registry / @tiledesk/tiledesk-server / 2.20.0

@tiledesk/tiledesk-server@2.20.0

The Tiledesk server module

AI Security Review

scanned 15d ago · by lpm-firewall-ai

The malicious scanner hint is not substantiated by the inspected source. The preinstall hook is conditional enterprise registry setup, while flagged application code shows ordinary server initialization and configured queue reconnection.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Package installation with the enterprise-module environment setting enabled.

Impact

This supports the stated enterprise dependency setup; the inspected code does not show the token being sent to an unrelated destination.

Mechanism

The preinstall hook invokes a script that writes the provided npm token to the project npm configuration.

AI rationale

Evidence

.npmrc

Decision evidence

public snapshot

AI called this Clean at 83.0% confidence as Benign with medium false-positive risk.

Evidence for AI clean decision

The install hook is gated on an enterprise-module environment setting and delegates to a script that configures npm registry authentication.
The flagged app entrypoint loads environment configuration and standard server dependencies.
The flagged queue code reconnects to a configured AMQP service, consistent with the server’s queue functionality.

Evidence against

The reviewed flagged source does not show credential collection or transmission to an unrelated recipient.
The concierge bot code is application event handling; the scanner’s semantic-analysis limitation is not source evidence of malicious behavior.

Behavioral surface

Source

CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

Manifest

CopyleftLicense

scanned 386 file(s), 2.43 MB of source, external domains: 34.65.210.38, api.elevenlabs.io, api.telegram.org, api.tiledesk.com, changeit.cloudfunctions.net, chat-v2-dev.firebaseio.com, console.tiledesk.com, developer.tiledesk.com, docs.tiledesk.com, graph.facebook.com, image.jpg, panel.tiledesk.com, securetoken.google.com, tiledesk.com, www.emanueleferonato.com, www.google.com, www.tiledesk.com, www.youtube.com

Source & flagged code

23 flagged

package.jsonView file

Lines 1-32json

2 "name": "@tiledesk/tiledesk-server",

3 "description": "The Tiledesk server module",

4 "version": "2.20.0",

5 "scripts": {

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg · L5

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg · L5

6 "start": "node ./bin/www",

7 "pretest": "mongodb-runner start",

8 "watchenv": "nodemon --watch .env --watch ./confenv/.env ./bin/www",

9 "test": "mocha ./test/*.js ./pubmodules/**/test/*.js ./modules/**/test/*.js ./channels/*/test/*.js ./node_modules/@tiledesk-ent/**/test/*.js --exit",

10 "test:int": "mocha ./test-int/*.js ./pubmodules/**/test-int/*.js ./modules/**/test-int/*.js ./channels/**/test-int/*.js --exit",

11 "posttest": "mongodb-runner stop",

12 "preinstall": "if [ $ENABLE_ENTERPRISE_MODULE ]; then npm run enable-ent; fi",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L12

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L12

13 "heroku-prebuild": "if [ $ENABLE_ENTERPRISE_MODULE ]; then npm run enable-ent; fi",

14 "enable-ent": "echo //registry.npmjs.org/:_authToken=${NPM_TOKEN} > .npmrc"

15 },

16 "private": false,

17 "author": "Andrea Leo - Tiledesk SRL",

18 "license": "AGPL-3.0",

19 "homepage": "https://www.tiledesk.com",

20 "repository": {

21 "type": "git",

22 "url": "git+https://github.com/Tiledesk/tiledesk-server.git"

23 },

24 "engines": {

25 "node": "16.17.0",

26 "npm": "8.15.0"

27 },

28 "bin": {

29 "tiledesk-server": "./bin/www"

30 },

31 "optionalDependencies": {

32 "@tiledesk-ent/tiledesk-server-enterprise": "^1.0.0",

pubmodules/cache/mongoose-cachegoose-fn.jsView file

Lines 923-965javascript

923 // fai cache faq

924

925 }

926

927module.exports = function (mongoose, option) {

928

929 if (process.env.

utils/jobs-worker-queue-manager/queueManagerClassV2.jsView file

Lines 250-290javascript

250 // if (this.debug) {console.log("Got msg1:"+ message_string + " topic:" + topic);}

251 // console.log("Got msg1:"+ message_string + " topic:" + topic);

252

253 if (topic === 'functions') {

254 // if (this.debug) {console.log("Got msg2:"+ JSON.stringify(message_string) + " topic:" + topic);}

