registry / Remote code execution / @tapi-dev/sdk / 0.3.0

@tapi-dev/sdk@0.3.0

Tapi's JavaScript/TypeScript SDK for **ServiceMaps, persistent browser sessions, code workflows, explicit recording, and read-only live view**. Requires Node 20+.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is a dangerous remote-code-execution capability with no automatic npm lifecycle trigger. The code is therefore suspicious rather than confirmed malicious.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A user runs the service installer, workflow host, workflow development, or runner development CLI command.

Impact

A compromised service endpoint or untrusted workflow can execute code with the invoking user's permissions.

Mechanism

Remote artifact installation and unsandboxed dynamic workflow import.

AI rationale

This is a dangerous remote-code-execution capability with no automatic npm lifecycle trigger. The code is therefore suspicious rather than confirmed malicious.

Evidence

dist/cli.jsdist/workflow-worker.jsdist/runner-dev.js

Network endpoints2

d4xaf52nfwiok.cloudfront.netdetermined-motivation-production.up.railway.app

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The explicit service-install command downloads a server-selected archive and runs its installer through PowerShell with execution-policy bypass.
Workflow host mode writes supplied workflow source to a temporary module and dynamically imports it without a sandbox.
Developer-runner setup starts a Python module from the selected workspace with inherited environment variables.

Evidence against

package.json has no install, preinstall, or postinstall hook; its only lifecycle-like hook is prepublishOnly.
The risky paths are reached through named CLI commands rather than package installation or ordinary import.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

Source & flagged code

14 flagged

dist/auth.jsView file

6patternName = google_api_key severity = high line = 6

High

High Secret

Package contains a high-severity secret pattern.

dist/auth.jsView on unpkg · L6

6patternName = google_api_key severity = high line = 6

High

Secret Pattern

Google API key in dist/auth.js

dist/auth.jsView on unpkg · L6

dist/workflow-cli.jsView file

Lines 1-23javascript

1import { mkdir, writeFile } from "node:fs/promises";

2import { loadWorkspace } from "./workspace.js";

3import { resolve, join } from "node:path";

4import { spawn } from "node:child_process";

5import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

dist/workflow-cli.jsView on unpkg · L3

6import { TapiClient } from "./index.js";

7import { DEFAULT_DEV_API, resolveDevContext } from "./dev-context.js";

8import { bundleWorkflow, serveWorkflowJobs } from "./workflow-source.js";

9export function workspaceArguments(args) {

10 const root = resolve(option(args, "--workspace") || process.cwd());

11 const workspace = loadWorkspace(root);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/workflow-cli.jsView on unpkg · L3

12 const config = workspace?.config;

13 const result = [...args];

14 if (!option(args, "--workspace") && workspace)

15 result.push("--workspace", workspace.root);

16 if (!option(args, "--tapp") && config?.tappId)

17 result.push("--tapp", config.tappId);

18 if (!option(args, "--server") && config?.apiBaseUrl)

19 result.push("--server", config.apiBaseUrl);

20 return result;

21}

22export async function runWorkflowCli(command, args, credentials) {

23 if (args.includes("--help")) {

dist/studio-dev.jsView file

1import { spawn } from "node:child_process"; L2: import { createServer } from "node:net"; L3: import { existsSync, readFileSync } from "node:fs"; ... L22: const phases = [{ message: "SDK development launch requested" }]; L23: const workspaceRoot = findWorkspaceRoot(options.workspaceRoot || process.cwd()); L24: const uiRoot = join(workspaceRoot, "tapi_v3", "studio", "browser"); ... L39: const env = { L40: ...process.env, L41: TAPI_DEV_CONFIG: runner.context.configPath, ... L49: phases.push({ message: "Vite UI is ready", detail: `${DEV_HOST}:${uiPort}` }); L50: const launchTrace = Buffer.from(JSON.stringify({ phases }), "utf8").toString("base64url"); L51: const url = `http://${DEV_HOST}:${uiPort}/?tapp=${encodeURIComponent(tappId)}&tapiDevLaunch=${launchTrace}`;

