tina4-nodejs@3.13.120
Tina4 for Node.js/TypeScript - native TypeScript conventions and shared Tina4 contracts
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package contains an explicit user-command AI configuration installer with global persistence and remote content loading. That warrants a warning for agent-control capability, not a malware block, because it is not automatically triggered and no credential exfiltration was confirmed.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The user runs tina4nodejs ai and selects Claude Code, or runs tina4nodejs ai --all.
Impact
A user-invoked command can persist third-party instructions in the project and the user's global Claude configuration; a configured skill ref can change the downloaded revision.
Mechanism
Remote skill download and AI context-file installation.
AI rationale
The package contains an explicit user-command AI configuration installer with global persistence and remote content loading. That warrants a warning for agent-control capability, not a malware block, because it is not automatically triggered and no credential exfiltration was confirmed.
Evidence
packages/cli/src/bin.tspackages/core/src/ai.ts.claude/skills~/.claude/skillsAGENTS.mdCLAUDE.md
Network endpoints1
raw.githubusercontent.com
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The published manifest exposes the tina4nodejs executable, while its lifecycle scripts are build-only prepare and prepublish actions.
- The explicit ai CLI command dynamically loads the installer and runs it after either --all or an interactive selection.
- The installer targets context files for several AI tools, including OpenAI Codex AGENTS.md.
- For Claude Code, the installer downloads remote skill files into both the selected project and the user's global .claude skills directory.
- The all-tools path also runs a shell command to install or upgrade tina4-ai through pip.
Evidence against
- No preinstall, install, or postinstall hook is declared.
- The AI-writing and network behavior is reached through an explicit user CLI command, not package import or registry installation.
- The inspected code does not show collection or transmission of existing credentials to an unrelated endpoint.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem
Source & flagged code
20 flaggedpackages/cli/dist/bin.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = tina4-nodejs@3.13.136
matchedIdentity = npm:dGluYTQtbm9kZWpz:3.13.136
similarity = 0.725
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
packages/cli/dist/bin.jsView on unpkg15Cross-file remote execution chain: packages/cli/dist/bin.js spawns packages/core/dist/index.js; helper contains network access plus dynamic code execution.
L15: function warnEnv(message) {
L16: process.stderr.write(`[tina4] ${message}
L17: `);
...
L20: return value.replace(REFERENCE, (whole, name) => {
L21: const resolved = process.env[name] ?? parsed[name];
L22: if (resolved !== void 0) return resolved;
...
L246: try {
L247: return new TextDecoder("utf-8", { fatal: true }).decode(buf);
L248: } catch {
...
L512: }
L513: const projectRoot3 = process.cwd();
L514: let dirCandidate = dirRaw;
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
packages/cli/dist/bin.jsView on unpkg · L15Findings
3 Critical10 High10 Medium6 Low
CriticalCredential Exfiltrationpackages/core/dist/index.js
CriticalTrigger Reachable Dangerous Capabilitypackages/core/dist/index.js
CriticalPrevious Version Dangerous Deltapackages/cli/dist/bin.js
HighChild Processpackages/core/dist/index.js
HighShell
HighSame File Env Network Executionpackages/core/dist/index.js
HighCredential Redirect Persistencepackages/core/dist/index.js
HighCommand Output Exfiltrationpackages/core/dist/index.js
HighSandbox Evasion Gated Capabilitypackages/core/src/metrics.ts
HighCross File Remote Execution Contextpackages/cli/dist/bin.js
HighTrigger Reachable Credential Exfiltration
Affected versions and remediation
This report applies to tina4-nodejs@3.13.120.
See all versions of tina4-nodejs for other recorded verdicts.
- Review the evidence and your use of tina4-nodejs@3.13.120 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.