255 // console.log("Got msg2:"+ JSON.stringify(message_string) + " topic:" + topic);

middleware/noentitycheck.jsView file

Lines 1-11javascript

1var winston = require('../config/winston');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

middleware/noentitycheck.jsView on unpkg · L1

5module.exports =

archive.shView file

•path = archive.sh kind = build_helper sizeBytes = 2865 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

archive.shView on unpkg

pubmodules/rules/conciergeBot.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

pubmodules/rules/conciergeBot.js#virtual:normalized:round1View on unpkg

app.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tiledesk/tiledesk-server@2.24.2 matchedIdentity = npm:[redacted]:2.24.2 similarity = 0.900 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

app.jsView on unpkg

pubmodules/sms/listener.jsView file

26patternName = generic_password severity = medium line = 26

Medium

Secret Pattern

Hardcoded password in pubmodules/sms/listener.js

pubmodules/sms/listener.jsView on unpkg · L26

pubmodules/voice-twilio/listener.jsView file

23patternName = generic_password severity = medium line = 23

Medium

Secret Pattern

Hardcoded password in pubmodules/voice-twilio/listener.js

pubmodules/voice-twilio/listener.jsView on unpkg · L23

pubmodules/voice/listener.jsView file

32patternName = generic_password severity = medium line = 32

Medium

Secret Pattern

Hardcoded password in pubmodules/voice/listener.js

pubmodules/voice/listener.jsView on unpkg · L32

pubmodules/tilebot/listener.jsView file

42patternName = generic_password severity = medium line = 42

Medium

Secret Pattern

Hardcoded password in pubmodules/tilebot/listener.js

pubmodules/tilebot/listener.jsView on unpkg · L42

pubmodules/whatsapp/listener.jsView file

26patternName = generic_password severity = medium line = 26

Medium

Secret Pattern

Hardcoded password in pubmodules/whatsapp/listener.js

pubmodules/whatsapp/listener.jsView on unpkg · L26

test/kbRoute.jsView file

196patternName = generic_password severity = medium line = 196

Medium

Secret Pattern

Hardcoded password in test/kbRoute.js

test/kbRoute.jsView on unpkg · L196

test/projectRoute.jsView file

64patternName = generic_password severity = medium line = 64

Medium

Secret Pattern

Hardcoded password in test/projectRoute.js

test/projectRoute.jsView on unpkg · L64

109patternName = generic_password severity = medium line = 109

Medium

Secret Pattern

Hardcoded password in test/projectRoute.js

test/projectRoute.jsView on unpkg · L109

test/authorization.jsView file

32patternName = generic_password severity = medium line = 32

Medium

Secret Pattern

Hardcoded password in test/authorization.js

test/authorization.jsView on unpkg · L32

test/authentication.jsView file

159patternName = generic_password severity = medium line = 159

Medium

Secret Pattern

Hardcoded password in test/authentication.js

test/authentication.jsView on unpkg · L159

235patternName = generic_password severity = medium line = 235

Medium

Secret Pattern

Hardcoded password in test/authentication.js

test/authentication.jsView on unpkg · L235

259patternName = generic_password severity = medium line = 259

Medium

Secret Pattern

Hardcoded password in test/authentication.js

test/authentication.jsView on unpkg · L259

Source & flagged code

23 flagged · loading source

package.jsonView file

•dependencies registry_only=@tiledesk-ent/tiledesk-server-enterprise,@tiledesk-ent/tiledesk-server-jwthistory,@tiledesk-ent/tiledesk-server-payments,@tiledesk-ent/tiledesk-server-request-history,@tiledesk-ent/tiledesk-server-visitorcounter

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•scripts.preinstall = if [ $ENABLE_ENTERPRISE_MODULE ]; then npm run enable-ent; fi

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•Runtime dependency names matching Node built-ins: http

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

•scripts.preinstall = if [ $ENABLE_ENTERPRISE_MODULE ]; then npm run enable-ent; fi

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

pubmodules/cache/mongoose-cachegoose-fn.jsView file

943patternName = generic_password severity = medium line = 943

Medium

Secret Pattern

Package contains a possible secret pattern.

pubmodules/cache/mongoose-cachegoose-fn.jsView on unpkg · L943

945patternName = generic_password severity = medium line = 945

Medium

Secret Pattern

Hardcoded password in pubmodules/cache/mongoose-cachegoose-fn.js

pubmodules/cache/mongoose-cachegoose-fn.jsView on unpkg · L945

utils/jobs-worker-queue-manager/queueManagerClassV2.jsView file

270L271: // eval(fdata.function) L272:

Low

Eval

Package source references a known benign dynamic code generation pattern.

