registry / arp-tui / 0.0.3

arp-tui@0.0.3

Human-facing terminal client for Agent Relay Protocol. Tail channels and post messages from your terminal.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The user-invoked CLI performs OAuth and connects to its configured relay, storing its own credentials locally with restrictive permissions.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Explicit arp-tui login, tail, status, or profile command

Impact

No concrete exfiltration, persistence, destructive action, or foreign control-surface mutation established.

Mechanism

User-authorized OAuth credential handling and ARP relay REST/WebSocket communication

Rationale

The scanner’s credential/network indicators correspond to documented OAuth and relay-client functionality. Source inspection found no install-time execution or concrete malicious chain.

Evidence

package.jsondist/index.jsREADME.md~/.arp-tui/config.json~/.arp-tui/credentials.json/tmp/arp-tui-frames.jsonl

Network endpoints3

arp-relay-dev.up.railway.apparp-web-dev.up.railway.appgenerous-fish-48.clerk.accounts.dev

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no install/preinstall/postinstall hook; only prepublishOnly.
dist/index.js runs as the user-invoked CLI entrypoint, not on import/install.
OAuth tokens are sent only to configured Clerk OAuth endpoints and relay API/WebSocket endpoints.
Credential/config writes are confined to ~/.arp-tui with 0600 files and a 0700 directory.
The only child process opens the user’s browser for explicit login.
No shell execution, eval/vm, payload loading, foreign config mutation, or broad file harvesting found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 106 KB of source, external domains: 127.0.0.1, app.example.com, arp-relay-dev.up.railway.app, arp-web-dev.up.railway.app, generous-fish-48.clerk.accounts.dev, relay.example.com, your-instance.clerk.accounts.dev

Source & flagged code

2 flagged

dist/index.jsView file

Lines 21-61javascript

21import path from "path";

22function ensureDir0700(dir) {

23 fs.mkdirSync(dir, { recursive: true, mode: 448 });

24}

25function writeFileAtomic0600(file, data) {

26 const dir = path.dirname(file);

27 ensureDir0700(dir);

28 const tmp = path.join(dir, `.${path.basename(file)}.${process.pid}.${Date.now()}.tmp`);

29 fs.writeFileSync(tmp, data, { mode: 384 });

30 try {

31 fs.renameSync(tmp, file);

32 } catch (err) {

33 try {

34 fs.unlinkSync(tmp);

35 } catch {

36 }

37 throw err;

38 }

39}

40function readJsonTolerant(file) {

41 try {

42 return JSON.parse(fs.readFileSync(file, "utf8"));

43 } catch {

44 return null;

45 }

46}

47function loosePermsError(p, expected) {

48 if (process.platform === "win32") return null;

49 let st;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L41

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L41

50 try {

51 st = fs.statSync(p);

52 } catch {

53 return null;

54 }

55 const mode = st.mode & 511;

56 if ((mode & 63) !== 0) {

57 const want = expected === "dir" ? "700" : "600";

58 return `${p} has loose permissions (0${mode.toString(8)}). Fix: chmod ${want} ${p}`;

59 }

60 return null;

61}

Source & flagged code

2 flagged · loading source

dist/index.jsView file

41try { L42: return JSON.parse(fs.readFileSync(file, "utf8")); L43: } catch { ... L47: function loosePermsError(p, expected) { L48: if (process.platform === "win32") return null; L49: let st; ... L63: // src/config.ts L64: var CONFIG_DIR = path2.join(os.homedir(), ".arp-tui"); L65: var CONFIG_FILE = path2.join(CONFIG_DIR, "config.json"); ... L73: var DEV_PROFILE = { L74: relayUrl: "https://arp-relay-dev.up.railway.app", L75: webUrl: "https://arp-web-dev.up.railway.app",

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L41

41Trigger-reachable chain: manifest.bin -> dist/index.js L41: try { L42: return JSON.parse(fs.readFileSync(file, "utf8")); L43: } catch { ... L47: function loosePermsError(p, expected) { L48: if (process.platform === "win32") return null; L49: let st; ... L63: // src/config.ts L64: var CONFIG_DIR = path2.join(os.homedir(), ".arp-tui"); L65: var CONFIG_FILE = path2.join(CONFIG_DIR, "config.json"); ... L73: var DEV_PROFILE = { L74: relayUrl: "https://arp-relay-dev.up.railway.app", L75: webUrl: "https://arp-web-dev.up.railway.app",

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L41

Findings

2 Critical3 Medium6 Low

CriticalCredential Exfiltrationdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/index.jsView file

Lines 21-61javascript

21import path from "path";

22function ensureDir0700(dir) {

23 fs.mkdirSync(dir, { recursive: true, mode: 448 });

24}

25function writeFileAtomic0600(file, data) {

26 const dir = path.dirname(file);

27 ensureDir0700(dir);

28 const tmp = path.join(dir, `.${path.basename(file)}.${process.pid}.${Date.now()}.tmp`);

29 fs.writeFileSync(tmp, data, { mode: 384 });

30 try {

31 fs.renameSync(tmp, file);

32 } catch (err) {

33 try {

34 fs.unlinkSync(tmp);

35 } catch {

36 }

37 throw err;

38 }

39}

40function readJsonTolerant(file) {

41 try {

42 return JSON.parse(fs.readFileSync(file, "utf8"));

43 } catch {

44 return null;

45 }

46}

47function loosePermsError(p, expected) {

48 if (process.platform === "win32") return null;

49 let st;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L41

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L41

50 try {

51 st = fs.statSync(p);

52 } catch {

53 return null;

54 }

55 const mode = st.mode & 511;

56 if ((mode & 63) !== 0) {

57 const want = expected === "dir" ? "700" : "600";

58 return `${p} has loose permissions (0${mode.toString(8)}). Fix: chmod ${want} ${p}`;

59 }

60 return null;

61}