registry / @tangle-network/sandbox-cli / 0.21.42
@tangle-network/sandbox-cli@0.21.42
CLI for Tangle Sandbox operations
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe solve configuration embeds a private tailnet sponsor host and treats it as part of a trusted deployment, but the reviewed source does not establish harmful traffic or credential disclosure. This is an unresolved endpoint risk, so warn rather than block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Potentially when a user invokes the solve workflow that consumes this deployment configuration.
Impact
If used for sponsor requests, the host could receive solve-related transaction data or influence sponsorship. Credential theft was not established.
Mechanism
The bundle embeds a sponsor URL on a tailnet host and checks solve metadata against it; the inspected code did not establish what requests, if any, are sent there.
AI rationale
The solve configuration embeds a private tailnet sponsor host and treats it as part of a trusted deployment, but the reviewed source does not establish harmful traffic or credential disclosure. This is an unresolved endpoint risk, so warn rather than block.
Evidence
dist/index.mjs
Network endpoints1
drew-gtr-pro.taild10bfc.ts.net
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The bundle hard-codes a solve sponsor endpoint at drew-gtr-pro.taild10bfc.ts.net.
- Solve metadata is checked against that hard-coded sponsor endpoint as part of a “trusted deployment” check.
Evidence against
- Native Claude credential enrollment launches the user’s local setup-token flow and stores the result as a requested Sandbox secret.
- The Claude subprocess has inherited Anthropic credential and base-URL variables cleared, and its OAuth URL is restricted to Claude’s official authorization hosts.
- The package is a CLI with a bin entry; the reviewed sponsor code does not establish that credentials are sent to the tailnet host.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
8 flaggeddist/index.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @tangle-network/sandbox-cli@0.20.50
matchedIdentity = npm:[redacted]:0.20.50
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.mjsView on unpkg1import{createRequire as e,findPackageJSON as t}from"node:module";import"dotenv/config";import{ALL_BACKEND_TYPES as n,AuthError as r,GPU_LEASE_PROVIDER_NAMES as i,NetworkError as a,...
L2: `);return`Hub connection reference is ambiguous: "${e}" matches ${t.length} connections. Use a connection id or provider:account instead.
High
1import{createRequire as e,findPackageJSON as t}from"node:module";import"dotenv/config";import{ALL_BACKEND_TYPES as n,AuthError as r,GPU_LEASE_PROVIDER_NAMES as i,NetworkError as a,...
L2: `);return`Hub connection reference is ambiguous: "${e}" matches ${t.length} connections. Use a connection id or provider:account instead.
Findings
1 Critical6 High3 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/index.mjs
HighChild Processdist/index.mjs
HighSame File Env Network Executiondist/index.mjs
HighCredential Redirect Persistencedist/index.mjs
HighCommand Output Exfiltrationdist/index.mjs
HighTrigger Reachable Command Output Exfiltrationdist/index.mjs
HighSemantic Analysis Limiteddist/graph-viewer/record-part-CZal_IMH.js#virtual:string-array:round1
MediumNetwork
MediumEnvironment Vars
MediumRemote Tarball Dependencypackage.json
LowScripts Present
LowEval
LowFilesystem
Affected versions and remediation
This report applies to @tangle-network/sandbox-cli@0.21.42.
See all versions of @tangle-network/sandbox-cli for other recorded verdicts.
- Review the evidence and your use of @tangle-network/sandbox-cli@0.21.42 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.