registry / Credential exfiltration / @tsuga/cli
@tsuga/cli
Tsuga CLI - manage resources from the command line
This report shows the evidence for @tsuga/cli@1.94.0. 1 of 103 known versions is blocked or flagged. The newest version, 1.149.0, is allowed. See all versions.
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe CLI’s opt-in usage telemetry includes raw option arguments, which can contain an operation API key, and sends them to `api.tsuga.com`. The opt-in prompt covers usage data but does not disclose that credential values may be included, so this is credential exfiltration despite the telemetry gate.
Static reason
One or more suspicious static signals were detected.
Trigger
A user enables telemetry and runs a command with an operation API key in its arguments.
Impact
The API key is disclosed to Tsuga’s telemetry service, outside the credential’s intended service flow.
Mechanism
The telemetry collector copies raw arguments into the run payload and sends it in a detached POST to the CLI-runs endpoint. The usage-data consent prompt does not disclose that argument values are included.
Attack narrative
After telemetry is enabled, the CLI collects raw arguments beginning at the first option and submits them to Tsuga’s `/v1/cli-runs` endpoint. Since `--operation-api-key` is accepted as a CLI option, its value can be sent with routine usage data without a specific warning or consent to disclose credentials.
AI rationale
The CLI’s opt-in usage telemetry includes raw option arguments, which can contain an operation API key, and sends them to `api.tsuga.com`. The opt-in prompt covers usage data but does not disclose that credential values may be included, so this is credential exfiltration despite the telemetry gate.
Evidence
dist/cli.js
Network endpoints2
api.tsuga.comPOST /v1/cli-runs
Decision evidence
public snapshotAI called this Malicious at 93.0% confidence as Malware with low false-positive risk.
Evidence for block
- Telemetry records raw command-line arguments, from the first option onward, in its run data.
- The CLI accepts an operation API key as a command-line option, so its value can be included in those arguments.
- When telemetry is enabled, the CLI serializes the run data and POSTs it to Tsuga’s telemetry endpoint.
- The endpoint is `https://api.tsuga.com/v1/cli-runs`.
- Telemetry sends only after an environment setting, saved consent, or an interactive usage-data prompt enables it.
Evidence against
- The manifest exposes a command-line tool and declares no install lifecycle scripts.
- Telemetry is opt-in; the source prompts interactively when no environment setting or saved choice exists.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
16 flaggeddist/cli.jsView file
268patternName = github_pat
severity = critical
line = 268
Critical
268patternName = github_pat
severity = critical
line = 268
Critical
268patternName = github_oauth
severity = critical
line = 268
Critical
268patternName = github_server_token
severity = critical
line = 268
Critical
Findings
9 Critical7 High2 Medium4 Low
CriticalCritical Secretdist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltration
Affected versions and remediation
This report applies to @tsuga/cli@1.94.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @tsuga/cli@1.94.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.