registry / @tsuga/cli / 1.61.0
@tsuga/cli@1.61.0
Tsuga CLI - manage resources from the command line
AI Security Review
scanned 21d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the credential path is constrained to approved API hosts or loopback. The explicit plugin setup enables automatic updates by default, so this is a warning-level agent extension lifecycle risk rather than a confirmed attack.
Static reason
One or more suspicious static signals were detected.
Trigger
The user runs the CLI's install plugin command for Claude Code.
Impact
Future plugin updates may change the extension loaded by Claude Code.
Mechanism
The command installs the Tsuga plugin and writes its marketplace entry with automatic updates enabled by default; the user can disable that setting.
AI rationale
The manifest has no install lifecycle hook, and the credential path is constrained to approved API hosts or loopback. The explicit plugin setup enables automatic updates by default, so this is a warning-level agent extension lifecycle risk rather than a confirmed attack.
Evidence
dist/cli.js~/.claude/settings.json
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest exposes a CLI and lists no install lifecycle hook.
- The API URL validator restricts credentials to HTTPS on approved hosts or loopback.
- Login exchanges a browser authorization code with the resolved API and saves the session.
- The Claude plugin setup writes to the user's Claude settings file.
- That setup adds the Tsuga GitHub marketplace with automatic updates enabled.
- The plugin setup is an explicit CLI command; automatic updates default on and can be disabled.
Evidence against
- No credential theft or other confirmed attack was identified; the CLI's credential destination is constrained by its URL validator.
- The agent configuration change is tied to an explicit plugin-install command, rather than an npm install hook.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
13 flaggeddist/cli.jsView file
83patternName = github_pat
severity = critical
line = 83
Critical
83patternName = github_pat
severity = critical
line = 83
Critical
83patternName = github_oauth
severity = critical
line = 83
Critical
83patternName = github_server_token
severity = critical
line = 83
Critical
Findings
9 Critical4 High2 Medium4 Low
CriticalCritical Secretdist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighSecret Patterndist/cli.js
HighSecret Patterndist/cli.js
HighSecret Patterndist/cli.js
Affected versions and remediation
This report applies to @tsuga/cli@1.61.0.
See all versions of @tsuga/cli for other recorded verdicts.
- Review the evidence and your use of @tsuga/cli@1.61.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.