@tsuga/cli@1.80.0
Tsuga CLI - manage resources from the command line
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe source supports an explicit telemetry setup feature, but prompt and tool-content logging is enabled by default and requires the user to opt out. Treat this as a warning about agent configuration capability rather than a confirmed attack.
Static reason
One or more suspicious static signals were detected.
Trigger
The user runs `tsuga setup claude-code` or `tsuga setup codex`.
Impact
Agent prompts and related telemetry may be sent to the configured collector.
Mechanism
The command writes OTEL settings, including a configured endpoint and ingestion key, into the user’s agent configuration; prompt logging defaults to enabled.
AI rationale
The source supports an explicit telemetry setup feature, but prompt and tool-content logging is enabled by default and requires the user to opt out. Treat this as a warning about agent configuration capability rather than a confirmed attack.
Evidence
dist/cli.js~/.claude/settings.json~/.codex/config.toml
Decision evidence
public snapshotAI called this Suspicious at 81.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- `package.json` exposes `dist/cli.js` as the CLI entrypoint and declares no lifecycle scripts.
- `dist/cli.js` offers an explicit `setup` command to configure local LLM CLIs to send OTEL telemetry to Tsuga.
- The setup option includes prompts by default; a flag disables prompt and tool-content logging.
- The Claude setup writes telemetry settings to the user’s settings file, and the Codex setup writes an OTEL table to the user’s config file.
- The CLI’s own usage telemetry asks for consent when no saved choice exists and the command is interactive and successful.
Evidence against
- The reviewed setup is user-invoked and directs telemetry to a configured Tsuga endpoint; no automatic install-time mutation or unrelated recipient was established.
- The manifest contains no install lifecycle hook.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
16 flaggeddist/cli.jsView file
268patternName = github_pat
severity = critical
line = 268
Critical
268patternName = github_pat
severity = critical
line = 268
Critical
268patternName = github_oauth
severity = critical
line = 268
Critical
268patternName = github_server_token
severity = critical
line = 268
Critical
Findings
9 Critical7 High2 Medium4 Low
CriticalCritical Secretdist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltration
Affected versions and remediation
This report applies to @tsuga/cli@1.80.0.
See all versions of @tsuga/cli for other recorded verdicts.
- Review the evidence and your use of @tsuga/cli@1.80.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.