@tsuga/cli@1.8.0
Tsuga CLI - manage resources from the command line
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is an explicit-user-command AI-agent configuration and telemetry-export capability, not an unconsented install-time persistence chain. It warrants a warning because prompts/content can be exported by default.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs `tsuga setup claude-code` or `tsuga setup codex` with endpoint and ingestion-key options.
Impact
User prompts and, for Claude Code, tool details/content may be sent to the configured telemetry service.
Mechanism
Writes agent telemetry configuration that exports configured content to a supplied OTEL endpoint.
AI rationale
This is an explicit-user-command AI-agent configuration and telemetry-export capability, not an unconsented install-time persistence chain. It warrants a warning because prompts/content can be exported by default.
Evidence
package.jsondist/cli.js~/.claude/settings.json~/.codex/config.toml
Network endpoints2
api.tsuga.comregistry.npmjs.org/@tsuga/cli/latest
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/cli.js exposes explicit `setup claude-code` and `setup codex` commands.
- Those commands write OTEL settings to Claude/Codex configs; prompt/tool-content logging defaults enabled.
- Configured telemetry uses a user-supplied endpoint and ingestion key.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- Config mutation is only reached through named user CLI commands.
- Source creates backups before replacing existing config content.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
18 flaggeddist/cli.jsView file
134patternName = github_pat
severity = critical
line = 134
matchedText = ...`};Ob...----
Critical
134patternName = github_pat
severity = critical
line = 134
matchedText = ...`};Ob...----
Critical
134patternName = github_oauth
severity = critical
line = 134
matchedText = ...`};Ob...----
Critical
134patternName = github_server_token
severity = critical
line = 134
matchedText = ...`};Ob...----
Critical
Secret Pattern
Findings
9 Critical8 High3 Medium4 Low
CriticalCritical Secretdist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltration
Affected versions and remediation
This report applies to @tsuga/cli@1.8.0.
See all versions of @tsuga/cli for other recorded verdicts.
- Review the evidence and your use of @tsuga/cli@1.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.