registry / tianxincode / 1.0.51

tianxincode@1.0.51

AI Coding Assistant

AI Security Review

scanned 7d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User invokes the `txcode` CLI; shell and downloader actions require agent/API use.

Impact

Persistent device usage reporting with TLS verification disabled; AI-driven actions can modify project files, run commands, or install configured external tooling.

Mechanism

Startup telemetry plus AI-mediated command and tool execution.

Rationale

The package is not confirmed malicious, but automatic telemetry with disabled TLS validation and broad AI-mediated execution capabilities leave a concrete unresolved security risk. No lifecycle hook, credential exfiltration, stealth persistence, or install-time foreign control-surface mutation was found.

Evidence

package.jsondist/index.jsdist/services/system/device-sync.service.jsdist/services/hub/txcode_hub.service.jsdist/core/tools/provider/bash.jsdist/core/lsp/downloader.js~/.txcode/bin./.txcode/memory/MEMORY.md

Network endpoints1

txcode.homecommunity.cn/api/usage/report_usage

tianxincode@1.0.51

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code