registry / @tsuga/cli / 1.53.0
@tsuga/cli@1.53.0
Tsuga CLI - manage resources from the command line
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspected source establishes first-party agent extension installation and persistent automatic-update configuration through explicit user commands. This warrants a lifecycle warning, while the absence of automatic npm installation hooks and concrete attack behavior does not support blocking as malware.
Static reason
One or more suspicious static signals were detected.
Trigger
Running tsuga install plugin claude-code or tsuga install plugin codex.
Impact
The installed plugin extends agent behavior, and the saved Claude preference enables later automatic marketplace updates.
Mechanism
The CLI invokes the agent's plugin installation commands. For Claude, it also saves an auto-update preference unless --no-auto-update is supplied.
AI rationale
Inspected source establishes first-party agent extension installation and persistent automatic-update configuration through explicit user commands. This warrants a lifecycle warning, while the absence of automatic npm installation hooks and concrete attack behavior does not support blocking as malware.
Evidence
dist/cli.js~/.claude/settings.json
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The explicit agent plugin installation commands install Tsuga plugins from tsuga-dev/agent-plugins into Claude Code and Codex.
- The Claude command defaults to enabling marketplace auto-updates; --no-auto-update skips that configuration change.
- The updater preserves existing settings, creates a backup, and writes the Tsuga marketplace auto-update preference to the user's Claude settings.
Evidence against
- package.json has no preinstall, install, or postinstall hook and no runtime self-dependency.
- The plugin behavior is activated through explicit CLI commands, rather than npm installation.
- API destinations are restricted to Tsuga hosts or localhost, and stored credentials are selected by API destination; no credential theft was established.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
13 flaggeddist/cli.jsView file
239patternName = github_pat
severity = critical
line = 239
Critical
239patternName = github_pat
severity = critical
line = 239
Critical
239patternName = github_oauth
severity = critical
line = 239
Critical
239patternName = github_server_token
severity = critical
line = 239
Critical
Findings
9 Critical4 High2 Medium4 Low
CriticalCritical Secretdist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighSecret Patterndist/cli.js
HighSecret Patterndist/cli.js
HighSecret Patterndist/cli.js
Affected versions and remediation
This report applies to @tsuga/cli@1.53.0.
See all versions of @tsuga/cli for other recorded verdicts.
- Review the evidence and your use of @tsuga/cli@1.53.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.