@tsuga/cli@1.47.0
Tsuga CLI - manage resources from the command line
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package contains a concrete, user-invoked AI-agent configuration capability, so it warrants a warning under the agent policy. Static inspection found no install hook or confirmed malicious execution chain.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs a tsuga setup or plugin-install command.
Impact
Prompt and tool telemetry may be sent according to the user-supplied telemetry endpoint; existing Codex OTEL configuration can be replaced.
Mechanism
The commands write agent configuration files, configure telemetry export, and may install or update a Tsuga plugin.
AI rationale
The package contains a concrete, user-invoked AI-agent configuration capability, so it warrants a warning under the agent policy. Static inspection found no install hook or confirmed malicious execution chain.
Evidence
dist/cli.js~/.claude/settings.json~/.codex/config.toml
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package exposes a tsuga command-line entrypoint.
- An explicit Claude setup command writes telemetry settings that can include prompts and tool content.
- An explicit Codex setup command overwrites the existing OTEL configuration table.
- Plugin installation commands can add Tsuga plugins and enable their marketplace updates.
Evidence against
- No npm preinstall, install, or postinstall lifecycle hook is declared.
- The agent configuration behavior is attached to named setup and install CLI commands, rather than package installation.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
13 flaggeddist/cli.jsView file
239patternName = github_pat
severity = critical
line = 239
Critical
239patternName = github_pat
severity = critical
line = 239
Critical
239patternName = github_oauth
severity = critical
line = 239
Critical
239patternName = github_server_token
severity = critical
line = 239
Critical
Findings
9 Critical4 High2 Medium4 Low
CriticalCritical Secretdist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighSecret Patterndist/cli.js
HighSecret Patterndist/cli.js
HighSecret Patterndist/cli.js
Affected versions and remediation
This report applies to @tsuga/cli@1.47.0.
See all versions of @tsuga/cli for other recorded verdicts.
- Review the evidence and your use of @tsuga/cli@1.47.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.