registry / Remote code execution / @tahc.ia/tahcia
@tahc.ia/tahcia
Tahcia CLI tunnel
This report shows the evidence for @tahc.ia/tahcia@1.0.14. 1 of 4 known versions is blocked or flagged. The newest version, 1.0.16, is flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a concrete remote-command and sensitive-data collection channel, not merely a local automation primitive. Lack of an install hook reduces install-time risk but does not remove the runtime attack surface.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs the tahcia CLI with a session/API key and connects.
Impact
Remote code execution and exfiltration of command output, screenshots, OCR text, and window metadata.
Mechanism
Remote WebSocket command execution and macOS screen/input control.
Attack narrative
On explicit CLI use, the package connects to the Tahcia backend. Its WebSocket message handler accepts system commands: the "shell" action passes backend-controlled text to execSync and sends command output back; other actions invoke the bundled macOS binary for screenshots, OCR, active-window enumeration, input, and app control. The optional Antigravity helper also starts an allow-all agent and returns its task output to the same service.
AI rationale
This is a concrete remote-command and sensitive-data collection channel, not merely a local automation primitive. Lack of an install hook reduces install-time risk but does not remove the runtime attack surface.
Evidence
package.jsontahcia.jstahcia-antigravity.pytahcia-mac~/.tahcia/config.env
Network endpoints2
api.tahcia.comwss://api.tahcia.com/wss
Decision evidence
public snapshotAI called this Malicious at 95.0% confidence as Malware with low false-positive risk.
Evidence for block
- tahcia.js connects to api.tahcia.com WebSocket and processes server messages.
- System message action "shell" runs cmd.text via execSync and returns stdout.
- Server-directed screenshot, OCR, window metadata, keyboard and mouse actions use tahcia-mac.
- tahcia-antigravity.py enables allow_all agent policy and posts task output to the API.
Evidence against
- package.json has no install lifecycle hooks.
- Activation requires an explicit CLI invocation and session identifier/API key.
- Importing tahcia.js alone exports code; CLI behavior is argument-triggered.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
8 flagged · loading sourcetahcia.jsView file
10198var WebSocket = require_ws();
L10199: var { execSync } = require("child_process");
L10200: var path2 = require("path");
High
27kStatusCode: /* @__PURE__ */ Symbol("status-code"),
L28: kWebSocket: /* @__PURE__ */ Symbol("websocket"),
L29: NOOP: () => {
...
L80: } else {
L81: buf = Buffer.from(data);
L82: toBuffer.readOnly = false;
...
L92: };
L93: if (!process.env.WS_NO_BUFFER_UTIL) {
L94: try {
...
L144: *
L145: * @private
L146: */
High
Host Fingerprint Exfiltration
Source collects local host identity data and sends it to an external endpoint.
tahcia.jsView on unpkg · L2710990if (sessionId == "--version" || sessionId == "--v") {
L10991: process.stdout.write(`v${VERSION}
L10992: `);
...
L10995: if (restArgs.length > 0 && restArgs[0] === "antigravity") {
L10996: const { execSync } = require("child_process");
L10997: const https = require("https");
L10998: const subArgs = restArgs.slice(1);
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
tahcia.jsFindings
5 High5 Medium5 Low
HighChild Processtahcia.js
HighHost Fingerprint Exfiltrationtahcia.js
HighCommand Output Exfiltrationtahcia.js
HighSandbox Evasion Gated Capabilitytahcia.js
HighTrigger Reachable Command Output Exfiltrationtahcia.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarytahcia-mac
MediumShips Build Helpertahcia-antigravity.py
MediumStructural Risk Force Deep Review
LowWeak Cryptotahcia.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @tahc.ia/tahcia@1.0.14.
The versions list below shows the verdict for each recorded version.
- Avoid installing @tahc.ia/tahcia@1.0.14. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.