registry / Credential exfiltration / @tapi-dev/sdk / 0.3.11

@tapi-dev/sdk@0.3.11

## Live Railway server diagnostics (operator MCP)

AI Security Review

scanned 21d ago · by lpm-firewall-ai

The active CLI forwards cached service credentials to an unrestricted configured endpoint, warranting a warning under the credential-forwarding policy. No separate concrete attack evidence supports blocking publication.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Run an authenticated workflow or development command with a custom server or workspace API configuration.

Impact

An operator-selected server could receive a token intended for Tapi.

Mechanism

The CLI obtains an existing Tapi token, selects the configured API destination without an allowlist, and sends bearer authentication there.

AI rationale

Evidence

dist/auth.jsdist/cli.jsdist/workflow-cli.jsdist/dev-context.jsdist/client.jsdist/runner-dev.jsauth.json

Network endpoints1

determined-motivation-production.up.railway.app

Decision evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json has no automatic install lifecycle hooks.
dist/auth.js reads existing Tapi credentials from its authentication cache.
dist/cli.js activates workflow commands with the cached credential provider.
dist/workflow-cli.js accepts a server from workspace configuration or --server and pairs it with the cached token.
dist/dev-context.js selects the configured server without enforcing a destination allowlist.
dist/client.js sends the token as bearer authentication to the selected endpoint; dist/runner-dev.js also forwards it during enrollment.

Evidence against

The default API destination is package-aligned.
The exposed behavior requires a user-invoked CLI command and a configured destination.
No concrete covert recipient or malicious install behavior was established.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Source & flagged code

13 flagged

dist/auth.jsView file

6patternName = google_api_key severity = high line = 6

High

High Secret

Package contains a high-severity secret pattern.

dist/auth.jsView on unpkg · L6

6patternName = google_api_key severity = high line = 6

High

Secret Pattern

Google API key in dist/auth.js

dist/auth.jsView on unpkg · L6

dist/workflow-cli.jsView file

3import { resolve, join } from "node:path"; L4: import { spawn } from "node:child_process"; L5: import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

dist/workflow-cli.jsView on unpkg · L3

3Cross-file remote execution chain: dist/workflow-cli.js spawns dist/cli.js; helper contains network access plus dynamic code execution. L3: import { resolve, join } from "node:path"; L4: import { spawn } from "node:child_process"; L5: import { fileURLToPath } from "node:url"; ... L9: export function workspaceArguments(args) { L10: const root = resolve(option(args, "--workspace") || process.cwd()); L11: const workspace = loadWorkspace(root); ... L111: throw new Error("Choose an existing session with --session; dev does not open or reset a browser"); L112: const job = await client.workflows.run({ sessionId, versionId: version.version_id, inputs: JSON.parse(option(expanded, "--input") || "{}") }); L113: await serveWorkflowJobs(options, { jobId: job.job_id, once: true });

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/workflow-cli.jsView on unpkg · L3

dist/cli.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: import { mkdir, readFile, readdir, rename, rm, stat, statfs, unlink, writeFile } from "node:fs/promises"; import { emitKeypressEvents } from "node:readline"; raw.apiBaseUrl = requireOptionValue(args, ++index, arg); raw.apiBaseUrl = arg.slice("--api-base-url=".length); raw.apiBaseUrl = arg.slice("--server=".length); const apiBaseUrl = normalizeHttpUrl(raw.apiBaseUrl const downloadsBaseUrl = normalizeHttpUrl(envString("TAPI_DOWNLOADS_BASE_URL") ?? DEFAULT_DOWNLOADS_BASE_URL, "TAPI_DOWNLOADS_BASE_URL"); : `${downloadsBaseUrl.replace(/\/+$/, "")}/studio/channels/${channel}/latest.json`;

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

•matchType = token_shingles matchedPackage = @tapi-dev/sdk@0.2.6 matchedPath = dist/cli.js matchedIdentity = npm:QHRhcGktZGV2L3Nkaw:0.2.6 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

