tina4-nodejs@3.13.125
Tina4 for Node.js/TypeScript - native TypeScript conventions and shared Tina4 contracts
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo automatic registry lifecycle attack or credential exfiltration was confirmed. The explicit global AI-skill installer remains a meaningful dangerous capability and warrants a warning.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs tina4nodejs ai and selects Claude Code, or uses its --all option.
Impact
Fetched upstream instructions can affect Claude Code behavior in the current project and future projects.
Mechanism
Explicit CLI installer downloads remote skill files into Claude configuration directories.
AI rationale
No automatic registry lifecycle attack or credential exfiltration was confirmed. The explicit global AI-skill installer remains a meaningful dangerous capability and warrants a warning.
Evidence
packages/cli/src/bin.tspackages/core/src/ai.ts.claude/skills~/.claude/skills
Network endpoints1
raw.githubusercontent.com
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The explicit ai CLI command invokes an AI-context installer.
- That installer targets both the current project and the user's global Claude skills directory.
- It builds raw GitHub URLs and downloads skill content into those destinations.
Evidence against
- No preinstall, install, or postinstall hook is present; prepare only builds the package.
- The installer is reached only through the user-invoked ai command, not on import or installation.
- The AI client defaults to official OpenAI and Anthropic endpoints when configured.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
26 flaggedpackages/core/dist/index.jsView file
14function warnEnv(message) {
L15: process.stderr.write(`[tina4] ${message}
L16: `);
...
L19: return value.replace(REFERENCE, (whole, name) => {
L20: const resolved = process.env[name] ?? parsed[name];
L21: if (resolved !== void 0) return resolved;
...
L245: try {
L246: return new TextDecoder("utf-8", { fatal: true }).decode(buf);
L247: } catch {
...
L511: }
L512: const projectRoot3 = process.cwd();
L513: let dirCandidate = dirRaw;
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
packages/core/dist/index.jsView on unpkg · L1414Trigger-reachable chain: manifest.main -> packages/core/dist/index.js
L14: function warnEnv(message) {
L15: process.stderr.write(`[tina4] ${message}
L16: `);
...
L19: return value.replace(REFERENCE, (whole, name) => {
L20: const resolved = process.env[name] ?? parsed[name];
L21: if (resolved !== void 0) return resolved;
...
L245: try {
L246: return new TextDecoder("utf-8", { fatal: true }).decode(buf);
L247: } catch {
...
L511: }
L512: const projectRoot3 = process.cwd();
L513: let dirCandidate = dirRaw;
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
packages/core/dist/index.jsView on unpkg · L14Findings
3 Critical10 High16 Medium6 Low
CriticalCredential Exfiltrationpackages/core/dist/index.js
CriticalTrigger Reachable Dangerous Capabilitypackages/core/dist/index.js
CriticalPrevious Version Dangerous Deltapackages/cli/dist/bin.js
HighChild Processpackages/core/dist/index.js
HighShell
HighSame File Env Network Executionpackages/core/dist/index.js
HighCredential Redirect Persistencepackages/core/dist/index.js
HighCommand Output Exfiltrationpackages/core/dist/index.js
HighSandbox Evasion Gated Capabilitypackages/core/src/metrics.ts
HighCross File Remote Execution Contextpackages/cli/dist/bin.js
HighTrigger Reachable Credential Exfiltration
Affected versions and remediation
This report applies to tina4-nodejs@3.13.125.
See all versions of tina4-nodejs for other recorded verdicts.
- Review the evidence and your use of tina4-nodejs@3.13.125 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.