tina4-nodejs@3.13.124
Tina4 for Node.js/TypeScript - native TypeScript conventions and shared Tina4 contracts
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has an explicit user-invoked global AI-agent configuration capability with remote content loading. It lacks automatic install-time activation or confirmed credential theft, so it should warn rather than block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The user runs `tina4nodejs ai` and selects Claude Code or uses `--all`.
Impact
Remote content can influence future AI-agent behavior in the selected project and globally for Claude Code.
Mechanism
User-invoked remote AI skill installation and AI context-file mutation.
AI rationale
The package has an explicit user-invoked global AI-agent configuration capability with remote content loading. It lacks automatic install-time activation or confirmed credential theft, so it should warn rather than block.
Evidence
package.jsonpackages/cli/src/bin.tspackages/core/src/ai.tspackages/core/src/aiClient.ts./.claude/skills~/.claude/skills./CLAUDE.md./AGENTS.md./.cursorules./.github/copilot-instructions.md
Network endpoints1
raw.githubusercontent.com
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The explicit `ai` CLI command installs AI coding-assistant context files.
- Selecting Claude Code downloads remote skill files into both the project and the user's global Claude skills directory.
- The installer can update existing AI context files and can invoke pip to install another tool.
Evidence against
- There are no preinstall, install, or postinstall hooks; the only lifecycle hook builds the package.
- The AI installer is reached only through the user-invoked `ai` command and normally presents a selection prompt.
- The AI client defaults to official OpenAI and Anthropic endpoints and uses a user-supplied key.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
26 flaggedpackages/core/dist/index.jsView file
14function warnEnv(message) {
L15: process.stderr.write(`[tina4] ${message}
L16: `);
...
L19: return value.replace(REFERENCE, (whole, name) => {
L20: const resolved = process.env[name] ?? parsed[name];
L21: if (resolved !== void 0) return resolved;
...
L245: try {
L246: return new TextDecoder("utf-8", { fatal: true }).decode(buf);
L247: } catch {
...
L511: }
L512: const projectRoot3 = process.cwd();
L513: let dirCandidate = dirRaw;
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
packages/core/dist/index.jsView on unpkg · L1414Trigger-reachable chain: manifest.main -> packages/core/dist/index.js
L14: function warnEnv(message) {
L15: process.stderr.write(`[tina4] ${message}
L16: `);
...
L19: return value.replace(REFERENCE, (whole, name) => {
L20: const resolved = process.env[name] ?? parsed[name];
L21: if (resolved !== void 0) return resolved;
...
L245: try {
L246: return new TextDecoder("utf-8", { fatal: true }).decode(buf);
L247: } catch {
...
L511: }
L512: const projectRoot3 = process.cwd();
L513: let dirCandidate = dirRaw;
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
packages/core/dist/index.jsView on unpkg · L14Findings
3 Critical10 High16 Medium6 Low
CriticalCredential Exfiltrationpackages/core/dist/index.js
CriticalTrigger Reachable Dangerous Capabilitypackages/core/dist/index.js
CriticalPrevious Version Dangerous Deltapackages/cli/src/bin.ts
HighChild Processpackages/core/dist/index.js
HighShell
HighSame File Env Network Executionpackages/core/dist/index.js
HighCredential Redirect Persistencepackages/core/dist/index.js
HighEntrypoint Foreign Package Code Overwritepackages/core/dist/index.js
HighCommand Output Exfiltrationpackages/core/dist/index.js
HighSandbox Evasion Gated Capabilitypackages/core/src/metrics.ts
HighCross File Remote Execution Context
Affected versions and remediation
This report applies to tina4-nodejs@3.13.124.
See all versions of tina4-nodejs for other recorded verdicts.
- Review the evidence and your use of tina4-nodejs@3.13.124 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.