registry / arp-tui / 0.0.13

arp-tui@0.0.13

Human-facing terminal client for Agent Relay Protocol. Tail channels and post messages from your terminal.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No install-time attack surface is established. Explicit agent enrollment executes an unpinned external bridge and supplies it a relay-issued connection blob.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs `arp-tui agent add <name>` or elects an in-app agent handoff.

Impact

The bridge can receive agent enrollment material and execute as the user; its behavior is outside this package's reviewed source.

Mechanism

User-invoked external agent bridge enrollment and launch.

Rationale

Scanner credential/network findings map to this authenticated ARP client, not proven exfiltration. Flag as a warning because explicit agent setup delegates sensitive enrollment to an unpinned external executable.

Evidence

package.jsondist/index.jsREADME.mdnpm-shrinkwrap.json~/.arp-tui/config.json~/.arp-tui/credentials.json

Network endpoints2

arp-relay-dev.up.railway.appgenerous-fish-48.clerk.accounts.dev

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`dist/index.js` defaults bridge execution to `npx -y @snowyroad/braid`.
`agent add` obtains a relay invite and pipes its `connectBlob` to that bridge.
Bridge enrollment then starts an agent unless `--no-start` is supplied.
The bridge command is overrideable through `--bridge-cmd` or `ARP_TUI_BRIDGE_CMD`.

Evidence against

`package.json` has only `prepublishOnly`; no install-time lifecycle hook.
OAuth and relay requests send tokens only to configured ARP/Clerk endpoints.
Credentials are stored in `~/.arp-tui/credentials.json` using mode `0600`.
No `eval`, VM, dynamic module loading, or unrelated file harvesting was found.
Source documents the bridge flow as an explicit `agent add` user action.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 191 KB of source, external domains: 127.0.0.1, app.example.com, arp-relay-dev.up.railway.app, arp-web-dev.up.railway.app, generous-fish-48.clerk.accounts.dev, relay.example.com, your-instance.clerk.accounts.dev

Source & flagged code

2 flagged

dist/index.jsView file

Lines 21-61javascript

21import path from "path";

22function ensureDir0700(dir) {

23 fs.mkdirSync(dir, { recursive: true, mode: 448 });

24}

25function writeFileAtomic0600(file, data) {

26 const dir = path.dirname(file);

27 ensureDir0700(dir);

28 const tmp = path.join(dir, `.${path.basename(file)}.${process.pid}.${Date.now()}.tmp`);

29 fs.writeFileSync(tmp, data, { mode: 384 });

30 try {

31 fs.renameSync(tmp, file);

32 } catch (err) {

33 try {

34 fs.unlinkSync(tmp);

35 } catch {

36 }

37 throw err;

38 }

39}

40function readJsonTolerant(file) {

41 try {

42 return JSON.parse(fs.readFileSync(file, "utf8"));

43 } catch {

44 return null;

45 }

46}

47function loosePermsError(p, expected) {

48 if (process.platform === "win32") return null;

49 let st;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L41

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L41

50 try {

51 st = fs.statSync(p);

52 } catch {

53 return null;

54 }

55 const mode = st.mode & 511;

56 if ((mode & 63) !== 0) {

57 const want = expected === "dir" ? "700" : "600";

58 return `${p} has loose permissions (0${mode.toString(8)}). Fix: chmod ${want} ${p}`;

59 }

60 return null;

61}

Source & flagged code

2 flagged · loading source

dist/index.jsView file

41try { L42: return JSON.parse(fs.readFileSync(file, "utf8")); L43: } catch { ... L47: function loosePermsError(p, expected) { L48: if (process.platform === "win32") return null; L49: let st; ... L63: // src/config.ts L64: var CONFIG_DIR = path2.join(os.homedir(), ".arp-tui"); L65: var CONFIG_FILE = path2.join(CONFIG_DIR, "config.json"); ... L73: var DEV_PROFILE = { L74: relayUrl: "https://arp-relay-dev.up.railway.app", L75: webUrl: "https://arp-web-dev.up.railway.app",

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L41

41Trigger-reachable chain: manifest.bin -> dist/index.js L41: try { L42: return JSON.parse(fs.readFileSync(file, "utf8")); L43: } catch { ... L47: function loosePermsError(p, expected) { L48: if (process.platform === "win32") return null; L49: let st; ... L63: // src/config.ts L64: var CONFIG_DIR = path2.join(os.homedir(), ".arp-tui"); L65: var CONFIG_FILE = path2.join(CONFIG_DIR, "config.json"); ... L73: var DEV_PROFILE = { L74: relayUrl: "https://arp-relay-dev.up.railway.app", L75: webUrl: "https://arp-web-dev.up.railway.app",

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L41

Findings

2 Critical3 Medium6 Low

CriticalCredential Exfiltrationdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/index.jsView file

Lines 21-61javascript

21import path from "path";

22function ensureDir0700(dir) {

23 fs.mkdirSync(dir, { recursive: true, mode: 448 });

24}

25function writeFileAtomic0600(file, data) {

26 const dir = path.dirname(file);

27 ensureDir0700(dir);

28 const tmp = path.join(dir, `.${path.basename(file)}.${process.pid}.${Date.now()}.tmp`);

29 fs.writeFileSync(tmp, data, { mode: 384 });

30 try {

31 fs.renameSync(tmp, file);

32 } catch (err) {

33 try {

34 fs.unlinkSync(tmp);

35 } catch {

36 }

37 throw err;

38 }

39}

40function readJsonTolerant(file) {

41 try {

42 return JSON.parse(fs.readFileSync(file, "utf8"));

43 } catch {

44 return null;

45 }

46}

47function loosePermsError(p, expected) {

48 if (process.platform === "win32") return null;

49 let st;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L41

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L41

50 try {

51 st = fs.statSync(p);

52 } catch {

53 return null;

54 }

55 const mode = st.mode & 511;

56 if ((mode & 63) !== 0) {

57 const want = expected === "dir" ? "700" : "600";

58 return `${p} has loose permissions (0${mode.toString(8)}). Fix: chmod ${want} ${p}`;

59 }

60 return null;

61}