registry / eve-studio / 0.1.2

eve-studio@0.1.2

Local observability workspace for eve agents. Inspect live sessions, messages, tool calls, steps, and usage in your browser.

AI Security Review

scanned 19h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

Running eve-studio and confirming the mount prompt, or passing --yes

Impact

Adds @eve-studio/extension to the selected Eve project and enables local session capture

Mechanism

Creates a project extension mount and runs the project package manager

Rationale

The package has a real agent-extension setup capability, but it is explicit and guarded by confirmation rather than stealthy or install-time behavior. Source inspection found no concrete malicious chain.

Evidence

package.jsondist/cli.jsdist/mount.jsdist/server.jsdist/disk-scan.jsagent/extensions/studio.ts.workflow-data/streams/chunks

Network endpoints1

127.0.0.1

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as with false-positive risk.

eve-studio@0.1.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code