registry / tina4-nodejs / 3.13.116
tina4-nodejs@3.13.116
⚠ Under reviewTina4 for Node.js/TypeScript - native TypeScript conventions and shared Tina4 contracts
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis completed at 0.0% confidence. No malicious behavior was detected; 29 low-signal pattern(s) were surfaced and cleared.
Static reason
Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
20 flaggedpackages/cli/dist/bin.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = tina4-nodejs@3.13.136
matchedIdentity = npm:dGluYTQtbm9kZWpz:3.13.136
similarity = 0.708
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
packages/cli/dist/bin.jsView on unpkg15Cross-file remote execution chain: packages/cli/dist/bin.js spawns packages/core/dist/index.js; helper contains network access plus dynamic code execution.
L15: function warnEnv(message) {
L16: process.stderr.write(`[tina4] ${message}
L17: `);
...
L20: return value.replace(REFERENCE, (whole, name) => {
L21: const resolved = process.env[name] ?? parsed[name];
L22: if (resolved !== void 0) return resolved;
...
L246: try {
L247: return new TextDecoder("utf-8", { fatal: true }).decode(buf);
L248: } catch {
...
L512: }
L513: const projectRoot3 = process.cwd();
L514: let dirCandidate = dirRaw;
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
packages/cli/dist/bin.jsView on unpkg · L15Findings
3 Critical10 High10 Medium6 Low
CriticalCredential Exfiltrationpackages/core/dist/index.js
CriticalTrigger Reachable Dangerous Capabilitypackages/core/dist/index.js
CriticalPrevious Version Dangerous Deltapackages/cli/dist/bin.js
HighChild Processpackages/core/dist/index.js
HighShell
HighSame File Env Network Executionpackages/core/dist/index.js
HighCredential Redirect Persistencepackages/core/dist/index.js
HighCommand Output Exfiltrationpackages/core/dist/index.js
HighSandbox Evasion Gated Capabilitypackages/core/src/metrics.ts
HighCross File Remote Execution Contextpackages/cli/dist/bin.js
HighTrigger Reachable Credential Exfiltration
Affected versions and remediation
This report applies to tina4-nodejs@3.13.116.
See all versions of tina4-nodejs for other recorded verdicts.
- Review the evidence and your use of tina4-nodejs@3.13.116 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.