registry / @tangle-network/sandbox-cli / 0.21.32
@tangle-network/sandbox-cli@0.21.32
CLI for Tangle Sandbox operations
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package is a CLI with no install lifecycle hook. The flagged credential flow is an explicit Claude enrollment command, and the inspected code sends its token to the configured Sandbox API after browser authorization; no automatic exfiltration was found.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The CLI parses the invoked command at startup; credential enrollment runs only when the user requests it.
Impact
No automatic credential redirection, install-time data collection, or unrelated command execution was found.
Mechanism
The enrollment command obtains a Claude token through its setup-token flow and stores it as a named secret through the configured Sandbox API.
AI rationale
The package is a CLI with no install lifecycle hook. The flagged credential flow is an explicit Claude enrollment command, and the inspected code sends its token to the configured Sandbox API after browser authorization; no automatic exfiltration was found.
Network endpoints3
router.tangle.toolsintelligence.tangle.toolsdrew-gtr-pro.taild10bfc.ts.net
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest declares no install, preinstall, or postinstall lifecycle script; its executable is the `tangle` CLI.
- The Claude credential-enrollment flow is explicitly labeled `--from-login claude` and asks the user to authorize in Claude’s browser.
- Enrollment requires a credential-free HTTPS Sandbox API URL and stores the token through that API’s secret-creation method.
- The token is extracted from the expected Claude setup-token output; the spawned process has Anthropic credential variables unset.
Evidence against
- The CLI invokes child processes, accesses environment variables, and makes network requests as part of its sandbox and agent-management features.
- The bundle contains a fixed `drew-gtr-pro.taild10bfc.ts.net` sponsor URL, used in solve deployment metadata validation; no credential-exfiltration flow to it was identified.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
8 flaggeddist/index.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @tangle-network/sandbox-cli@0.20.50
matchedIdentity = npm:[redacted]:0.20.50
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.mjsView on unpkg1import{createRequire as e}from"node:module";import"dotenv/config";import{ALL_BACKEND_TYPES as t,AuthError as n,GPU_LEASE_PROVIDER_NAMES as r,NetworkError as i,NotFoundError as a,Pu...
L2: `);return`Hub connection reference is ambiguous: "${e}" matches ${t.length} connections. Use a connection id or provider:account instead.
High
1import{createRequire as e}from"node:module";import"dotenv/config";import{ALL_BACKEND_TYPES as t,AuthError as n,GPU_LEASE_PROVIDER_NAMES as r,NetworkError as i,NotFoundError as a,Pu...
L2: `);return`Hub connection reference is ambiguous: "${e}" matches ${t.length} connections. Use a connection id or provider:account instead.
Findings
1 Critical6 High3 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/index.mjs
HighChild Processdist/index.mjs
HighSame File Env Network Executiondist/index.mjs
HighCredential Redirect Persistencedist/index.mjs
HighCommand Output Exfiltrationdist/index.mjs
HighTrigger Reachable Command Output Exfiltrationdist/index.mjs
HighSemantic Analysis Limiteddist/graph-viewer/record-part-CZal_IMH.js#virtual:string-array:round1
MediumNetwork
MediumEnvironment Vars
MediumRemote Tarball Dependencypackage.json
LowScripts Present
LowEval
LowFilesystem
Affected versions and remediation
This report applies to @tangle-network/sandbox-cli@0.21.32.
See all versions of @tangle-network/sandbox-cli for other recorded verdicts.
- Review the evidence and your use of @tangle-network/sandbox-cli@0.21.32 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.