@tsuga/cli@1.30.0
Tsuga CLI - manage resources from the command line
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package is not malicious by the inspected source, but its explicit commands modify or extend AI-agent control surfaces. Downgrade to a warning for that user-triggered capability rather than blocking publication.
Static reason
One or more suspicious static signals were detected.
Trigger
The user runs tsuga install plugin codex or tsuga install plugin claude-code.
Impact
It can extend a local AI CLI with the Tsuga plugin and enable its marketplace auto-update setting.
Mechanism
Explicit agent-plugin installation and Claude settings modification.
AI rationale
The package is not malicious by the inspected source, but its explicit commands modify or extend AI-agent control surfaces. Downgrade to a warning for that user-triggered capability rather than blocking publication.
Evidence
README.mddist/cli.js~/.claude/settings.json~/.codex/config.toml
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package provides explicit commands that install a Tsuga plugin into Codex or Claude Code.
- After a user command, the CLI checks npm for a newer version and prints an update notice.
- The manifest exposes a user-invoked CLI entry point rather than an install lifecycle hook.
Evidence against
- package.json has no preinstall, install, or postinstall script.
- Plugin installation and agent configuration changes are reachable only through explicit tsuga commands.
- The inspected network and credential handling supports the Tsuga CLI API and update check; no secret harvesting or unrelated exfiltration was found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
17 flaggeddist/cli.jsView file
53patternName = github_pat
severity = critical
line = 53
Critical
53patternName = github_pat
severity = critical
line = 53
Critical
53patternName = github_oauth
severity = critical
line = 53
Critical
53patternName = github_server_token
severity = critical
line = 53
Critical
Findings
9 Critical8 High3 Medium4 Low
CriticalCritical Secretdist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
Affected versions and remediation
This report applies to @tsuga/cli@1.30.0.
See all versions of @tsuga/cli for other recorded verdicts.
- Review the evidence and your use of @tsuga/cli@1.30.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.