registry / @tangle-network/sandbox-cli / 0.21.35
@tangle-network/sandbox-cli@0.21.35
CLI for Tangle Sandbox operations
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe bundle hard-codes a non-obvious Tailscale host as the trusted relay for Solve transactions, creating a meaningful trust and transaction-privacy concern. I found no source evidence that it steals credentials or submits transactions automatically, so this merits a warning rather than a publish block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Invoking the Solve workflow that creates a Tempo wallet client.
Impact
The relay receives transaction sponsorship requests and may observe signed transaction data; the inspected source does not show private-key transmission or automatic transaction submission.
Mechanism
The wallet client routes sponsored transactions through the fixed relay URL in dist/index.mjs.
AI rationale
The bundle hard-codes a non-obvious Tailscale host as the trusted relay for Solve transactions, creating a meaningful trust and transaction-privacy concern. I found no source evidence that it steals credentials or submits transactions automatically, so this merits a warning rather than a publish block.
Evidence
dist/index.mjs
Network endpoints2
drew-gtr-pro.taild10bfc.ts.net/solve-sponsorrpc.moderato.tempo.xyz
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The bundle hard-codes a developer-looking Tailscale URL as the Solve sponsor relay.
- Solve metadata is required to match that hard-coded relay, so the endpoint cannot be changed through competition metadata.
- The wallet client uses the sponsor URL as its transaction relay transport.
- The manifest exposes the bundle as both the CLI entry point and the package main.
Evidence against
- The manifest shows no install, preinstall, or postinstall hook.
- The relay setup appears in a Solve transaction workflow; the inspected source does not show it sending credentials or running automatically on install.
- The credential enrollment flow inspected prompts for Claude authorization and removes existing Claude credentials from the child process environment.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinified
Source & flagged code
8 flaggeddist/index.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @tangle-network/sandbox-cli@0.20.50
matchedIdentity = npm:[redacted]:0.20.50
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.mjsView on unpkg1import{createRequire as e}from"node:module";import"dotenv/config";import{ALL_BACKEND_TYPES as t,AuthError as n,GPU_LEASE_PROVIDER_NAMES as r,NetworkError as i,NotFoundError as a,Pu...
L2: `);return`Hub connection reference is ambiguous: "${e}" matches ${t.length} connections. Use a connection id or provider:account instead.
High
1import{createRequire as e}from"node:module";import"dotenv/config";import{ALL_BACKEND_TYPES as t,AuthError as n,GPU_LEASE_PROVIDER_NAMES as r,NetworkError as i,NotFoundError as a,Pu...
L2: `);return`Hub connection reference is ambiguous: "${e}" matches ${t.length} connections. Use a connection id or provider:account instead.
Findings
1 Critical6 High3 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/index.mjs
HighChild Processdist/index.mjs
HighSame File Env Network Executiondist/index.mjs
HighCredential Redirect Persistencedist/index.mjs
HighCommand Output Exfiltrationdist/index.mjs
HighTrigger Reachable Command Output Exfiltrationdist/index.mjs
HighSemantic Analysis Limiteddist/graph-viewer/record-part-CZal_IMH.js#virtual:string-array:round1
MediumNetwork
MediumEnvironment Vars
MediumRemote Tarball Dependencypackage.json
LowScripts Present
LowEval
LowFilesystem
Affected versions and remediation
This report applies to @tangle-network/sandbox-cli@0.21.35.
See all versions of @tangle-network/sandbox-cli for other recorded verdicts.
- Review the evidence and your use of @tangle-network/sandbox-cli@0.21.35 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.