registry / @tsuga/cli / 1.65.0
@tsuga/cli@1.65.0
Tsuga CLI - manage resources from the command line
AI Security Review
scanned 20d ago · by lpm-firewall-aiThe source supports a warning for first-party agent-extension setup that enables automatic updates in global Claude settings. The credential redirect hint is not supported: the CLI restricts credential destinations to Tsuga API hosts or loopback.
Static reason
One or more suspicious static signals were detected.
Trigger
A user invokes the Claude plugin installation command.
Impact
Future plugin updates may be applied automatically; the inspected source does not establish malicious behavior.
Mechanism
The command installs the Tsuga marketplace plugin and, by default, writes its marketplace entry with automatic updates enabled.
AI rationale
The source supports a warning for first-party agent-extension setup that enables automatic updates in global Claude settings. The credential redirect hint is not supported: the CLI restricts credential destinations to Tsuga API hosts or loopback.
Evidence
dist/cli.js~/.claude/settings.json
Network endpoints1
github.com/tsuga-dev/agent-plugins
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest exposes dist/cli.js as the tsuga executable.
- The CLI restricts its API URL to Tsuga HTTPS hosts or loopback addresses before sending credentials.
- The Claude plugin setup writes the Tsuga GitHub marketplace and enables auto-updates in the user's Claude settings.
- The explicit Claude plugin command installs the plugin; auto-updates default on and can be disabled with --no-auto-update.
Evidence against
- The plugin configuration change is reached through the explicit CLI plugin-install command.
- The credential destination check rejects non-allowlisted hosts, so the inspected source does not support the scanner's credential-redirect claim.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
13 flaggeddist/cli.jsView file
84patternName = github_pat
severity = critical
line = 84
Critical
84patternName = github_pat
severity = critical
line = 84
Critical
84patternName = github_oauth
severity = critical
line = 84
Critical
84patternName = github_server_token
severity = critical
line = 84
Critical
Findings
9 Critical4 High2 Medium4 Low
CriticalCritical Secretdist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighSecret Patterndist/cli.js
HighSecret Patterndist/cli.js
HighSecret Patterndist/cli.js
Affected versions and remediation
This report applies to @tsuga/cli@1.65.0.
See all versions of @tsuga/cli for other recorded verdicts.
- Review the evidence and your use of @tsuga/cli@1.65.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.