@tsuga/cli@1.27.0
Tsuga CLI - manage resources from the command line
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has no automatic npm lifecycle trigger, but it offers explicit commands that modify AI-agent plugin state and can add an updating marketplace. This warrants a warning under the agent capability policy rather than a block.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs tsuga install plugin claude-code or tsuga install plugin codex.
Impact
It can add a third-party agent plugin and enable its future updates.
Mechanism
Explicit AI-agent plugin installation and configuration mutation.
AI rationale
The package has no automatic npm lifecycle trigger, but it offers explicit commands that modify AI-agent plugin state and can add an updating marketplace. This warrants a warning under the agent capability policy rather than a block.
Evidence
dist/cli.jspackage.json.claude/settings.json
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The explicit Claude plugin-install command creates and modifies Claude Code settings to enable marketplace auto-updates.
- The explicit Codex plugin-install command runs Codex CLI plugin marketplace and plugin-add commands.
- The CLI includes an explicit self-update command that invokes npm globally.
Evidence against
- package.json has no npm preinstall, install, or postinstall lifecycle hook.
- The agent configuration changes are reachable only through named user commands, not on package installation.
- API requests use supplied Tsuga credentials for the CLI's stated resource-management functions.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
17 flaggeddist/cli.jsView file
51patternName = github_pat
severity = critical
line = 51
Critical
51patternName = github_pat
severity = critical
line = 51
Critical
51patternName = github_oauth
severity = critical
line = 51
Critical
51patternName = github_server_token
severity = critical
line = 51
Critical
Findings
9 Critical8 High3 Medium4 Low
CriticalCritical Secretdist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
Affected versions and remediation
This report applies to @tsuga/cli@1.27.0.
See all versions of @tsuga/cli for other recorded verdicts.
- Review the evidence and your use of @tsuga/cli@1.27.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.