registry / @tapi-dev/sdk / 0.2.9

@tapi-dev/sdk@0.2.9

Tapi's JavaScript/TypeScript SDK for **ServiceMaps, persistent browser sessions, code workflows, explicit recording, and read-only live view**. Requires Node 20+.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Scanner reverse-shell and malware-similarity hits are readable Studio and Runner development code, not a remote shell or hidden implant. There is no install-time or import-time attack; remaining process and network use is user-invoked product behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

No automatic install or import trigger. Behavior starts when a user runs tapi commands or constructs TapiClient.

Impact

No unconsented impact established.

Mechanism

No confirmed attack; package-aligned SDK and CLI.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

studio-dev.js spawns npm to run a local Vite UI and uses a localhost net server only to pick a free port, which the scanner labeled reverse shell.
The tapi CLI can download CloudFront Studio artifacts and talk to a Railway API plus a GitLab Pages sign-in page, but only after the user runs login or studio/service commands.
runner-dev.js enrolls a workspace runner at the Railway API and starts local venv Python tapi_v3.runner.dev_mode from tapi runner dev.
workflow-source.js runs claimed workflow source in a local worker after a SHA-256 digest check.
package.json exposes dist/index.js and the tapi CLI with publisher-only prepack/prepublishOnly scripts, not install hooks.
Expired Tapi credentials cause requireTapiCredentials to throw and tell the user to run tapi login.
The workflow CLI starts tapi runner dev as a local Node child process with inherited stdio.

Evidence against

There is no npm preinstall, install, or postinstall script, so a normal registry install does not execute this package.
Importing dist/index.js only constructs HTTP client facades; it does not spawn processes or open sockets.
Child-process stdio is inherit, ignore, or local pipes or IPC, not wired to a remote socket.

Source & flagged code

14 flagged

dist/auth.jsView file

Lines 1-26javascript

1import { randomUUID } from "node:crypto";

2import { existsSync, readFileSync } from "node:fs";

3import { mkdir, rename, rm, writeFile } from "node:fs/promises";

4import { homedir } from "node:os";

5import { dirname, join } from "node:path";

6const DEFAULT_FIREBASE_API_KEY = "AIzaSyCDZR8lWyVQcWYfFdNZa4vuL4IWEC0h6gE";

High

High Secret

Package contains a high-severity secret pattern.

dist/auth.jsView on unpkg · L6

High

Secret Pattern

Google API key in dist/auth.js

dist/auth.jsView on unpkg · L6

7const DEFAULT_EXPIRY_SKEW_MS = 60_000;

8export function getTapiDataDir() {

9 if (process.platform === "win32") {

10 return join(process.env.LOCALAPPDATA || join(process.env.USERPROFILE || homedir(), "AppData", "Local"), "Tapi");

11 }

12 return join(process.env.XDG_DATA_HOME || join(homedir(), ".local", "share"), "tapi");

13}

14export function getTapiAuthCachePath(options = {}) {

15 return options.cachePath || join(getTapiDataDir(), "auth.json");

16}

17export function readTapiCredentials(options = {}) {

18 const path = getTapiAuthCachePath(options);

19 if (!existsSync(path))

20 return null;

21 try {

22 const value = JSON.parse(readFileSync(path, "utf8"));

23 const credentials = {

24 uid: String(value.uid || "").trim(),

25 idToken: String(value.id_token || "").trim(),

26 refreshToken: String(value.refresh_token || "").trim(),

dist/workflow-cli.jsView file

Lines 1-23javascript

1import { mkdir, writeFile } from "node:fs/promises";

2import { loadWorkspace } from "./workspace.js";

3import { resolve, join } from "node:path";

4import { spawn } from "node:child_process";

dist/studio-dev.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { createServer } from "node:net";

3import { existsSync, readFileSync } from "node:fs";

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

dist/studio-dev.jsView on unpkg · L1

Critical

dist/cli.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: import { mkdir, readFile, readdir, rename, rm, stat, statfs, unlink, writeFile } from "node:fs/promises"; import { emitKeypressEvents } from "node:readline"; raw.apiBaseUrl = requireOptionValue(args, ++index, arg); raw.apiBaseUrl = arg.slice("--api-base-url=".length); raw.apiBaseUrl = arg.slice("--server=".length); const apiBaseUrl = normalizeHttpUrl(raw.apiBaseUrl const downloadsBaseUrl = normalizeHttpUrl(envString("TAPI_DOWNLOADS_BASE_URL") ?? DEFAULT_DOWNLOADS_BASE_URL, "TAPI_DOWNLOADS_BASE_URL"); : `${downloadsBaseUrl.replace(/\/+$/, "")}/studio/channels/${channel}/latest.json`;

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @tapi-dev/sdk@0.2.6 matchedPath = dist/cli.js matchedIdentity = npm:QHRhcGktZGV2L3Nkaw:0.2.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

27patternName = google_api_key severity = high line = 27

High

Secret Pattern

Google API key in dist/cli.js

dist/cli.jsView on unpkg · L27

dist/runner-dev.jsView file

•matchType = normalized_sha256 matchedPackage = @tapi-dev/sdk@0.2.6 matchedPath = dist/runner-dev.js matchedIdentity = npm:QHRhcGktZGV2L3Nkaw:0.2.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runner-dev.jsView on unpkg

dist/workflow-source.jsView file

•matchType = normalized_sha256 matchedPackage = @tapi-dev/sdk@0.2.6 matchedPath = dist/workflow-source.js matchedIdentity = npm:QHRhcGktZGV2L3Nkaw:0.2.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/workflow-source.jsView on unpkg

Source & flagged code

14 flagged · loading source

dist/auth.jsView file

6patternName = google_api_key severity = high line = 6

High

High Secret

Package contains a high-severity secret pattern.

dist/auth.jsView on unpkg · L6

6patternName = google_api_key severity = high line = 6

High

Secret Pattern

Google API key in dist/auth.js

dist/auth.jsView on unpkg · L6

dist/workflow-cli.jsView file

3import { resolve, join } from "node:path"; L4: import { spawn } from "node:child_process"; L5: import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

dist/workflow-cli.jsView on unpkg · L3

Findings

2 Critical12 High4 Medium6 Low

CriticalReverse Shelldist/studio-dev.js

CriticalTrigger Reachable Dangerous Capabilitydist/studio-dev.js

HighHigh Secretdist/auth.js

HighChild Processdist/workflow-cli.js

HighShelldist/studio-dev.js

HighCredential Redirect Persistencedist/cli.js

HighSandbox Evasion Gated Capabilitydist/studio-dev.js

HighCross File Remote Execution Contextdist/workflow-cli.js

HighKnown Malware Source Similaritydist/cli.js

HighKnown Malware Source Similaritydist/studio-dev.js

HighKnown Malware Source Similaritydist/runner-dev.js

HighKnown Malware Source Similarity

Affected versions and remediation

This report applies to @tapi-dev/sdk@0.2.9.

See all versions of @tapi-dev/sdk for other recorded verdicts.

Review the evidence and your use of @tapi-dev/sdk@0.2.9 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-17 16:28:45.180Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.