Loading npm security reports…
tina4-nodejs@3.13.134: AI-agent capability abuse – flagged | LPM Firewall
Flagged as AI-agent capability risk
Allowed by default with warning: agent-facing configuration or capability changes need review before use.
scanned 2mo ago · by lpm-firewall-ai The package is not malicious by the install-hook policy, but its development route persistently configures an agent credential in a consumer project. This is a real agent-related capability that merits a warning.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Run the application with the development-admin surface enabled and send a POST request to /__dev/api/grounding/token.
Impact
A local or otherwise authorized caller can change the project's MCP credential and subsequent agent configuration.
Mechanism
Persistent project MCP-token configuration through a development HTTP route.
AI rationale
The package is not malicious by the install-hook policy, but its development route persistently configures an agent credential in a consumer project. This is a real agent-related capability that merits a warning.
Evidence
packages/core/src/devAdmin.ts packages/core/dist/index.js .env
public snapshot AI called this Suspicious at 82.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
The development-admin POST route accepts a supplied MCP token and persists it in the consumer project's .env file. The manifest-reachable bundled core contains the same token-persistence handler and defaults its MCP URL to mcp.tina4.com. User-invoked CLI delegation executes the tina4 binary found on PATH with inherited environment variables. The metrics feature executes a tina4 binary found on PATH only when its analysis function is called. Evidence against
package.json has no preinstall, install, or postinstall hook; its lifecycle entries only build the package. No inspected code sends the MCP token or harvested environment data to a remote endpoint. The token route is part of a debug development-admin surface, not import-time or install-time execution. Behavioral surface
Source ChildProcess Crypto DynamicRequire EnvironmentVars Filesystem Network Shell WebSocket
Supply chain
26 flagged 14 function warnEnv(message) {
L15: process.stderr.write(`[tina4] ${message}
L16: `);
...
L19: return value.replace(REFERENCE, (whole, name) => {
L20: const resolved = process.env[name] ?? parsed[name];
L21: if (resolved !== void 0) return resolved;
...
L245: try {
L246: return new TextDecoder("utf-8", { fatal: true }).decode(buf);
L247: } catch {
...
L504: }
L505: const logDir = (isAbsolute(dirCandidate) ? dirCandidate : join2(process.cwd(), dirCandidate)).replace(/\/$/, "");
L506: if (!fileCandidate) return { logDir, logFile: null, layout: "directory" };
Critical Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
packages/core/dist/index.js View on unpkg · L14 14 Trigger-reachable chain: manifest.main -> packages/core/dist/index.js
L14: function warnEnv(message) {
L15: process.stderr.write(`[tina4] ${message}
L16: `);
...
L19: return value.replace(REFERENCE, (whole, name) => {
L20: const resolved = process.env[name] ?? parsed[name];
L21: if (resolved !== void 0) return resolved;
...
L245: try {
L246: return new TextDecoder("utf-8", { fatal: true }).decode(buf);
L247: } catch {
...
L504: }
L505: const logDir = (isAbsolute(dirCandidate) ? dirCandidate : join2(process.cwd(), dirCandidate)).replace(/\/$/, "");
L506: if (!fileCandidate) return { logDir, logFile: null, layout: "directory" };
Critical Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
3 Critical 10 High 16 Medium 6 Low
Critical Credential Exfiltration packages/core/dist/index.js
Critical Trigger Reachable Dangerous Capability packages/core/dist/index.js
Critical Previous Version Dangerous Delta packages/cli/dist/bin.js
High Child Process packages/core/dist/index.js
High Shell
High Same File Env Network Execution packages/core/dist/index.js
High Credential Redirect Persistence packages/core/dist/index.js
High Command Output Exfiltration packages/core/dist/index.js
High Sandbox Evasion Gated Capability packages/core/src/metrics.ts
High Cross File Remote Execution Context packages/cli/dist/bin.js
High Trigger Reachable Credential Exfiltration
Affected versions and remediation This report applies to tina4-nodejs@3.13.134 .
