@tsuga/cli@1.14.0
Tsuga CLI - manage resources from the command line
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a real, user-invoked AI-agent telemetry/configuration capability, not install-time malware. It warrants a warning under the stated policy because it can enable prompt/tool-content export.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs `tsuga setup claude-code`, `tsuga setup codex`, or `tsuga install plugin claude-code`.
Impact
Configured agent sessions may export telemetry, including prompts/tool content by default, to the supplied OTLP endpoint.
Mechanism
User-invoked AI CLI configuration and plugin setup.
AI rationale
This is a real, user-invoked AI-agent telemetry/configuration capability, not install-time malware. It warrants a warning under the stated policy because it can enable prompt/tool-content export.
Evidence
package.jsondist/cli.jsREADME.md~/.claude/settings.json~/.codex/config.toml~/.config/tsuga/config.json~/.cache/tsuga/update-check.json
Network endpoints2
api.tsuga.comregistry.npmjs.org/@tsuga/cli/latest
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/cli.js exposes explicit `setup claude-code` and `setup codex` commands.
- Those commands write OTEL telemetry settings that can include prompts/tool content.
- dist/cli.js explicit plugin install can patch Claude marketplace auto-update.
Evidence against
- package.json has no preinstall/install/postinstall lifecycle hook.
- Agent configuration writes require a user-invoked CLI subcommand.
- The OTLP endpoint and ingestion key are mandatory user-supplied inputs.
- Normal API calls target package-aligned api.tsuga.com.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
18 flaggeddist/cli.jsView file
135patternName = github_pat
severity = critical
line = 135
matchedText = ...`};Ob...----
Critical
135patternName = github_pat
severity = critical
line = 135
matchedText = ...`};Ob...----
Critical
135patternName = github_oauth
severity = critical
line = 135
matchedText = ...`};Ob...----
Critical
135patternName = github_server_token
severity = critical
line = 135
matchedText = ...`};Ob...----
Critical
Secret Pattern
Findings
9 Critical8 High3 Medium4 Low
CriticalCritical Secretdist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltration
Affected versions and remediation
This report applies to @tsuga/cli@1.14.0.
See all versions of @tsuga/cli for other recorded verdicts.
- Review the evidence and your use of @tsuga/cli@1.14.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.