utils/jobs-worker-queue-manager/queueManagerClassV2.jsView on unpkg · L270

middleware/noentitycheck.jsView file

1var winston = require('../config/winston'); L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

middleware/noentitycheck.jsView on unpkg · L1

archive.shView file

•path = archive.sh kind = build_helper sizeBytes = 2865 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

archive.shView on unpkg

pubmodules/rules/conciergeBot.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

pubmodules/rules/conciergeBot.js#virtual:normalized:round1View on unpkg

app.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

app.jsView on unpkg

pubmodules/sms/listener.jsView file

26patternName = generic_password severity = medium line = 26

Medium

Secret Pattern

Hardcoded password in pubmodules/sms/listener.js

pubmodules/sms/listener.jsView on unpkg · L26

pubmodules/voice-twilio/listener.jsView file

23patternName = generic_password severity = medium line = 23

Medium

Secret Pattern

Hardcoded password in pubmodules/voice-twilio/listener.js

pubmodules/voice-twilio/listener.jsView on unpkg · L23

pubmodules/voice/listener.jsView file

32patternName = generic_password severity = medium line = 32

Medium

Secret Pattern

Hardcoded password in pubmodules/voice/listener.js

pubmodules/voice/listener.jsView on unpkg · L32

pubmodules/tilebot/listener.jsView file

42patternName = generic_password severity = medium line = 42

Medium

Secret Pattern

Hardcoded password in pubmodules/tilebot/listener.js

pubmodules/tilebot/listener.jsView on unpkg · L42

pubmodules/whatsapp/listener.jsView file

26patternName = generic_password severity = medium line = 26

Medium

Secret Pattern

Hardcoded password in pubmodules/whatsapp/listener.js

pubmodules/whatsapp/listener.jsView on unpkg · L26

test/kbRoute.jsView file

196patternName = generic_password severity = medium line = 196

Medium

Secret Pattern

Hardcoded password in test/kbRoute.js

test/kbRoute.jsView on unpkg · L196

test/projectRoute.jsView file

64patternName = generic_password severity = medium line = 64

Medium

Secret Pattern

Hardcoded password in test/projectRoute.js

test/projectRoute.jsView on unpkg · L64

109patternName = generic_password severity = medium line = 109

Medium

Secret Pattern

Hardcoded password in test/projectRoute.js

test/projectRoute.jsView on unpkg · L109

test/authorization.jsView file

32patternName = generic_password severity = medium line = 32

Medium

Secret Pattern

Hardcoded password in test/authorization.js

test/authorization.jsView on unpkg · L32

test/authentication.jsView file

159patternName = generic_password severity = medium line = 159

Medium

Secret Pattern

Hardcoded password in test/authentication.js

test/authentication.jsView on unpkg · L159

235patternName = generic_password severity = medium line = 235

Medium

Secret Pattern

Hardcoded password in test/authentication.js

test/authentication.jsView on unpkg · L235

259patternName = generic_password severity = medium line = 259

Medium

Secret Pattern

Hardcoded password in test/authentication.js

test/authentication.jsView on unpkg · L259

Findings

1 Critical4 High20 Medium7 Low

CriticalManifest Confusionpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighNode Builtin Dependency Squatpackage.json

HighSemantic Analysis Limitedpubmodules/rules/conciergeBot.js#virtual:normalized:round1

HighPrevious Version Dangerous Deltaapp.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Patternpubmodules/cache/mongoose-cachegoose-fn.js

MediumDynamic Requiremiddleware/noentitycheck.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperarchive.sh

MediumStructural Risk Force Deep Review

MediumSecret Patternpubmodules/cache/mongoose-cachegoose-fn.js

MediumSecret Patternpubmodules/sms/listener.js

MediumSecret Patternpubmodules/voice-twilio/listener.js

MediumSecret Patternpubmodules/voice/listener.js

MediumSecret Patternpubmodules/tilebot/listener.js

MediumSecret Patternpubmodules/whatsapp/listener.js

MediumSecret Patterntest/kbRoute.js

MediumSecret Patterntest/projectRoute.js

MediumSecret Patterntest/authorization.js

MediumSecret Patterntest/authentication.js

LowScripts Present

LowEvalutils/jobs-worker-queue-manager/queueManagerClassV2.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowCopyleft License

Affected versions and remediation

This report applies to @tiledesk/tiledesk-server@2.20.0.

See all versions of @tiledesk/tiledesk-server for other recorded verdicts.

Review the evidence and your use of @tiledesk/tiledesk-server@2.20.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 09:33:37.833Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.