registry / tina4-nodejs / 3.13.105
tina4-nodejs@3.13.105
Tina4 for Node.js/TypeScript - native TypeScript conventions and shared Tina4 contracts
AI Security Review
scanned 3mo ago · by lpm-firewall-aiNot malicious under the install-control-surface policy because there is no unconsented install-time mutation. Warn for the guarded MCP lifecycle behavior and explicit global AI-skill installation capability.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Start the server with TINA4_DEBUG enabled, or run `tina4nodejs ai` and select Claude/--all.
Impact
AI tools may discover the local dev MCP server; explicit CLI use can modify project and global Claude skill directories with remotely fetched content.
Mechanism
Project MCP auto-discovery plus explicit assistant-context and global-skill installation.
AI rationale
Not malicious under the install-control-surface policy because there is no unconsented install-time mutation. Warn for the guarded MCP lifecycle behavior and explicit global AI-skill installation capability.
Evidence
package.jsonpackages/core/src/server.tspackages/core/src/docsAutoDiscovery.tspackages/core/src/ai.tspackages/cli/src/bin.ts.tina4/mcp.json.gitignore.claude/skills~/.claude/skillsCLAUDE.md.cursorules.github/copilot-instructions.mdAGENTS.md
Network endpoints2
raw.githubusercontent.comlocalhost:${portStr}/__dev/mcp
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Debug server startup writes MCP auto-discovery configuration into the project.
- The explicit `tina4nodejs ai` command installs assistant context files.
- Claude selection downloads Tina4 skills to both project and global Claude skill directories.
- Downloaded skill content is fetched from raw.githubusercontent.com and written locally.
Evidence against
- No preinstall, install, or postinstall hook; `prepare` only runs the package build.
- AI-context mutation is behind an explicit CLI command or debug-server startup.
- The automatic MCP endpoint is localhost and package-owned; no credential harvesting or exfiltration was confirmed.
- No concrete remote payload execution, destructive behavior, or foreign-package overwrite was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
20 flaggedpackages/cli/dist/bin.jsView file
45405patternName = generic_password
severity = medium
line = 45405
matchedText = const re... });
Medium
Secret Pattern
Package contains a possible secret pattern.
packages/cli/dist/bin.jsView on unpkg · L4540545408patternName = generic_password
severity = medium
line = 45408
matchedText = const du... });
Medium
Secret Pattern
Hardcoded password in packages/cli/dist/bin.js
packages/cli/dist/bin.jsView on unpkg · L4540845411patternName = generic_password
severity = medium
line = 45411
matchedText = const lo... });
Medium
Secret Pattern
Hardcoded password in packages/cli/dist/bin.js
packages/cli/dist/bin.jsView on unpkg · L45411packages/core/dist/index.jsView file
Findings
3 Critical10 High10 Medium6 Low
CriticalCredential Exfiltrationpackages/core/dist/index.js
CriticalTrigger Reachable Dangerous Capabilitypackages/core/dist/index.js
CriticalPrevious Version Dangerous Deltapackages/core/src/queueBackends/mongoBackend.ts
HighChild Processpackages/core/dist/index.js
HighShell
HighSame File Env Network Executionpackages/core/dist/index.js
HighCredential Redirect Persistencepackages/core/dist/index.js
HighEntrypoint Foreign Package Code Overwritepackages/core/dist/index.js
HighCommand Output Exfiltrationpackages/core/dist/index.js
HighSandbox Evasion Gated Capabilitypackages/core/src/metrics.ts
HighCross File Remote Execution Context
Affected versions and remediation
This report applies to tina4-nodejs@3.13.105.
See all versions of tina4-nodejs for other recorded verdicts.
- Review the evidence and your use of tina4-nodejs@3.13.105 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.