registry / @tangle-network/sandbox-cli / 0.21.14
@tangle-network/sandbox-cli@0.21.14
CLI for Tangle Sandbox operations
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package presents itself as a sandbox operations CLI, has no install hooks, and dispatches graph execution through an explicit command. The flagged credential, network, and process behavior is consistent with its agent workflows; the inspected worker path strips the Tangle API key before spawning agents.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The CLI processes arguments at startup; graph execution and other operations require an explicit command.
Impact
Expected operation can transmit user task content to the configured agent or provider and write run records under the user's Tangle directory; no unrelated credential collection or transmission was identified.
Mechanism
Graph runs create a temporary loopback bridge, then execute the selected graph. Configured provider keys are routed to the selected provider; the Tangle API key is removed from worker environments.
AI rationale
The package presents itself as a sandbox operations CLI, has no install hooks, and dispatches graph execution through an explicit command. The flagged credential, network, and process behavior is consistent with its agent workflows; the inspected worker path strips the Tangle API key before spawning agents.
Evidence
.tangle/runs.tangle/graph-registry
Network endpoints5
router.tangle.toolsapi.openai.comapi.anthropic.comapi.moonshot.aiapi.z.ai
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a Tangle Sandbox CLI, points its executable to bin/tangle.js, and declares no install lifecycle scripts.
- The executable imports the CLI bundle; the bundle starts parsing process arguments, consistent with a command-line entry point.
- Graph execution is exposed as an explicit `graph run` command described as running a saved graph over local subscriptions; its embedded bridge binds to 127.0.0.1 and closes after the run.
- The CLI removes TANGLE_API_KEY from the environment passed to spawned workers.
- The inspected passthrough backend sends configured provider credentials to the corresponding provider endpoint for a selected model.
Evidence against
- The manifest includes cli-bridge as a dependency from a pinned GitHub archive URL.
- The CLI bundle uses filesystem, network, and child-process APIs, which account for several scanner alerts but are used for sandbox and agent operations.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
Source & flagged code
7 flaggeddist/index.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @tangle-network/sandbox-cli@0.20.50
matchedIdentity = npm:[redacted]:0.20.50
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.mjsView on unpkg1import{createRequire as e}from"node:module";import"dotenv/config";import{ALL_BACKEND_TYPES as t,AuthError as n,GPU_LEASE_PROVIDER_NAMES as r,NetworkError as i,NotFoundError as a,Pu...
L2: `);return`Hub connection reference is ambiguous: "${e}" matches ${t.length} connections. Use a connection id or provider:account instead.
High
1import{createRequire as e}from"node:module";import"dotenv/config";import{ALL_BACKEND_TYPES as t,AuthError as n,GPU_LEASE_PROVIDER_NAMES as r,NetworkError as i,NotFoundError as a,Pu...
L2: `);return`Hub connection reference is ambiguous: "${e}" matches ${t.length} connections. Use a connection id or provider:account instead.
Findings
1 Critical5 High3 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/index.mjs
HighChild Processdist/index.mjs
HighSame File Env Network Executiondist/index.mjs
HighCredential Redirect Persistencedist/index.mjs
HighCommand Output Exfiltrationdist/index.mjs
HighTrigger Reachable Command Output Exfiltrationdist/index.mjs
MediumNetwork
MediumEnvironment Vars
MediumRemote Tarball Dependencypackage.json
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @tangle-network/sandbox-cli@0.21.14.
See all versions of @tangle-network/sandbox-cli for other recorded verdicts.
- Review the evidence and your use of @tangle-network/sandbox-cli@0.21.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.