registry / @tangle-network/sandbox-cli / 0.20.36
@tangle-network/sandbox-cli@0.20.36
CLI for Tangle Sandbox operations
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe scanner's high-severity signals resolve to intended CLI functions: credential-store and browser helpers, user-supplied sandbox execution, and explicitly configured agent telemetry. The manifest has no install hook, and inspected source shows neither credential transfer to an unrelated recipient nor autonomous command-output exfiltration.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs an authentication, sandbox, or telemetry CLI command.
Impact
No unintended credential disclosure or autonomous command-output transfer was established.
Mechanism
Authentication sends credentials to the fixed Tangle solve API. Telemetry configuration targets Tangle Intelligence and requires explicit setup; Claude Code shell changes require confirmation.
AI rationale
The scanner's high-severity signals resolve to intended CLI functions: credential-store and browser helpers, user-supplied sandbox execution, and explicitly configured agent telemetry. The manifest has no install hook, and inspected source shows neither credential transfer to an unrelated recipient nor autonomous command-output exfiltration.
Network endpoints2
solve.tangle.tools/api/solveintelligence.tangle.tools/v1/otlp
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and declares build, development, and check/test scripts; it declares no npm install lifecycle hook.
- Solve credentials are sent to the fixed Tangle solve API, and source rejects a different destination; credential login and storage run through the explicit login command.
- Telemetry setup is an explicit CLI command targeting Tangle Intelligence. Content forwarding is configurable, and Claude Code configuration changes require an affirmative prompt.
- The CLI executes a command supplied for the sandbox and prints returned output locally.
- Inspected dependency manifests list build and test scripts; reviewed runtime artifacts provide telemetry helpers, schema types, and Hub API clients.
Evidence against
- The CLI uses child-process and credential-store APIs for browser launching, OS credential access, and user-invoked sandbox operations.
- Agent prompt and tool content can be forwarded when telemetry is configured; the source ties this to explicit setup and Tangle's telemetry service.
Behavioral surface
ChildProcess
Source & flagged code
6 flaggeddist/index.mjsView file
1import{createRequire as e}from"node:module";import"dotenv/config";import{Command as t}from"commander";import{createHash as n,randomBytes as r,randomUUID as i}from"node:crypto";impo...
L2: `);return`Hub connection reference is ambiguous: "${e}" matches ${t.length} connections. Use a connection id or provider:account instead.
High
1import{createRequire as e}from"node:module";import"dotenv/config";import{Command as t}from"commander";import{createHash as n,randomBytes as r,randomUUID as i}from"node:crypto";impo...
L2: `);return`Hub connection reference is ambiguous: "${e}" matches ${t.length} connections. Use a connection id or provider:account instead.
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.mjsView on unpkg · L1•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.mjs:
import{createRequire as e}from"node:module";import"dotenv/config";import{Command as t}from"commander";import{createHash as n,randomBytes as r,randomUUID as i}from"node:crypto";impo...
`+n}function qn(e,t){return[...t,e]}async function Jn(e,t){let n=e.map(e=>{let t=e.trim(),n=t.indexOf(`:`);return n===-1?{raw:e,ref:null,tail:null}:{raw:e,ref:t.slice(0,n).trim(),t...
}`}}function Hr(e){return{anthropic:`Anthropic Messages API (Claude)`,openai:`OpenAI Chat Completions (function calling)`,"vercel-ai":`Vercel AI SDK (generateText / streamText)`,ma...
`),e(t.trim())})})}async function V(e,t){let n=(await import(`node:readline
Findings
5 High2 Medium5 Low
HighChild Processdist/index.mjs
HighSame File Env Network Executiondist/index.mjs
HighCredential Redirect Persistencedist/index.mjs
HighCommand Output Exfiltrationdist/index.mjs
HighTrigger Reachable Command Output Exfiltrationdist/index.mjs
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @tangle-network/sandbox-cli@0.20.36.
See all versions of @tangle-network/sandbox-cli for other recorded verdicts.
- Review the evidence and your use of @tangle-network/sandbox-cli@0.20.36 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.