registry / Remote code execution / @tapi-dev/sdk / 0.2.8

@tapi-dev/sdk@0.2.8

Tapi's JavaScript/TypeScript SDK for **ServiceMaps, persistent browser sessions, code workflows, explicit recording, and read-only live view**. Requires Node 20+.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The package is not malicious on the inspected evidence because execution requires an explicit authenticated workflow-host action and no install hook exists. It remains risky because the remote service can supply code that the host imports without an independent authenticity check.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Run `tapi workflow host` or a workflow development command with valid Tapi credentials.

Impact

A compromised or malicious Tapi service account can execute arbitrary JavaScript with the host user's permissions.

Mechanism

Imports remote workflow source as a local Node.js module.

AI rationale

Evidence

dist/workflow-cli.jsdist/workflow-source.jsdist/workflow-worker.js

Network endpoints1

determined-motivation-production.up.railway.app

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The explicit workflow-host feature accepts jobs from the Tapi service and executes their supplied JavaScript locally.
The worker writes supplied source to a temporary module and imports it without a sandbox.
The source only compares the received source to a digest supplied alongside it; it does not establish an independent publisher signature.

Evidence against

package.json has no install, preinstall, or postinstall hook; its lifecycle scripts are publish-time only.
Job hosting is reached through explicit `tapi workflow host` or workflow development commands and requires credentials.
No source evidence shows credential harvesting, covert exfiltration, persistence, or automatic execution on package installation.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

15 flagged

dist/auth.jsView file

Lines 1-26javascript

1import { randomUUID } from "node:crypto";

2import { existsSync, readFileSync } from "node:fs";

3import { mkdir, rename, rm, writeFile } from "node:fs/promises";

4import { homedir } from "node:os";

5import { dirname, join } from "node:path";

6const DEFAULT_FIREBASE_API_KEY = "AIzaSyCDZR8lWyVQcWYfFdNZa4vuL4IWEC0h6gE";

High

High Secret

Package contains a high-severity secret pattern.

dist/auth.jsView on unpkg · L6

High

Secret Pattern

Google API key in dist/auth.js

dist/auth.jsView on unpkg · L6

7const DEFAULT_EXPIRY_SKEW_MS = 60_000;

8export function getTapiDataDir() {

9 if (process.platform === "win32") {

10 return join(process.env.LOCALAPPDATA || join(process.env.USERPROFILE || homedir(), "AppData", "Local"), "Tapi");

11 }

12 return join(process.env.XDG_DATA_HOME || join(homedir(), ".local", "share"), "tapi");

13}

14export function getTapiAuthCachePath(options = {}) {

15 return options.cachePath || join(getTapiDataDir(), "auth.json");

16}

17export function readTapiCredentials(options = {}) {

18 const path = getTapiAuthCachePath(options);

19 if (!existsSync(path))

20 return null;

21 try {

22 const value = JSON.parse(readFileSync(path, "utf8"));

23 const credentials = {

24 uid: String(value.uid || "").trim(),

25 idToken: String(value.id_token || "").trim(),

26 refreshToken: String(value.refresh_token || "").trim(),

dist/workflow-cli.jsView file

Lines 1-23javascript

1import { mkdir, writeFile } from "node:fs/promises";

2import { loadWorkspace } from "./workspace.js";

3import { resolve, join } from "node:path";

4import { spawn } from "node:child_process";

dist/studio-dev.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { createServer } from "node:net";

3import { existsSync, readFileSync } from "node:fs";

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

dist/studio-dev.jsView on unpkg · L1

Critical

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tapi-dev/sdk@0.1.45 matchedIdentity = npm:QHRhcGktZGV2L3Nkaw:0.1.45 similarity = 0.611 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: import { mkdir, readFile, readdir, rename, rm, stat, statfs, unlink, writeFile } from "node:fs/promises"; import { emitKeypressEvents } from "node:readline"; raw.apiBaseUrl = requireOptionValue(args, ++index, arg); raw.apiBaseUrl = arg.slice("--api-base-url=".length); raw.apiBaseUrl = arg.slice("--server=".length); const apiBaseUrl = normalizeHttpUrl(raw.apiBaseUrl const downloadsBaseUrl = normalizeHttpUrl(envString("TAPI_DOWNLOADS_BASE_URL") ?? DEFAULT_DOWNLOADS_BASE_URL, "TAPI_DOWNLOADS_BASE_URL"); : `${downloadsBaseUrl.replace(/\/+$/, "")}/studio/channels/${channel}/latest.json`;

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @tapi-dev/sdk@0.2.6 matchedPath = dist/cli.js matchedIdentity = npm:QHRhcGktZGV2L3Nkaw:0.2.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

dist/runner-dev.jsView file

•matchType = normalized_sha256 matchedPackage = @tapi-dev/sdk@0.2.6 matchedPath = dist/runner-dev.js matchedIdentity = npm:QHRhcGktZGV2L3Nkaw:0.2.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runner-dev.jsView on unpkg

dist/workflow-source.jsView file

•matchType = normalized_sha256 matchedPackage = @tapi-dev/sdk@0.2.6 matchedPath = dist/workflow-source.js matchedIdentity = npm:QHRhcGktZGV2L3Nkaw:0.2.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/workflow-source.jsView on unpkg

Source & flagged code

15 flagged · loading source

dist/auth.jsView file

6patternName = google_api_key severity = high line = 6

High

High Secret

Package contains a high-severity secret pattern.

dist/auth.jsView on unpkg · L6

6patternName = google_api_key severity = high line = 6

High

Secret Pattern

Google API key in dist/auth.js

dist/auth.jsView on unpkg · L6

dist/workflow-cli.jsView file

3import { resolve, join } from "node:path"; L4: import { spawn } from "node:child_process"; L5: import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

dist/workflow-cli.jsView on unpkg · L3

Findings

3 Critical12 High4 Medium6 Low

CriticalReverse Shelldist/studio-dev.js

CriticalTrigger Reachable Dangerous Capabilitydist/studio-dev.js

CriticalPrevious Version Dangerous Deltadist/cli.js

HighHigh Secretdist/auth.js

HighChild Processdist/workflow-cli.js

HighShelldist/studio-dev.js

HighCredential Redirect Persistencedist/cli.js

HighSandbox Evasion Gated Capabilitydist/studio-dev.js

HighCross File Remote Execution Contextdist/workflow-cli.js

HighKnown Malware Source Similaritydist/cli.js

HighKnown Malware Source Similaritydist/studio-dev.js

HighKnown Malware Source Similarity

Affected versions and remediation

This report applies to @tapi-dev/sdk@0.2.8.

See all versions of @tapi-dev/sdk for other recorded verdicts.

Review the evidence and your use of @tapi-dev/sdk@0.2.8 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-15 17:34:28.109Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.