See all versions of tina4-nodejs for other recorded verdicts.
Review the evidence and your use of tina4-nodejs@3.13.134 before allowing it. Restrict the permissions described in this report. Choose an independently verified alternative or release. This report does not establish that other versions are safe. Evidence last updated: 2026-09-07 09:04:48.722Z (UTC) .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced .
82% Suspicious
AI assessment confidence
Package metadata npm Author Tina4 Team
Maintainers tina4stack
Version 3.13.134
Latest on npm 3.13.157
Published Sep 5, 2026
License MIT
Dependencies 5
Integrity verified
Package size 2.53 MB
Files 354
Keywords tina4 framework web api orm graphql websocket typescript
HighEntropyStrings Minified UrlStrings
Manifest No manifest risk signals triggered.
scanned 179 file(s), 8.85 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.openai.com, app.example.com, cdn.jsdelivr.net, github.com, mcp.tina4.com, profile.tina4.com, raw.githubusercontent.com, registry.npmjs.org, schemas.xmlsoap.org, tina4.com, www.w3.org
packages/core/dist/index.js
20817 // src/portTakeover.ts
L20818: import { execFileSync } from "node:child_process";
L20819: import { existsSync as existsSync9, readFileSync as readFileSync7, writeFileSync as writeFileSync5, mkdirSync as mkdirSync8, unlinkSync as unlinkSync4 } from "node:fs";
High Child Process
Package source references child process execution.
packages/core/dist/index.js View on unpkg · L20817 38348 // src/server.ts
L38349: import { createServer as createServer2 } from "node:http";
L38350: import { randomBytes as randomBytes8 } from "node:crypto";
...
L38354: import { fileURLToPath as fileURLToPath6 } from "node:url";
L38355: import { execFileSync as execFileSync3, exec } from "node:child_process";
L38356: import cluster from "node:cluster";
...
L38361: function shutdownTimeoutSeconds() {
L38362: const raw = process.env.TINA4_SHUTDOWN_TIMEOUT;
L38363: if (raw === void 0 || raw.trim() === "") return DEFAULT_SHUTDOWN_TIMEOUT_SECONDS;
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
packages/core/dist/index.js View on unpkg · L38348 • Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
packages/core/dist/index.js:
const authHeader = req2.headers.authorization ?? "";
const authHeader = headers.authorization ?? headers.Authorization ?? "";
const authHeader = req2.headers.authorization ?? "";
const headersRaw = config?.headers ?? process.env.TINA4_CORS_HEADERS ?? "Content-Type,Authorization,X-Request-ID";
// ../orm/src/databaseUrl.ts
`DatabaseUrl: ${subject}${at} - expected scheme://[user[:password]@]host[:port]/database. The URL itself is not shown because it may contain a password.`
var ENGINE_ALIASES, DEFAULT_PORTS, REDACTED, SECRET_KEYWORD_PATTERN, DatabaseUrl;
var init_databaseUrl = __esm({
High Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
packages/core/dist/index.js View on unpkg 14 function warnEnv(message) {
L15: process.stderr.write(`[tina4] ${message}
L16: `);
...
L19: return value.replace(REFERENCE, (whole, name) => {
L20: const resolved = process.env[name] ?? parsed[name];
L21: if (resolved !== void 0) return resolved;
...
L245: try {
L246: return new TextDecoder("utf-8", { fatal: true }).decode(buf);
L247: } catch {
...
L504: }
L505: const logDir = (isAbsolute(dirCandidate) ? dirCandidate : join2(process.cwd(), dirCandidate)).replace(/\/$/, "");
L506: if (!fileCandidate) return { logDir, logFile: null, layout: "directory" };
High Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
packages/core/dist/index.js View on unpkg · L14 14 Trigger-reachable credential exfiltration chain: manifest.main -> packages/core/dist/index.js
L14: function warnEnv(message) {
L15: process.stderr.write(`[tina4] ${message}
L16: `);
...
