registry / @sentropic/h2a-runtime / 0.98.8
@sentropic/h2a-runtime@0.98.8
h2a heavy runtime (sessions / k8s / tunnel, node-pty + aws-sdk). Lazily imported by @sentropic/h2a; installed separately.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package has no install lifecycle hook, and its CLI dispatcher runs only when the entry point is invoked directly. The flagged plugin setup writes agent MCP configuration as part of an explicit `plugin add` operation.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A user invokes the `plugin add` command.
Impact
The selected plugin becomes available to the configured agent; no unauthorized or automatic change was identified.
Mechanism
The command can install a selected plugin and register its MCP server in the relevant agent configuration.
AI rationale
The package has no install lifecycle hook, and its CLI dispatcher runs only when the entry point is invoked directly. The flagged plugin setup writes agent MCP configuration as part of an explicit `plugin add` operation.
Evidence
~/.claude.json~/.gemini/config/mcp_config.json~/.codex/config.toml
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines a build script but no install, preinstall, or postinstall hook.
- The entry point runs its CLI only when invoked directly, so importing it does not launch the command dispatcher.
- Plugin installation and agent MCP configuration writes are part of the explicit `plugin add` command.
Evidence against
- The CLI can install user-selected plugins and update agent MCP configuration files.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
15 flaggeddist/pty.jsView file
94package = @sentropic/h2a-runtime; repositoryIdentity = h2a; dependency = node-pty
L94: try {
L95: require("node-pty");
L96: }
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/pty.jsView on unpkg · L94•matchType = normalized_sha256
matchedPackage = @sentropic/h2a-runtime@0.98.7
matchedPath = dist/pty.js
matchedIdentity = npm:QHNlbnRyb3BpYy9oMmEtcnVudGltZQ:0.98.7
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/pty.jsView on unpkgdist/plugin.jsView file
•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
nd, args: [...args] };
root.mcpservers = servers;
return json.stringify(root, null, 2) + "\n";
}
export function mergeclaudemcpservers(json, name, command, args) {
return mergemcpserversjson(json, name, command, args, "claude.json");
}
export function mergeagymcpservers(json, name, command, args) {
return mergemcpserversjson(json, name, command, args, "mcp_config.json");
}
Findings
15 High3 Medium4 Low
HighCopied Package Dependency Bridgedist/pty.js
HighExternal Ai Agent Control Surface Mutationdist/plugin.js
HighSemantic Analysis Limiteddist/auth-tools.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/claude-code-cli-runner.js
HighKnown Malware Source Similaritydist/llm-mesh-accounts.js
HighKnown Malware Source Similaritydist/pty.js
HighKnown Malware Source Similaritydist/central-mcp.js
HighKnown Malware Source Similaritydist/delegate.js
HighKnown Malware Source Similaritydist/gateway-host/daemon.js
HighKnown Malware Source Similaritydist/gateway-host/live-object-store.js
HighKnown Malware Source Similarity
Affected versions and remediation
This report applies to @sentropic/h2a-runtime@0.98.8.
See all versions of @sentropic/h2a-runtime for other recorded verdicts.
- Review the evidence and your use of @sentropic/h2a-runtime@0.98.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.