registry / @tangle-network/sandbox-cli / 0.21.54
@tangle-network/sandbox-cli@0.21.54
CLI for Tangle Sandbox operations
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe flagged credential flow is an explicit enrollment operation that obtains a token through Claude's native setup command and stores it in the sandbox secret service; it clears inherited Anthropic credential and endpoint variables. The unusual fixed sponsor host is tied to a Solve deployment and metadata is checked against it; no unrelated automatic data collection or exfiltration was established.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
CLI startup parses arguments; native credential enrollment and Solve network actions require their respective commands.
Impact
No automatic credential exfiltration, install-time contact, or unrelated command-output transmission was established.
Mechanism
The reviewed Claude flow prompts through the native CLI, removes inherited Anthropic credentials and endpoint overrides, and stores the returned token using the sandbox secrets API. Solve requests use pinned deployment configuration.
AI rationale
The flagged credential flow is an explicit enrollment operation that obtains a token through Claude's native setup command and stores it in the sandbox secret service; it clears inherited Anthropic credential and endpoint variables. The unusual fixed sponsor host is tied to a Solve deployment and metadata is checked against it; no unrelated automatic data collection or exfiltration was established.
Network endpoints2
drew-gtr-pro.taild10bfc.ts.netrpc.moderato.tempo.xyz
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no lifecycle scripts; its executable is the Tangle CLI and its main entry is dist/index.mjs.
- The native Claude credential flow runs `claude setup-token` only as part of an explicit secret-enrollment action, clears inherited Anthropic credential and base-URL variables, then stores the prompted token through the sandbox secrets API.
- The Solve sponsor endpoint is part of a pinned deployment configuration, and the code checks it against trusted deployment metadata.
- The entry point parses CLI arguments and dispatches commands; no import-time data collection or unrelated command execution was identified.
Evidence against
- The Solve configuration includes a fixed sponsor URL on `drew-gtr-pro.taild10bfc.ts.net`; the inspected code ties it to a Solve deployment and validates metadata against that configured URL.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
8 flaggeddist/index.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @tangle-network/sandbox-cli@0.20.50
matchedIdentity = npm:[redacted]:0.20.50
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.mjsView on unpkg1import{createRequire as e,findPackageJSON as t}from"node:module";import"dotenv/config";import{ALL_BACKEND_TYPES as n,AuthError as r,GPU_LEASE_PROVIDER_NAMES as i,NetworkError as a,...
L2: `);return`Hub connection reference is ambiguous: "${e}" matches ${t.length} connections. Use a connection id or provider:account instead.
High
1import{createRequire as e,findPackageJSON as t}from"node:module";import"dotenv/config";import{ALL_BACKEND_TYPES as n,AuthError as r,GPU_LEASE_PROVIDER_NAMES as i,NetworkError as a,...
L2: `);return`Hub connection reference is ambiguous: "${e}" matches ${t.length} connections. Use a connection id or provider:account instead.
Findings
1 Critical6 High3 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/index.mjs
HighChild Processdist/index.mjs
HighSame File Env Network Executiondist/index.mjs
HighCredential Redirect Persistencedist/index.mjs
HighCommand Output Exfiltrationdist/index.mjs
HighTrigger Reachable Command Output Exfiltrationdist/index.mjs
HighSemantic Analysis Limiteddist/graph-viewer/record-part-CZal_IMH.js#virtual:string-array:round1
MediumNetwork
MediumEnvironment Vars
MediumRemote Tarball Dependencypackage.json
LowScripts Present
LowEval
LowFilesystem
Affected versions and remediation
This report applies to @tangle-network/sandbox-cli@0.21.54.
See all versions of @tangle-network/sandbox-cli for other recorded verdicts.
- Review the evidence and your use of @tangle-network/sandbox-cli@0.21.54 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.