registry / tianxincode / 1.0.55

tianxincode@1.0.55

AI Coding Assistant

AI Security Review

scanned 15h ago · by lpm-firewall-ai

Running `txcode web` exposes unauthenticated local project/system control APIs. Absolute-path file reads, writes, deletions, and provider-key retrieval are directly reachable through registered HTTP routes; the WebSocket path can invoke an AI workflow with a shell tool.

Static reason

No blocking static signals were detected.

Trigger

User runs `txcode web` and a client reaches the server.

Impact

A reachable client can exfiltrate local files and API keys, alter or delete arbitrary paths, and potentially obtain command execution through the agent workflow.

Mechanism

Unauthenticated permissive web API with absolute filesystem access and agent-driven shell execution.

Rationale

No concrete malicious install-time or stealth execution chain is present, so blocking is not justified. However, the unauthenticated runtime API exposes critical file, secret, destructive, and potential command-execution capabilities.

Evidence

package.jsondist/index.jsdist/gateway/server/web.server.jsdist/gateway/api/file/download_file.jsdist/gateway/api/file/write_file.jsdist/gateway/api/file/delete_file.jsdist/gateway/api/sys_config/detail_provider_config.jsdist/gateway/websocket/code.websocket.jsdist/core/tools/provider/bash.jsdist/services/system/device-sync.service.jsdist/services/hub/txcode_hub.service.jsdist/services/skill/skills.manager.js

Decision evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

`dist/gateway/server/web.server.js` starts an unauthenticated Express server with permissive `cors()` and no host restriction.
`dist/gateway/api/file/download_file.js` accepts absolute paths and serves existing files, including dotfiles.
`dist/gateway/api/file/write_file.js` and `delete_file.js` permit absolute-path writes and recursive deletion.
`dist/gateway/api/sys_config/detail_provider_config.js` returns stored provider API keys without authentication.
`dist/core/tools/provider/bash.js` executes shell commands; WebSocket chat routes invoke the code-agent workflow.
`dist/services/system/device-sync.service.js` reports a generated device ID and platform at runtime to the configured hub.

Evidence against

`package.json` contains no npm preinstall, install, or postinstall lifecycle hook.
`dist/index.js` executes only when the CLI/bin is invoked, not during package installation.
The shell, file, and AI capabilities are consistent with the declared AI coding-assistant function.
No source evidence of stealth persistence, credential harvesting at install time, or concealed payload execution.
`dist/services/skill/skills.manager.js` reads external agent skill directories but does not write to them.

Source & flagged code

4 flagged

dist/gateway/api_routes.jsView file

Lines 1-28javascript

1import { Router } from 'express';

2import * as fs from 'fs';

3import * as path

Source & flagged code

4 flagged · loading source

dist/gateway/api_routes.jsView file

8const fileUrl = pathToFileURL(filePath).href; L9: return await import(fileUrl); L10: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/gateway/api_routes.jsView on unpkg · L8

test_tool_notify.pyView file

•path = test_tool_notify.py kind = build_helper sizeBytes = 2339 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

test_tool_notify.pyView on unpkg

web/dist/assets/element-icons-B-tDfklg.woffView file

•path = web/dist/assets/element-icons-B-tDfklg.woff kind = high_entropy_blob sizeBytes = 28200 magicHex = [redacted]

Findings

2 High5 Medium6 Low

HighShips High Entropy Blobweb/dist/assets/element-icons-B-tDfklg.woff

HighOversized Source Fileweb/dist/assets/index-B6eYD1o1.js

MediumDynamic Requiredist/gateway/api_routes.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertest_tool_notify.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code