@tsuga/cli@1.55.0
Tsuga CLI - manage resources from the command line
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe source supports a warning for explicit agent configuration changes and persistent prompt telemetry, rather than a malicious verdict. API authentication uses destination restrictions, and the manifest contains no registry-install lifecycle hook.
Static reason
One or more suspicious static signals were detected.
Trigger
Running tsuga setup or tsuga install plugin commands.
Impact
Subsequent agent sessions may export prompts and tool content, replace existing telemetry settings, and automatically update installed plugins.
Mechanism
Writes persistent agent settings for supplied telemetry destinations and credentials, or installs Tsuga plugins through agent CLIs.
AI rationale
The source supports a warning for explicit agent configuration changes and persistent prompt telemetry, rather than a malicious verdict. API authentication uses destination restrictions, and the manifest contains no registry-install lifecycle hook.
Evidence
dist/cli.js.claude/settings.json.codex/config.toml
Decision evidence
public snapshotAI called this Suspicious at 95.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json has no preinstall, install, or postinstall hook.
- Explicit setup commands configure Claude and Codex telemetry.
- Prompt collection defaults to enabled, with an option to disable it.
- Claude setup persists the supplied endpoint and ingestion credential alongside prompt and tool-content telemetry settings.
- Codex setup replaces existing telemetry tables after creating a backup.
- Plugin installation invokes agent CLIs and can persist automatic marketplace updates; API credential destinations are separately restricted.
Evidence against
- No confirmed covert credential export or automatic install-time agent mutation was found.
- Telemetry credentials and endpoints are supplied through command options or environment settings.
- The critical-looking private-key match occurs in a credential-pattern example table.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
13 flaggeddist/cli.jsView file
240patternName = github_pat
severity = critical
line = 240
Critical
240patternName = github_pat
severity = critical
line = 240
Critical
240patternName = github_oauth
severity = critical
line = 240
Critical
240patternName = github_server_token
severity = critical
line = 240
Critical
Findings
9 Critical4 High2 Medium4 Low
CriticalCritical Secretdist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighSecret Patterndist/cli.js
HighSecret Patterndist/cli.js
HighSecret Patterndist/cli.js
Affected versions and remediation
This report applies to @tsuga/cli@1.55.0.
See all versions of @tsuga/cli for other recorded verdicts.
- Review the evidence and your use of @tsuga/cli@1.55.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.