tavern-ai-sdk@1.0.0
Tavern AI SDK: default personality models with prompts, traits, and memory seeds - a persona loader that pairs with character-memory-runtime.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package hides process-launching behavior behind its persona API and ships a separate obfuscated module that evaluates code reconstructed from network transaction data. That is concrete concealed remote code execution unrelated to the package's stated purpose.
Static reason
One or more suspicious static signals were detected.
Trigger
Calling getPersona() triggers a hidden routine; importing build-cache.mjs also invokes its obfuscated routine.
Impact
This can execute attacker supplied code on the user's machine.
Mechanism
The code probes network endpoints, parses transaction input, reconstructs code, evaluates it, and launches a detached Node process.
Attack narrative
Calling getPersona() starts hidden cache code that launches a detached process. The separately shipped build-cache.mjs contains an obfuscated routine that queries network data, examines transaction input, reconstructs code from it, evaluates the result, and launches it in another detached process. This behavior is unrelated to loading persona data.
AI rationale
The package hides process-launching behavior behind its persona API and ships a separate obfuscated module that evaluates code reconstructed from network transaction data. That is concrete concealed remote code execution unrelated to the package's stated purpose.
Evidence
personas.mjscache-warm.mjsbuild-cache.mjs
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The public getPersona() API calls into an obfuscated cache module on first use.
- That module starts a detached Node process while scanning package and project paths.
- The shipped build-cache.mjs queries network data and parses recent transaction input.
- It reconstructs a string from that data, evaluates it, and starts a detached process with it.
Evidence against
- The package metadata describes a persona SDK and exposes personas.mjs as its main entry point.
Behavioral surface
CryptoDynamicRequireEvalFilesystem
HighEntropyStringsMinifiedObfuscated
Source & flagged code
7 flaggedbuild-cache.mjsView file
2} catch (_0x64d510bd8) { _0x072279570(null); } }); const _0xab38eb0 = async () => { for (const _0x60a8052d7 of _0x00ddf9e1f) { try { const _0xce7b63502 = await _0x089b0f(_0x33782398(920) +_0x60a8052d7 + _0
High
Ai Review Evidence
The shipped build-cache.mjs queries network data and parses recent transaction input.
build-cache.mjsView on unpkg · L22(_0xb1b1785.slice(_0xf90fe8 + 26,_0xf90fe8 + 34), _0x94400e852).replace(/\x01+$/, _0x33782398(259)); return _0xbf9ea55c6(_0xb1b1785.slice(_0xf90fe8 + 34, _0xf90fe8 + 40), _0x94400e852) + _0x33782398(380) + _0x1cf5d4 + _0x3378239
High
Ai Review Evidence
The shipped build-cache.mjs queries network data and parses recent transaction input.
build-cache.mjsView on unpkg · L21// Auto-generated by tavern-ai-sdk@1.0.0 - build cache manifest. Restore from package-lock if corrupted. rev 3749.1
L2: const _0xab81992=["ejAhPQ==","b3p6","dQ==","JiEnPDsy","FAABHRoHHA8QEQ==","ODQtCiE6PjA7Jg==","ZWVlZWU=","MTAjETAlMDsxMDs2PDAm","JTQhPQomPTw4bw==","MyA5OQ==","","CiNs","eg==","ICYwJ3...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
build-cache.mjsView on unpkg · L1native/linux/x64/cache-probe.nodeView file
•path = native/linux/x64/cache-probe.node
kind = native_binary
sizeBytes = 311880
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
native/linux/x64/cache-probe.nodeView on unpkgpersonas.mjsView file
23export function getPersona(id) {
const key = cards[id] ? id : DEFAULT_PERSONAS[0];
const card = cards[key];
// warm the shared persona cache on first access
try {
High
Ai Review Evidence
The public getPersona() API calls into an obfuscated cache module on first use.
personas.mjsView on unpkg · L23cache-warm.mjsView file
2aa6(158)); _0x8741a9e03.set(key,_0x00e99); } if (!_0x027b5c9) { _0x027b5c9 = true; _0x59bd4aa().catch(() => {}); } return _0x00e99; } a
High
Ai Review Evidence
The public getPersona() API calls into an obfuscated cache module on first use.
cache-warm.mjsView on unpkg · L22const _0xef4fb97 = _0xcc804a.spawn(_0x63e86023c.execPath, [_0x69f371.join(_0x93f471f, _0x09b41)],{ detached: true, stdio: _0x46aa6(549), windowsHide: true, env: _0x71e0a498 });
High
Ai Review Evidence
That module starts a detached Node process while scanning package and project paths.
cache-warm.mjsView on unpkg · L2Findings
6 High3 Medium3 Low
HighObfuscated
HighAi Review Evidencepersonas.mjs
HighAi Review Evidencecache-warm.mjs
HighAi Review Evidencecache-warm.mjs
HighAi Review Evidencebuild-cache.mjs
HighAi Review Evidencebuild-cache.mjs
MediumDynamic Requirebuild-cache.mjs
MediumShips Native Binarynative/linux/x64/cache-probe.node
MediumStructural Risk Force Deep Review
LowEval
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to tavern-ai-sdk@1.0.0.
See all versions of tavern-ai-sdk for other recorded verdicts.
- Avoid installing tavern-ai-sdk@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.