@tenux/cli@1.0.2
Tenux — mobile-first IDE for 10x engineering
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package does not show install-time malware or credential exfiltration to an unrelated fixed endpoint. Its automatic user-scoped Claude Code MCP registration is a real, user-invoked AI-agent control-surface risk that warrants a warning.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The user runs the Tenux agent and Claude Code is available on PATH.
Impact
A later Claude Code session can invoke the Tenux MCP bridge for workspace capabilities.
Mechanism
Automatic user-scoped Claude MCP registration.
AI rationale
The package does not show install-time malware or credential exfiltration to an unrelated fixed endpoint. Its automatic user-scoped Claude Code MCP registration is a real, user-invoked AI-agent control-surface risk that warrants a warning.
Evidence
dist/chunk-T7K3JJWJ.jsClaude Code user-scoped MCP configuration
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Starting the agent automatically adds a user-scoped Tenux MCP server to Claude Code when the Claude CLI is present.
- The registered MCP command exposes the package's workspace bridge to an AI client.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The configuration change is reached from agent startup, not package installation, and networked AI providers are explicit product functionality.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsTelemetryUrlStrings
NoLicense
Source & flagged code
12 flaggeddist/chunk-T7K3JJWJ.jsView file
50m._DeChar = function(a, p) {
L51: return String.fromCharCode(a[p]);
L52: };
...
L717: let m;
L718: return typeof document !== "undefined" && document.documentElement && document.documentElement.style && document.documentElement.style.WebkitAppearance || // Is firebug? http://sta...
L719: typeof window !== "undefined" && window.console && (window.console.firebug || window.console.exception && window.console.table) || // Is firefox >= v31?
...
L762: if (!r && typeof process !== "undefined" && "env" in process) {
L763: r = process.env.DEBUG;
L764: }
...
L848: }
L849: if (process.platform === "win32") {
L850: const osRelease = os3.release().split(".");
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/chunk-T7K3JJWJ.jsView on unpkg · L5050Trigger-reachable chain: scripts.start -> dist/cli.js -> dist/chunk-T7K3JJWJ.js
L50: m._DeChar = function(a, p) {
L51: return String.fromCharCode(a[p]);
L52: };
...
L717: let m;
L718: return typeof document !== "undefined" && document.documentElement && document.documentElement.style && document.documentElement.style.WebkitAppearance || // Is firebug? http://sta...
L719: typeof window !== "undefined" && window.console && (window.console.firebug || window.console.exception && window.console.table) || // Is firefox >= v31?
...
L762: if (!r && typeof process !== "undefined" && "env" in process) {
L763: r = process.env.DEBUG;
L764: }
...
L848: }
L849: if (process.platform === "win32") {
L850: const osRelease = os3.release().split(".");
Critical
Findings
2 Critical9 High3 Medium8 Low
CriticalCredential Exfiltrationdist/chunk-T7K3JJWJ.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-T7K3JJWJ.js
HighChild Processdist/chunk-T7K3JJWJ.js
HighShelldist/chunk-T7K3JJWJ.js
HighSame File Env Network Executiondist/chunk-T7K3JJWJ.js
HighCredential Redirect Persistencedist/chunk-T7K3JJWJ.js
HighCommand Output Exfiltrationdist/chunk-T7K3JJWJ.js
HighCopied Package Dependency Bridgedist/cli.js
HighCross File Remote Execution Contextdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/chunk-T7K3JJWJ.js
HighSemantic Analysis Limiteddist/chunk-T7K3JJWJ.js
Affected versions and remediation
This report applies to @tenux/cli@1.0.2.
See all versions of @tenux/cli for other recorded verdicts.
- Review the evidence and your use of @tenux/cli@1.0.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.