tina4-nodejs
Tina4 for Node.js/TypeScript - native TypeScript conventions and shared Tina4 contracts
This report shows the evidence for tina4-nodejs@3.13.157. 1 of 61 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package includes a reviewer-directed instruction to warn rather than block when reviewing work that departs from its rules. This is explicit reviewer manipulation, which is evidence of malicious intent even though the inspected credential and lifecycle leads did not establish a separate attack chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A reviewer reads CLAUDE.md during package review.
Impact
Could bias a security review toward a non-blocking verdict.
Mechanism
The file directs reviewers to warn rather than block when reviewed work departs from its prescribed rules.
Attack narrative
The shipped CLAUDE.md addresses work being reviewed and instructs reviewers to warn, “do not block,” creating a direct attempt to steer the security verdict.
AI rationale
The package includes a reviewer-directed instruction to warn rather than block when reviewing work that departs from its rules. This is explicit reviewer manipulation, which is evidence of malicious intent even though the inspected credential and lifecycle leads did not establish a separate attack chain.
Evidence
CLAUDE.md
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- CLAUDE.md tells a reviewer to warn and “do not block” when reviewing work that departs from its preferred rules.
- package.json includes CLAUDE.md in the package files.
Evidence against
- The package lifecycle scripts shown run build commands; no install-time data transmission was identified.
- The inspected AI configuration uses provider-specific endpoints and a key explicitly configured for that provider; no credential exfiltration was confirmed in the reviewed excerpts.
- The CLI dispatches commands only when run as the entry point, not when imported.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
25 flaggedpackages/core/dist/index.jsView file
18let end = s.length;
L19: while (end > 0 && s.charCodeAt(end - 1) === SLASH) end--;
L20: return end === s.length ? s : s.slice(0, end);
...
L78: function warnEnv(message) {
L79: process.stderr.write(`[tina4] ${message}
L80: `);
...
L83: return value.replace(REFERENCE, (whole, name) => {
L84: const resolved = process.env[name] ?? parsed[name];
L85: if (resolved !== void 0) return resolved;
...
L533: }
L534: const logDir = (isAbsolute(dirCandidate) ? dirCandidate : join2(process.cwd(), dirCandidate)).replace(/\/$/, "");
L535: if (!fileCandidate) return { logDir, logFile: null, layout: "directory" };
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
packages/core/dist/index.jsView on unpkg · L18•context = LockMode = 'Exclusive', @LockOwner = 'Session', @LockTimeout = -1`\n );\n return { kind: "mssql" };\n }\n } catch (err) {\n Log.debug(`DB migration lock unavailable (${engine}): ${err instanceof Error ? err.message : err}; using a file lock`);\n }\n return acquireFileLock(dir);\n}\nasync function acquireFileLock(dir) {\n const lockFile = join6(tmpdir(), `tina4-migration-${createHash2("sha256").update(resolve3(dir)).digest("hex")}.lock`);\n const deadline = Date.now() + 6e4;\n for (; ; ) {\n try {\n writeFileSync(lockFile, String(process.pid), { flag: "wx" });\n return { kind: "file", resource: lockFile };\n } catch (err) {\n if (err.code !== "EEXIST") {\n Log.debug(`file migration lock unavailable: ${err instanceof Error ? err.mes
Critical
Findings
3 Critical9 High16 Medium7 Low
CriticalCredential Exfiltrationpackages/core/dist/index.js
CriticalEncrypted Payload Temp Executionpackages/core/dist/index.js
CriticalTrigger Reachable Dangerous Capabilitypackages/core/dist/index.js
HighChild Processpackages/core/dist/index.js
HighShell
HighCredential Redirect Persistencepackages/core/dist/index.js
HighCommand Output Exfiltrationpackages/core/dist/index.js
HighSandbox Evasion Gated Capabilitypackages/core/src/metrics.ts
HighCross File Remote Execution Contextpackages/cli/dist/bin.js
HighTrigger Reachable Credential Exfiltrationpackages/core/dist/index.js
HighRuntime Package Install
Affected versions and remediation
This report applies to tina4-nodejs@3.13.157.
The versions list below shows the verdict for each recorded version.
- Avoid installing tina4-nodejs@3.13.157. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.