tina4-nodejs@3.13.138
Tina4 for Node.js/TypeScript - native TypeScript conventions and shared Tina4 contracts
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe AI installer is an explicit CLI that downloads first-party skill files into Claude skill directories, including the user home directory, so it is a guarded agent-config capability rather than install-time hijacking. No registry lifecycle hook, hidden recipient, or automatic execution of those files was found.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs the tina4nodejs ai command, including with --all, or a caller invokes installSelected or installSkills.
Impact
Selected coding-assistant instruction files change on disk, including the user-global Claude skills folder. Install does not perform this write. Remote MCP use still depends on explicit environment flags.
Mechanism
The command selects AI tools, then a child node process fetches versioned raw.githubusercontent.com skill files and writes them under .claude/skills in the project and in the user home directory.
AI rationale
The AI installer is an explicit CLI that downloads first-party skill files into Claude skill directories, including the user home directory, so it is a guarded agent-config capability rather than install-time hijacking. No registry lifecycle hook, hidden recipient, or automatic execution of those files was found.
Evidence
packages/cli/src/bin.tspackages/core/src/ai.tspackages/core/src/mcp.ts.claude/skills~/.claude/skills
Network endpoints1
raw.githubusercontent.com/tina4stack/
Decision evidence
public snapshotAI called this Suspicious at 74.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The published bin command ai calls installAiContext, which runs a menu or installAll when the user passes --all.
- installSkills writes fetched skill files into the project .claude/skills directory and the user home .claude/skills directory.
- Skill URLs are built on raw.githubusercontent.com under the tina4stack organization, using the installed version or TINA4_SKILLS_REF.
- A child node process started with execFileSync fetches those URLs and writes the response bodies to disk.
- package.json scripts are build, test, prepare, and prepublishOnly only; there is no preinstall, install, or postinstall hook.
- MCP dev tools are off unless TINA4_MCP or TINA4_DEBUG enables them, and remote callers still need an extra opt-in plus a token.
Evidence against
- Nothing runs the agent-file installer on import or during npm install.
- writeClaudeConfig is defined but has no caller in this package.
- Fetched skill bodies are written as files; the installer does not eval them.
- Loopback MCP access is the default; remote MCP requires TINA4_MCP_REMOTE and a matching token.
Behavioral surface
Source & flagged code
25 flaggedpackages/core/dist/index.jsView file
54function warnEnv(message) {
L55: process.stderr.write(`[tina4] ${message}
L56: `);
...
L59: return value.replace(REFERENCE, (whole, name) => {
L60: const resolved = process.env[name] ?? parsed[name];
L61: if (resolved !== void 0) return resolved;
...
L250: try {
L251: return new TextDecoder("utf-8", { fatal: true }).decode(buf);
L252: } catch {
...
L509: }
L510: const logDir = (isAbsolute(dirCandidate) ? dirCandidate : join2(process.cwd(), dirCandidate)).replace(/\/$/, "");
L511: if (!fileCandidate) return { logDir, logFile: null, layout: "directory" };
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
packages/core/dist/index.jsView on unpkg · L5454Trigger-reachable chain: manifest.main -> packages/core/dist/index.js
L54: function warnEnv(message) {
L55: process.stderr.write(`[tina4] ${message}
L56: `);
...
L59: return value.replace(REFERENCE, (whole, name) => {
L60: const resolved = process.env[name] ?? parsed[name];
L61: if (resolved !== void 0) return resolved;
...
L250: try {
L251: return new TextDecoder("utf-8", { fatal: true }).decode(buf);
L252: } catch {
...
L509: }
L510: const logDir = (isAbsolute(dirCandidate) ? dirCandidate : join2(process.cwd(), dirCandidate)).replace(/\/$/, "");
L511: if (!fileCandidate) return { logDir, logFile: null, layout: "directory" };
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
Findings
3 Critical9 High16 Medium7 Low
CriticalCredential Exfiltrationpackages/core/dist/index.js
CriticalTrigger Reachable Dangerous Capabilitypackages/core/dist/index.js
CriticalPrevious Version Dangerous Deltapackages/cli/dist/bin.js
HighChild Processpackages/core/dist/index.js
HighShell
HighCredential Redirect Persistencepackages/core/dist/index.js
HighCommand Output Exfiltrationpackages/core/dist/index.js
HighSandbox Evasion Gated Capabilitypackages/core/src/metrics.ts
HighCross File Remote Execution Contextpackages/cli/dist/bin.js
HighTrigger Reachable Credential Exfiltrationpackages/core/dist/index.js
HighRuntime Package Installpackages/core/src/devAdmin.ts
Affected versions and remediation
This report applies to tina4-nodejs@3.13.138.
See all versions of tina4-nodejs for other recorded verdicts.
- Review the evidence and your use of tina4-nodejs@3.13.138 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.