@tsuga/cli@1.41.0
Tsuga CLI - manage resources from the command line
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package has no install lifecycle hook, so the behavior is not an unconsented installation-time compromise. Its explicit commands nevertheless modify an LLM-agent control surface and can enable ongoing telemetry, which warrants a non-blocking warning under the agent integration policy.
Static reason
One or more suspicious static signals were detected.
Trigger
The user runs a Tsuga install or setup command for an LLM CLI.
Impact
A user who invokes setup may enable ongoing LLM telemetry and plugin updates; this is a guarded agent capability rather than a confirmed covert attack.
Mechanism
The command invokes the Claude plugin CLI and can modify Claude settings to enable telemetry, including prompt and tool-content collection.
AI rationale
The package has no install lifecycle hook, so the behavior is not an unconsented installation-time compromise. Its explicit commands nevertheless modify an LLM-agent control surface and can enable ongoing telemetry, which warrants a non-blocking warning under the agent integration policy.
Evidence
dist/cli.js.claude/settings.json
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package exposes its bundled code as a command-line program.
- An explicit Claude Code plugin-install command invokes the Claude plugin marketplace and install commands, with automatic marketplace updates enabled by default.
- An explicit Claude setup command writes telemetry settings that can include prompts and tool content, an endpoint, and an ingestion authorization header.
Evidence against
- The inspected package metadata contains no npm install lifecycle hook.
- The agent configuration behavior is reached through named CLI setup or install commands rather than package installation.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
13 flaggeddist/cli.jsView file
239patternName = github_pat
severity = critical
line = 239
Critical
239patternName = github_pat
severity = critical
line = 239
Critical
239patternName = github_oauth
severity = critical
line = 239
Critical
239patternName = github_server_token
severity = critical
line = 239
Critical
Findings
9 Critical4 High2 Medium4 Low
CriticalCritical Secretdist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighSecret Patterndist/cli.js
HighSecret Patterndist/cli.js
HighSecret Patterndist/cli.js
Affected versions and remediation
This report applies to @tsuga/cli@1.41.0.
See all versions of @tsuga/cli for other recorded verdicts.
- Review the evidence and your use of @tsuga/cli@1.41.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.