registry / @tsuga/cli / 1.31.0
@tsuga/cli@1.31.0
Tsuga CLI - manage resources from the command line
AI Security Review
scanned 28d ago · by lpm-firewall-aiThe package has no npm install hook, and the agent integration is activated by an explicit CLI command. Because that setup enables automatic updates for a first-party agent plugin, classify it as a warning under the agent extension policy; the source does not establish a concrete attack.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the CLI’s Claude Code plugin installation command; automatic updates are enabled unless disabled with its option.
Impact
The installed plugin may update automatically after this user-invoked setup; no malicious behavior was established in the inspected code.
Mechanism
The command invokes the Claude CLI to add the marketplace and plugin, then writes the marketplace configuration with automatic updates enabled to the user’s Claude settings file.
AI rationale
The package has no npm install hook, and the agent integration is activated by an explicit CLI command. Because that setup enables automatic updates for a first-party agent plugin, classify it as a warning under the agent extension policy; the source does not establish a concrete attack.
Evidence
dist/cli.js
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes `dist/cli.js` as the `tsuga` command.
- The CLI’s explicit Claude Code plugin setup can patch the user’s settings file.
- That setup adds a Tsuga GitHub marketplace entry with automatic updates enabled by default.
- The setup command offers `--no-auto-update` to skip the settings change.
Evidence against
- The manifest has no install lifecycle hook, so npm installation does not trigger this setup.
- The setup runs through an explicit CLI command and installs the package’s named Tsuga plugin.
- API URL validation restricts non-localhost destinations to Tsuga HTTPS hosts.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
17 flaggeddist/cli.jsView file
53patternName = github_pat
severity = critical
line = 53
Critical
53patternName = github_pat
severity = critical
line = 53
Critical
53patternName = github_oauth
severity = critical
line = 53
Critical
53patternName = github_server_token
severity = critical
line = 53
Critical
Findings
9 Critical8 High3 Medium4 Low
CriticalCritical Secretdist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
Affected versions and remediation
This report applies to @tsuga/cli@1.31.0.
See all versions of @tsuga/cli for other recorded verdicts.
- Review the evidence and your use of @tsuga/cli@1.31.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.