27patternName = google_api_key severity = high line = 27

High

Secret Pattern

Google API key in dist/cli.js

dist/cli.jsView on unpkg · L27

dist/studio-dev.jsView file

1import { spawn } from "node:child_process"; L2: import { createServer } from "node:net"; L3: import { existsSync, readFileSync } from "node:fs"; ... L22: const phases = [{ message: "SDK development launch requested" }]; L23: const workspaceRoot = findWorkspaceRoot(options.workspaceRoot || process.cwd()); L24: const uiRoot = join(workspaceRoot, "tapi_v3", "studio", "browser"); ... L39: const env = { L40: ...process.env, L41: TAPI_DEV_CONFIG: runner.context.configPath, ... L49: phases.push({ message: "Vite UI is ready", detail: `${DEV_HOST}:${uiPort}` }); L50: const launchTrace = Buffer.from(JSON.stringify({ phases }), "utf8").toString("base64url"); L51: const url = `http://${DEV_HOST}:${uiPort}/?tapp=${encodeURIComponent(tappId)}&tapiDevLaunch=${launchTrace}`;

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

dist/studio-dev.jsView on unpkg · L1

1Trigger-reachable chain: manifest.bin -> dist/cli.js -> dist/studio-dev.js L1: import { spawn } from "node:child_process"; L2: import { createServer } from "node:net"; L3: import { existsSync, readFileSync } from "node:fs"; ... L22: const phases = [{ message: "SDK development launch requested" }]; L23: const workspaceRoot = findWorkspaceRoot(options.workspaceRoot || process.cwd()); L24: const uiRoot = join(workspaceRoot, "tapi_v3", "studio", "browser"); ... L39: const env = { L40: ...process.env, L41: TAPI_DEV_CONFIG: runner.context.configPath, ... L49: phases.push({ message: "Vite UI is ready", detail: `${DEV_HOST}:${uiPort}` }); L50: const launchTrace = Buffer.from(JSON.stringify({ phases }), "utf8").toString("base64url"); L51: const url = `http://${DEV_HOST}:${uiPort}/?tapp=${encodeURIC

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/studio-dev.jsView on unpkg · L1

dist/workflow-source.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/workflow-source.js#virtual:normalized:round1View on unpkg

dist/runner-dev.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tapi-dev/sdk@0.3.9 matchedIdentity = npm:QHRhcGktZGV2L3Nkaw:0.3.9 similarity = 0.787 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/runner-dev.jsView on unpkg

Source & flagged code

13 flagged · loading source

dist/auth.jsView file

6patternName = google_api_key severity = high line = 6

High

High Secret

Package contains a high-severity secret pattern.

dist/auth.jsView on unpkg · L6

6patternName = google_api_key severity = high line = 6

High

Secret Pattern

Google API key in dist/auth.js

dist/auth.jsView on unpkg · L6

dist/workflow-cli.jsView file

3import { resolve, join } from "node:path"; L4: import { spawn } from "node:child_process"; L5: import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

dist/workflow-cli.jsView on unpkg · L3

Findings

3 Critical10 High4 Medium7 Low

CriticalReverse Shelldist/studio-dev.js

CriticalTrigger Reachable Dangerous Capabilitydist/studio-dev.js

CriticalPrevious Version Dangerous Deltadist/runner-dev.js

HighHigh Secretdist/auth.js

HighChild Processdist/workflow-cli.js

HighCredential Redirect Persistencedist/cli.js

HighSandbox Evasion Gated Capabilitydist/studio-dev.js

HighCross File Remote Execution Contextdist/workflow-cli.js

HighSemantic Analysis Limiteddist/workflow-source.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/cli.js

HighKnown Malware Source Similaritydist/studio-dev.js

Affected versions and remediation

This report applies to @tapi-dev/sdk@0.3.11.

See all versions of @tapi-dev/sdk for other recorded verdicts.

Review the evidence and your use of @tapi-dev/sdk@0.3.11 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-01 18:05:47.894Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.