@tenux/cli@1.0.3
Access your computer from your phone — Tenux pairs a mobile browser IDE with an agent that runs on your own machine.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis release is not malicious by the inspected source: execution and credential handling are command-driven and package-aligned. It should still be warned because it provides a high-impact remote shell and accepts API credentials.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs the Tenux CLI, especially `tenux start`; AI-key processing requires the explicit key-setting command.
Impact
An attacker who obtains the service credentials or authenticated remote session could operate a shell on the user's machine. Pasted AI keys are sent to configured provider endpoints for validation and then stored in the Tenux configuration.
Mechanism
A mobile-facing agent bridges authenticated sessions to locally spawned shell PTYs.
AI rationale
This release is not malicious by the inspected source: execution and credential handling are command-driven and package-aligned. It should still be warned because it provides a high-impact remote shell and accepts API credentials.
Evidence
package.jsondist/cli.jsdist/chunk-T7K3JJWJ.js~/.tenux/config.json
Network endpoints7
tenux.devapi.anthropic.comapi.z.aiapi.deepseek.comapi.moonshot.aidashscope-intl.aliyuncs.comapi.openai.com
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The package exposes a CLI agent intended to bridge the machine to a mobile IDE.
- The startable agent creates local pseudo-terminal sessions using the user's configured shell.
- The explicit AI-key command accepts a supplied key, validates it against configured provider endpoints, and saves it locally.
Evidence against
- package.json has no preinstall, install, postinstall, or prepare lifecycle hook.
- The terminal capability is reached through registered CLI commands, not on package installation or import.
- No covert credential harvesting, foreign agent-control mutation, self-dependency chain, or opaque payload loader was confirmed.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
13 flaggeddist/chunk-T7K3JJWJ.jsView file
50m._DeChar = function(a, p) {
L51: return String.fromCharCode(a[p]);
L52: };
...
L717: let m;
L718: return typeof document !== "undefined" && document.documentElement && document.documentElement.style && document.documentElement.style.WebkitAppearance || // Is firebug? http://sta...
L719: typeof window !== "undefined" && window.console && (window.console.firebug || window.console.exception && window.console.table) || // Is firefox >= v31?
...
L762: if (!r && typeof process !== "undefined" && "env" in process) {
L763: r = process.env.DEBUG;
L764: }
...
L848: }
L849: if (process.platform === "win32") {
L850: const osRelease = os3.release().split(".");
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/chunk-T7K3JJWJ.jsView on unpkg · L5050Trigger-reachable chain: scripts.start -> dist/cli.js -> dist/chunk-T7K3JJWJ.js
L50: m._DeChar = function(a, p) {
L51: return String.fromCharCode(a[p]);
L52: };
...
L717: let m;
L718: return typeof document !== "undefined" && document.documentElement && document.documentElement.style && document.documentElement.style.WebkitAppearance || // Is firebug? http://sta...
L719: typeof window !== "undefined" && window.console && (window.console.firebug || window.console.exception && window.console.table) || // Is firefox >= v31?
...
L762: if (!r && typeof process !== "undefined" && "env" in process) {
L763: r = process.env.DEBUG;
L764: }
...
L848: }
L849: if (process.platform === "win32") {
L850: const osRelease = os3.release().split(".");
Critical
Findings
2 Critical9 High4 Medium8 Low
CriticalCredential Exfiltrationdist/chunk-T7K3JJWJ.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-T7K3JJWJ.js
HighChild Processdist/chunk-T7K3JJWJ.js
HighShelldist/chunk-T7K3JJWJ.js
HighSame File Env Network Executiondist/chunk-T7K3JJWJ.js
HighCredential Redirect Persistencedist/chunk-T7K3JJWJ.js
HighCommand Output Exfiltrationdist/chunk-T7K3JJWJ.js
HighCopied Package Dependency Bridgedist/cli.js
HighCross File Remote Execution Contextdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/chunk-T7K3JJWJ.js
HighSemantic Analysis Limiteddist/chunk-T7K3JJWJ.js
Affected versions and remediation
This report applies to @tenux/cli@1.0.3.
See all versions of @tenux/cli for other recorded verdicts.
- Review the evidence and your use of @tenux/cli@1.0.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.