@tsuga/cli@1.33.0
Tsuga CLI - manage resources from the command line
AI Security Review
scanned 28d ago · by lpm-firewall-aiThe source shows a user-invoked agent configuration command that writes telemetry settings, with prompt and tool content included by default. This warrants a warning for explicit-command agent configuration capability; the inspected code does not establish an automatic install-time attack.
Static reason
One or more suspicious static signals were detected.
Trigger
The user runs `tsuga setup claude-code` with an OTLP endpoint and ingestion API key.
Impact
Subsequent Claude Code telemetry may send prompts and tool content to the configured endpoint. No attack was identified in this user-invoked setup behavior.
Mechanism
The command writes the endpoint, bearer key, and telemetry settings into `.claude/settings.json`; the default enables user prompts and tool content.
AI rationale
The source shows a user-invoked agent configuration command that writes telemetry settings, with prompt and tool content included by default. This warrants a warning for explicit-command agent configuration capability; the inspected code does not establish an automatic install-time attack.
Evidence
.claude/settings.json
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes dist/cli.js as its tsuga command.
- The CLI can write an OTEL endpoint and bearer ingestion key into Claude Code settings.
- The explicit setup command enables prompt and tool content telemetry by default.
Evidence against
- The manifest has no preinstall, install, or postinstall hook.
- The telemetry setup is an explicit CLI command and requires the caller to supply its endpoint and ingestion key.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
17 flaggeddist/cli.jsView file
53patternName = github_pat
severity = critical
line = 53
Critical
53patternName = github_pat
severity = critical
line = 53
Critical
53patternName = github_oauth
severity = critical
line = 53
Critical
53patternName = github_server_token
severity = critical
line = 53
Critical
Findings
9 Critical8 High3 Medium4 Low
CriticalCritical Secretdist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
Affected versions and remediation
This report applies to @tsuga/cli@1.33.0.
See all versions of @tsuga/cli for other recorded verdicts.
- Review the evidence and your use of @tsuga/cli@1.33.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.