L19: return value.replace(REFERENCE, (whole, name) => {
L20: const resolved = process.env[name] ?? parsed[name];
L21: if (resolved !== void 0) return resolved;
...
L245: try {
L246: return new TextDecoder("utf-8", { fatal: true }).decode(buf);
L247: } catch {
...
L504: }
L505: const logDir = (isAbsolute(dirCandidate) ? dirCandidate : join2(process.cwd(), dirCandidate)).replace(/\/$/, "");
L506: if (!fileCandidate) return { logDir, logFile: null, layout: "directory" };
High Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
packages/core/dist/index.js View on unpkg · L14 26122 patternName = generic_password
severity = medium
line = 26122
2932 from: (_tokens, start2, content, context) => {
L2933: this.handleFromImport(content, context);
L2934: return { next: start2 + 1 };
Medium Dynamic Require
Package source references dynamic require/import behavior.
packages/core/dist/index.js View on unpkg · L2932 26125 patternName = generic_password
severity = medium
line = 26125
Medium Secret Pattern
Hardcoded password in packages/core/dist/index.js
packages/core/dist/index.js View on unpkg · L26125 26128 patternName = generic_password
severity = medium
line = 26128
Medium Secret Pattern
Hardcoded password in packages/core/dist/index.js
packages/core/dist/index.js View on unpkg · L26128 14 function warnEnv(message) {
L15: process.stderr.write(`[tina4] ${message}
L16: `);
...
L19: return value.replace(REFERENCE, (whole, name) => {
L20: const resolved = process.env[name] ?? parsed[name];
L21: if (resolved !== void 0) return resolved;
...
L245: try {
L246: return new TextDecoder("utf-8", { fatal: true }).decode(buf);
L247: } catch {
...
L504: }
L505: const logDir = (isAbsolute(dirCandidate) ? dirCandidate : join2(process.cwd(), dirCandidate)).replace(/\/$/, "");
L506: if (!fileCandidate) return { logDir, logFile: null, layout: "directory" };
Low Weak Crypto
Package source references weak cryptographic algorithms.
packages/core/dist/index.js View on unpkg · L14 4 import * as path from "node:path";
L5: import { spawnSync } from "node:child_process";
L6: import { fileURLToPath } from "node:url";
...
L15: }
L16: const INSTALL_HINT = "update the native tina4 CLI: https://tina4.com/cli";
L17: const SUMMARY_KEYS = ["files_analyzed", "total_functions", "avg_complexity", "avg_maintainability"];
...
L40: export function enginePath(): string | null {
L41: const names = process.platform === "win32" ? ["tina4.exe", "tina4"] : ["tina4"];
L42: for (const directory of (process.env.PATH || "").split(path.delimiter)) {
L43: for (const name of names) {
...
L72: if (processResult.status !== 0) {
L73: const detail = (processResult.stderr || processResult.stdout || "").trim().split("\n")[0];
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
packages/core/src/metrics.ts View on unpkg · L4 • matchType = previous_version_dangerous_delta
matchedPackage = tina4-nodejs@3.13.132
matchedIdentity = npm:dGluYTQtbm9kZWpz:3.13.132
similarity = 0.808
summary = stored previous version shares package body but lacks this dangerous source file
Critical Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
packages/cli/dist/bin.js View on unpkg 15 Cross-file remote execution chain: packages/cli/dist/bin.js spawns packages/core/dist/index.js; helper contains network access plus dynamic code execution.
L15: function warnEnv(message) {
L16: process.stderr.write(`[tina4] ${message}
L17: `);
...
L20: return value.replace(REFERENCE, (whole, name) => {
L21: const resolved = process.env[name] ?? parsed[name];
L22: if (resolved !== void 0) return resolved;
...
L246: try {
L247: return new TextDecoder("utf-8", { fatal: true }).decode(buf);
L248: } catch {
...
