tina4-nodejs@3.13.136
Tina4 for Node.js/TypeScript - native TypeScript conventions and shared Tina4 contracts
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is an explicit-user-command agent configuration mutation with a global scope, so it warrants a warning. Source inspection found no automatic install hook, hidden persistence, or confirmed credential theft.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The user runs the Tina4 AI context command and selects Claude Code, or invokes it with --all.
Impact
Remote repository content can influence Claude Code behavior in other projects through the global skills directory.
Mechanism
Downloads remote skill files and writes them to project and global Claude skill directories.
AI rationale
This is an explicit-user-command agent configuration mutation with a global scope, so it warrants a warning. Source inspection found no automatic install hook, hidden persistence, or confirmed credential theft.
Evidence
packages/core/src/ai.tspackages/cli/src/bin.ts.claude/skills~/.claude/skillsAGENTS.mdCLAUDE.md
Network endpoints1
raw.githubusercontent.com
Decision evidence
public snapshotAI called this Suspicious at 85.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The explicit AI setup command can install remote skill files into the user's global Claude skills directory.
- Skill content is fetched from GitHub and written to each configured destination.
- The CLI exposes both an interactive setup flow and a non-interactive --all flow.
Evidence against
- No preinstall, install, or postinstall hook is present; prepare only builds the package.
- The global agent configuration write is reached through an explicit CLI command, not package installation or import.
- AI credentials default to the official OpenAI and Anthropic endpoints; no fixed unofficial credential gateway was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
26 flaggedpackages/core/dist/index.jsView file
14function warnEnv(message) {
L15: process.stderr.write(`[tina4] ${message}
L16: `);
...
L19: return value.replace(REFERENCE, (whole, name) => {
L20: const resolved = process.env[name] ?? parsed[name];
L21: if (resolved !== void 0) return resolved;
...
L245: try {
L246: return new TextDecoder("utf-8", { fatal: true }).decode(buf);
L247: } catch {
...
L504: }
L505: const logDir = (isAbsolute(dirCandidate) ? dirCandidate : join2(process.cwd(), dirCandidate)).replace(/\/$/, "");
L506: if (!fileCandidate) return { logDir, logFile: null, layout: "directory" };
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
packages/core/dist/index.jsView on unpkg · L1414Trigger-reachable chain: manifest.main -> packages/core/dist/index.js
L14: function warnEnv(message) {
L15: process.stderr.write(`[tina4] ${message}
L16: `);
...
L19: return value.replace(REFERENCE, (whole, name) => {
L20: const resolved = process.env[name] ?? parsed[name];
L21: if (resolved !== void 0) return resolved;
...
L245: try {
L246: return new TextDecoder("utf-8", { fatal: true }).decode(buf);
L247: } catch {
...
L504: }
L505: const logDir = (isAbsolute(dirCandidate) ? dirCandidate : join2(process.cwd(), dirCandidate)).replace(/\/$/, "");
L506: if (!fileCandidate) return { logDir, logFile: null, layout: "directory" };
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
Findings
3 Critical10 High16 Medium6 Low
CriticalCredential Exfiltrationpackages/core/dist/index.js
CriticalTrigger Reachable Dangerous Capabilitypackages/core/dist/index.js
CriticalPrevious Version Dangerous Deltapackages/cli/dist/bin.js
HighChild Processpackages/core/dist/index.js
HighShell
HighSame File Env Network Executionpackages/core/dist/index.js
HighCredential Redirect Persistencepackages/core/dist/index.js
HighCommand Output Exfiltrationpackages/core/dist/index.js
HighSandbox Evasion Gated Capabilitypackages/core/src/metrics.ts
HighCross File Remote Execution Contextpackages/cli/dist/bin.js
HighTrigger Reachable Credential Exfiltration
Affected versions and remediation
This report applies to tina4-nodejs@3.13.136.
See all versions of tina4-nodejs for other recorded verdicts.
- Review the evidence and your use of tina4-nodejs@3.13.136 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.