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

dist/studio-dev.jsView on unpkg · L1

1Trigger-reachable chain: manifest.bin -> dist/cli.js -> dist/studio-dev.js L1: import { spawn } from "node:child_process"; L2: import { createServer } from "node:net"; L3: import { existsSync, readFileSync } from "node:fs"; ... L22: const phases = [{ message: "SDK development launch requested" }]; L23: const workspaceRoot = findWorkspaceRoot(options.workspaceRoot || process.cwd()); L24: const uiRoot = join(workspaceRoot, "tapi_v3", "studio", "browser"); ... L39: const env = { L40: ...process.env, L41: TAPI_DEV_CONFIG: runner.context.configPath, ... L49: phases.push({ message: "Vite UI is ready", detail: `${DEV_HOST}:${uiPort}` }); L50: const launchTrace = Buffer.from(JSON.stringify({ phases }), "utf8").toString("base64url"); L51: const url = `http://${DEV_HOST}:${uiPort}/?tapp=${encodeURIC

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/studio-dev.jsView on unpkg · L1

dist/cli.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: import { mkdir, readFile, readdir, rename, rm, stat, statfs, unlink, writeFile } from "node:fs/promises"; import { emitKeypressEvents } from "node:readline"; raw.apiBaseUrl = requireOptionValue(args, ++index, arg); raw.apiBaseUrl = arg.slice("--api-base-url=".length); raw.apiBaseUrl = arg.slice("--server=".length); const apiBaseUrl = normalizeHttpUrl(raw.apiBaseUrl const downloadsBaseUrl = normalizeHttpUrl(envString("TAPI_DOWNLOADS_BASE_URL") ?? DEFAULT_DOWNLOADS_BASE_URL, "TAPI_DOWNLOADS_BASE_URL"); : `${downloadsBaseUrl.replace(/\/+$/, "")}/studio/channels/${channel}/latest.json`;

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @tapi-dev/sdk@0.2.6 matchedPath = dist/cli.js matchedIdentity = npm:QHRhcGktZGV2L3Nkaw:0.2.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

27patternName = google_api_key severity = high line = 27

High

Secret Pattern

Google API key in dist/cli.js

dist/cli.jsView on unpkg · L27

dist/runner-dev.jsView file

•matchType = normalized_sha256 matchedPackage = @tapi-dev/sdk@0.2.6 matchedPath = dist/runner-dev.js matchedIdentity = npm:QHRhcGktZGV2L3Nkaw:0.2.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runner-dev.jsView on unpkg

dist/workflow-source.jsView file

•matchType = normalized_sha256 matchedPackage = @tapi-dev/sdk@0.2.6 matchedPath = dist/workflow-source.js matchedIdentity = npm:QHRhcGktZGV2L3Nkaw:0.2.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/workflow-source.jsView on unpkg

Source & flagged code

14 flagged · loading source

dist/auth.jsView file

6patternName = google_api_key severity = high line = 6

High

High Secret

Package contains a high-severity secret pattern.

dist/auth.jsView on unpkg · L6

6patternName = google_api_key severity = high line = 6

High

Secret Pattern

Google API key in dist/auth.js

dist/auth.jsView on unpkg · L6

dist/workflow-cli.jsView file

3import { resolve, join } from "node:path"; L4: import { spawn } from "node:child_process"; L5: import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

dist/workflow-cli.jsView on unpkg · L3

Findings

2 Critical12 High4 Medium6 Low

CriticalReverse Shelldist/studio-dev.js

CriticalTrigger Reachable Dangerous Capabilitydist/studio-dev.js

HighHigh Secretdist/auth.js

HighChild Processdist/workflow-cli.js

HighShelldist/studio-dev.js

HighCredential Redirect Persistencedist/cli.js

HighSandbox Evasion Gated Capabilitydist/studio-dev.js

HighCross File Remote Execution Contextdist/workflow-cli.js

HighKnown Malware Source Similaritydist/cli.js

HighKnown Malware Source Similaritydist/studio-dev.js

HighKnown Malware Source Similaritydist/runner-dev.js

HighKnown Malware Source Similarity

Affected versions and remediation

This report applies to @tapi-dev/sdk@0.3.0.

See all versions of @tapi-dev/sdk for other recorded verdicts.

Review the evidence and your use of @tapi-dev/sdk@0.3.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-17 16:39:38.377Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.