@tsuga/cli@1.9.0
Tsuga CLI - manage resources from the command line
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is not malicious install-time behavior, but it provides an explicit command that alters AI-agent configuration to export sensitive telemetry with permissive defaults. It warrants a warning under the agent-control policy.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs tsuga setup claude-code, tsuga setup codex, or tsuga install plugin ...
Impact
Configured agent sessions may send prompts, and Claude tool content, to the supplied OTLP endpoint.
Mechanism
user-invoked AI-agent telemetry and plugin configuration mutation
AI rationale
This is not malicious install-time behavior, but it provides an explicit command that alters AI-agent configuration to export sensitive telemetry with permissive defaults. It warrants a warning under the agent-control policy.
Evidence
package.jsondist/cli.jsREADME.md~/.claude/settings.json~/.codex/config.toml
Network endpoints1
api.tsuga.com
Decision evidence
public snapshotAI called this Suspicious at 95.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/cli.js: setup claude-code writes OTEL telemetry settings, including prompt and tool-content logging by default.
- dist/cli.js: setup codex replaces ~/.codex/config.toml [otel] configuration with an endpoint and bearer key.
- dist/cli.js: explicit install plugin commands invoke Claude/Codex CLIs and patch Claude marketplace auto-update.
- README.md documents these commands and that prompts are included unless opted out.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- AI-agent configuration changes occur only through explicit setup/install subcommands.
- The endpoint and ingestion key are mandatory user arguments or environment values.
- No hidden payload, eval, credential harvesting, or import-time execution was found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinified
Source & flagged code
18 flaggeddist/cli.jsView file
134patternName = github_pat
severity = critical
line = 134
matchedText = ...`};Ob...----
Critical
134patternName = github_pat
severity = critical
line = 134
matchedText = ...`};Ob...----
Critical
134patternName = github_oauth
severity = critical
line = 134
matchedText = ...`};Ob...----
Critical
134patternName = github_server_token
severity = critical
line = 134
matchedText = ...`};Ob...----
Critical
Secret Pattern
Findings
9 Critical8 High3 Medium4 Low
CriticalCritical Secretdist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
CriticalSecret Patterndist/cli.js
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltration
Affected versions and remediation
This report applies to @tsuga/cli@1.9.0.
See all versions of @tsuga/cli for other recorded verdicts.
- Review the evidence and your use of @tsuga/cli@1.9.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.