@tsuga/cli@1.13.0
Tsuga CLI - manage resources from the command line
AI Security Review
scanned 3mo ago · by lpm-firewall-aiNo lifecycle hook or automatic execution was found. The explicit setup behavior can persist prompt-bearing telemetry routing, so it warrants a warning under the agent-control policy rather than a block.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs `tsuga setup claude-code` or `tsuga setup codex` with an endpoint and ingestion API key.
Impact
Future agent telemetry may send prompts and related content to the user-selected OTLP endpoint.
Mechanism
Explicit AI-agent telemetry configuration mutation
AI rationale
No lifecycle hook or automatic execution was found. The explicit setup behavior can persist prompt-bearing telemetry routing, so it warrants a warning under the agent-control policy rather than a block.
Evidence
package.jsondist/cli.js~/.claude/settings.json~/.codex/config.toml
Network endpoints2
api.tsuga.comregistry.npmjs.org/@tsuga/cli/latest
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/cli.js exposes explicit `tsuga setup claude-code` and `setup codex` commands.
- Those commands write OTEL settings and a bearer token into Claude/Codex configuration.
- Prompt and tool-content telemetry is enabled by default; opt-out is `--no-include-prompts`.
- The configured OTLP endpoint is user-supplied and becomes persistent agent telemetry routing.
Evidence against
- package.json has no preinstall, install, postinstall, or prepare hook.
- Configuration mutation is reachable only through explicit user-invoked setup commands.
- No hidden payload, eval, or remote code-loading path was found in inspected package files.
- The critical-secret hit is a bundled credential-pattern detector, not an embedded package secret.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
18 flaggeddist/cli.jsView file
135patternName = github_pat
severity = critical
line = 135
matchedText = ...`};Ob...----
Critical
135patternName = github_pat
severity = critical
line = 135
matchedText = ...`};Ob...----
Critical
135patternName = github_oauth
severity = critical
line = 135
matchedText = ...`};Ob...----
Critical
135patternName = github_server_token
severity = critical
line = 135
matchedText = ...`};Ob...----
Critical
Secret Pattern
Findings
9 Critical8 High3 Medium4 Low
CriticalCritical Secretdist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltration
Affected versions and remediation
This report applies to @tsuga/cli@1.13.0.
See all versions of @tsuga/cli for other recorded verdicts.
- Review the evidence and your use of @tsuga/cli@1.13.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.