L505: }
L506: const logDir = (isAbsolute(dirCandidate) ? dirCandidate : join3(process.cwd(), dirCandidate)).replace(/\/$/, "");
L507: if (!fileCandidate) return { logDir, logFile: null, layout: "directory" };
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
packages/cli/dist/bin.js View on unpkg · L15 26143 patternName = generic_password
severity = medium
line = 26143
26146 patternName = generic_password
severity = medium
line = 26146
26149 patternName = generic_password
severity = medium
line = 26149
2722 const { execFileSync } = await import("node:child_process");
L2723: const output = execFileSync("npx", ["tina4nodejs", "generate", kind, name], {
L2724: cwd: resolve(process.cwd()),
High Runtime Package Install
Package source invokes a package manager install command at runtime.
packages/core/src/devAdmin.ts View on unpkg · L2722 packages/cli/src/bin.ts#virtual:normalized:round1 View file • stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 26
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
packages/cli/src/bin.ts#virtual:normalized:round1 View on unpkg packages/cli/src/commands/generate.ts View file 2642 patternName = generic_password
severity = medium
line = 2642
Medium Secret Pattern
Hardcoded password in packages/cli/src/commands/generate.ts
packages/cli/src/commands/generate.ts View on unpkg · L2642 2645 patternName = generic_password
severity = medium
line = 2645
Medium Secret Pattern
Hardcoded password in packages/cli/src/commands/generate.ts
packages/cli/src/commands/generate.ts View on unpkg · L2645 2648 patternName = generic_password
severity = medium
line = 2648
Medium Secret Pattern
Hardcoded password in packages/cli/src/commands/generate.ts
packages/cli/src/commands/generate.ts View on unpkg · L2648 14411 patternName = generic_password
severity = medium
line = 14411
Medium Secret Pattern
Hardcoded password in packages/orm/dist/index.js
packages/orm/dist/index.js View on unpkg · L14411 14414 patternName = generic_password
severity = medium
line = 14414
Medium Secret Pattern
Hardcoded password in packages/orm/dist/index.js
packages/orm/dist/index.js View on unpkg · L14414 14417 patternName = generic_password
severity = medium
line = 14417
Medium Secret Pattern
Hardcoded password in packages/orm/dist/index.js
packages/orm/dist/index.js View on unpkg · L14417 packages/core/dist/index.js
High Runtime Package Install packages/core/src/devAdmin.ts
High Semantic Analysis Limited packages/cli/src/bin.ts#virtual:normalized:round1
Medium Secret Pattern packages/core/dist/index.js
Medium Dynamic Require packages/core/dist/index.js
Medium Structural Risk Force Deep Review
Medium Secret Pattern packages/core/dist/index.js
Medium Secret Pattern packages/core/dist/index.js
Medium Secret Pattern packages/cli/dist/bin.js
Medium Secret Pattern packages/cli/dist/bin.js
Medium Secret Pattern packages/cli/dist/bin.js
Medium Secret Pattern packages/cli/src/commands/generate.ts
Medium Secret Pattern packages/cli/src/commands/generate.ts
Medium Secret Pattern packages/cli/src/commands/generate.ts
Medium Secret Pattern packages/orm/dist/index.js
Medium Secret Pattern packages/orm/dist/index.js
Medium Secret Pattern packages/orm/dist/index.js
Low Non Install Lifecycle Scripts
Low Weak Crypto packages/core/dist/index.js
Runtime surface package.json Entrypoints main → packages/core/dist/index.js types → ./types/core/src/index.d.ts exports map bin → tina4nodejs
Runtime node >=22.0.0
Artifact 10.1 MB · 354 files 1 signature(s)
Install lifecycle prepare prepublishOnly
Behavioral surface ChildProcess Crypto DynamicRequire EnvironmentVars Filesystem Network Shell WebSocket HighEntropyStrings Minified UrlStrings Manifest: clean