@tenux/cli@1.0.6
Access your computer from your phone — Tenux pairs a mobile browser IDE with an agent that runs on your own machine.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package implements a consent-gated but powerful MCP workspace bridge with persistent approvals. Its manifest has no automatic install lifecycle hook, so the inspected code does not establish malware behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user starts the agent and invokes the MCP bridge, then authorizes a client.
Impact
An approved AI client can receive broad workspace capabilities; this is a guarded dangerous capability rather than a confirmed attack.
Mechanism
The bridge uses the local agent endpoint and stores an always-allow decision for an approved client.
AI rationale
The package implements a consent-gated but powerful MCP workspace bridge with persistent approvals. Its manifest has no automatic install lifecycle hook, so the inspected code does not establish malware behavior.
Evidence
dist/cli.jsdist/chunk-RMLJA2MA.js
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The CLI provides an MCP bridge that can expose workspace terminal, file, and preview access to an AI client.
- A client attachment is gated by an allow-once, always-allow, or deny decision.
- The consent store can retain an always-allow decision for a client identity.
- The indicated permission-rule code can retain command- or path-specific grants.
Evidence against
- The package manifest has no install, preinstall, or postinstall hook.
- The MCP bridge is activated through an explicit CLI command and requires a running agent.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsTelemetryUrlStrings
NoLicense
Source & flagged code
10 flaggeddist/chunk-RMLJA2MA.jsView file
64m._DeChar = function(a, p) {
L65: return String.fromCharCode(a[p]);
L66: };
...
L731: let m;
L732: return typeof document !== "undefined" && document.documentElement && document.documentElement.style && document.documentElement.style.WebkitAppearance || // Is firebug? http://sta...
L733: typeof window !== "undefined" && window.console && (window.console.firebug || window.console.exception && window.console.table) || // Is firefox >= v31?
...
L776: if (!r && typeof process !== "undefined" && "env" in process) {
L777: r = process.env.DEBUG;
L778: }
...
L862: }
L863: if (process.platform === "win32") {
L864: const osRelease = os3.release().split(".");
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/chunk-RMLJA2MA.jsView on unpkg · L6464Trigger-reachable chain: scripts.start -> dist/cli.js -> dist/chunk-RMLJA2MA.js
L64: m._DeChar = function(a, p) {
L65: return String.fromCharCode(a[p]);
L66: };
...
L731: let m;
L732: return typeof document !== "undefined" && document.documentElement && document.documentElement.style && document.documentElement.style.WebkitAppearance || // Is firebug? http://sta...
L733: typeof window !== "undefined" && window.console && (window.console.firebug || window.console.exception && window.console.table) || // Is firefox >= v31?
...
L776: if (!r && typeof process !== "undefined" && "env" in process) {
L777: r = process.env.DEBUG;
L778: }
...
L862: }
L863: if (process.platform === "win32") {
L864: const osRelease = os3.release().split(".");
Critical
Findings
2 Critical7 High4 Medium9 Low
CriticalCredential Exfiltrationdist/chunk-RMLJA2MA.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunk-RMLJA2MA.js
HighChild Processdist/chunk-RMLJA2MA.js
HighSame File Env Network Executiondist/chunk-RMLJA2MA.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/chunk-RMLJA2MA.js
HighCross File Remote Execution Contextdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/chunk-RMLJA2MA.js
HighSemantic Analysis Limiteddist/chunk-RMLJA2MA.js
MediumDynamic Require
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to @tenux/cli@1.0.6.
See all versions of @tenux/cli for other recorded verdicts.
- Review the evidence and your use of @tenux/cli@1.0.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.