@twing/cli@0.2.29

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The source supports a warning for guarded first-party agent integration setup: a deliberate machine install writes machine-level Claude and OpenCode configuration. The install gate and repository checks constrain that behavior, and no concrete attack was established.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Global npm installation or an explicit machine-setup invocation; repository hook setup also requires attended initialization by a project admin.

Impact

The integrations can participate in agent sessions and invoke Twing for configured repositories; the inspected source does not establish an attack or unauthorized credential transfer.

Mechanism

Machine setup writes Claude user-level resolver wiring and an OpenCode plugin. The resolver looks for a repository Twing configuration before installing or invoking Twing for that repository.

AI rationale

Evidence

postinstall.cjsdist/machine-setup.jsdist/resolve-hook.jsdist/opencode-plugin.jsdist/init.js

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package runs a postinstall script, gated to global installation or an explicit machine-setup flag.
Machine setup writes Claude user-level resolver wiring and an OpenCode plugin, then marks the machine managed.
The resolver acts only when a session is in a repository with a Twing coordinator configuration.
The CLI also has an admin-gated, attended setup path that writes repository-local install-enforcement hooks.

Evidence against

The package-level install hook exits for ordinary project dependency installs and self-installs.
Test-support uses child processes to create temporary Git fixtures; the inspected excerpt shows no production behavior.
The design commands are described as on-request operations.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

7 flagged

package.jsonView file

Lines 6-35json

6 "bin": {

7 "twing": "./dist/index.js"

8 },

9 "main": "./dist/index.js",

10 "types": "./dist/index.d.ts",

11 "repository": {

12 "type": "git",

13 "url": "https://github.com/Twing-dev/twing-cli.git",

14 "directory": "packages/cli"

15 },

16 "files": [

17 "dist",

18 "postinstall.cjs",

19 "!dist/**/*.test.js",

20 "!dist/**/*.test.js.map",

21 "!dist/**/*.test.d.ts",

22 "!dist/**/*.test.d.ts.map"

23 ],

24 "scripts": {

25 "build": "tsc -b",

26 "postinstall": "node postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 "typecheck": "tsc --noEmit",

28 "test": "node --test dist/*.test.js dist/*/*.test.js"

29 },

30 "dependencies": {

31 "@twing/core": "^0.2.29",

32 "web-tree-sitter": "^0.26.12"

33 }

34}

dist/opencode-adapter.jsView file

Lines 1-32javascript

1/**

2 * OpenCode -> twing-hook adapter.

3 *

4 * OpenCode plugins run inside the long-lived OpenCode process, while the

5 * existing twing client contract is one JSON payload per short-lived hook

6 * process. Keeping the translation here means OpenCode shares the exact Go

7 * gate, auth recovery, daemon protocol, and target-file repo resolution

8 * Claude already uses instead of growing a second implementation.

9 *

10 * Copied verbatim to `~/.twing/opencode/adapter.mjs` by `opencode-plugin.ts`,

dist/test-support.jsView file

Lines 14-54javascript

14import * as fs from "node:fs";

15import * as os from "node:os";

16import * as path from

dist/machine-setup.jsView file

Lines 1-24javascript

1/**

2 * Machine wiring shared by the one-step install and `twing init --ghuser`.

3 *

4 * Both leave a machine in the same state: the resolver wired into

5 * `~/.claude/settings.json`, the OpenCode plugin installed, and nothing

6 * installed into `~/.twing/lib`. The coordinator picks the version, so the CLI,

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/machine-setup.jsView on unpkg · L4

7 * hook binary and daemon arrive lazily the first time a session opens a repo

8 * that uses twing -- and version recovery keeps them current from then on.

dist/design.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/design.js#virtual:normalized:round1View on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/opencode-adapter.jsView file

12*/ L13: import { spawn } from "node:child_process"; L14: import * as fs from "node:fs";

High

Child Process

Package source references child process execution.

dist/opencode-adapter.jsView on unpkg · L12

Findings

1 Critical6 High4 Medium4 Low

CriticalAi Agent Control Hijackdist/machine-setup.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/opencode-adapter.js

HighShell

HighSame File Env Network Executiondist/test-support.js

HighSemantic Analysis Limiteddist/design.js#virtual:normalized:round1

HighPrevious Version Dangerous Deltadist/opencode-adapter.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

Low

Affected versions and remediation

This report applies to @twing/cli@0.2.29.

See all versions of @twing/cli for other recorded verdicts.

Review the evidence and your use of @twing/cli@0.2.29 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 21:25:55.036Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.