tina4-nodejs@3.13.140
Tina4 for Node.js/TypeScript - native TypeScript conventions and shared Tina4 contracts
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe source shows a concrete, user-invoked global AI-agent configuration capability with remote content installation. It does not show unconsented install-time execution, credential theft, or a confirmed active attack.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The user runs the AI CLI command and selects Claude or all tools.
Impact
Later Claude sessions may load the installed remote skill content.
Mechanism
The installer constructs raw GitHub skill URLs and writes downloaded files to project and global Claude skill directories.
AI rationale
The source shows a concrete, user-invoked global AI-agent configuration capability with remote content installation. It does not show unconsented install-time execution, credential theft, or a confirmed active attack.
Evidence
packages/core/src/ai.tspackages/cli/src/bin.ts.claude/skills~/.claude/skills
Network endpoints1
raw.githubusercontent.com/tina4stack/
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The explicit AI CLI command invokes the installer.
- The installer downloads skill content and writes it to both project and global Claude skill directories.
- The remote skill source is constructed from a release reference, including an environment override.
Evidence against
- Package scripts contain build and publish preparation only; no install lifecycle hook was found.
- The AI installer is reached through an explicit CLI command and selection flow.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
CopyleftLicense
Source & flagged code
25 flaggedpackages/core/dist/index.jsView file
54function warnEnv(message) {
L55: process.stderr.write(`[tina4] ${message}
L56: `);
...
L59: return value.replace(REFERENCE, (whole, name) => {
L60: const resolved = process.env[name] ?? parsed[name];
L61: if (resolved !== void 0) return resolved;
...
L250: try {
L251: return new TextDecoder("utf-8", { fatal: true }).decode(buf);
L252: } catch {
...
L509: }
L510: const logDir = (isAbsolute(dirCandidate) ? dirCandidate : join2(process.cwd(), dirCandidate)).replace(/\/$/, "");
L511: if (!fileCandidate) return { logDir, logFile: null, layout: "directory" };
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
packages/core/dist/index.jsView on unpkg · L5454Trigger-reachable chain: manifest.main -> packages/core/dist/index.js
L54: function warnEnv(message) {
L55: process.stderr.write(`[tina4] ${message}
L56: `);
...
L59: return value.replace(REFERENCE, (whole, name) => {
L60: const resolved = process.env[name] ?? parsed[name];
L61: if (resolved !== void 0) return resolved;
...
L250: try {
L251: return new TextDecoder("utf-8", { fatal: true }).decode(buf);
L252: } catch {
...
L509: }
L510: const logDir = (isAbsolute(dirCandidate) ? dirCandidate : join2(process.cwd(), dirCandidate)).replace(/\/$/, "");
L511: if (!fileCandidate) return { logDir, logFile: null, layout: "directory" };
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
Findings
3 Critical9 High16 Medium7 Low
CriticalCredential Exfiltrationpackages/core/dist/index.js
CriticalTrigger Reachable Dangerous Capabilitypackages/core/dist/index.js
CriticalPrevious Version Dangerous Deltapackages/cli/src/commands/generate.ts
HighChild Processpackages/core/dist/index.js
HighShell
HighCredential Redirect Persistencepackages/core/dist/index.js
HighCommand Output Exfiltrationpackages/core/dist/index.js
HighSandbox Evasion Gated Capabilitypackages/core/src/metrics.ts
HighCross File Remote Execution Contextpackages/cli/dist/bin.js
HighTrigger Reachable Credential Exfiltrationpackages/core/dist/index.js
HighRuntime Package Install
Affected versions and remediation
This report applies to tina4-nodejs@3.13.140.
See all versions of tina4-nodejs for other recorded verdicts.
- Review the evidence and your use of tina4-nodejs@3.13.140 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.