tina4-nodejs@3.13.144
Tina4 for Node.js/TypeScript - native TypeScript conventions and shared Tina4 contracts
AI Security Review
scanned 1mo ago · by lpm-firewall-aiSource supports an explicit-user-command agent configuration capability, which warrants a warning under the supplied policy. It does not substantiate the scanner's malicious credential-exfiltration verdict.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Running the CLI AI setup and selecting tools, or supplying --all.
Impact
Installed instructions can influence agents across projects through global Claude skills. No covert execution or credential theft was established.
Mechanism
The installer merges agent context and downloads Tina4 skill files into project and home-directory destinations.
AI rationale
Source supports an explicit-user-command agent configuration capability, which warrants a warning under the supplied policy. It does not substantiate the scanner's malicious credential-exfiltration verdict.
Evidence
packages/cli/dist/bin.jspackages/core/src/ai.ts.claude/skillsCLAUDE.mdAGENTS.md
Network endpoints1
raw.githubusercontent.com
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI AI setup requires a menu selection or --all before installing agent context.
- AI setup writes skills into both project and global Claude skill directories.
- Skills are downloaded from Tina4 GitHub repositories and written to the selected destinations; setup also merges project agent instructions.
- The manifest contains build-oriented prepare and prepublishOnly hooks, with no preinstall, install, or postinstall hook.
Evidence against
- The inspected agent documentation lookup locations read project documentation rather than changing agent configuration.
- No concrete covert credential export or automatic install-time agent hijack was established.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
25 flaggedpackages/core/dist/index.jsView file
54function warnEnv(message) {
L55: process.stderr.write(`[tina4] ${message}
L56: `);
...
L59: return value.replace(REFERENCE, (whole, name) => {
L60: const resolved = process.env[name] ?? parsed[name];
L61: if (resolved !== void 0) return resolved;
...
L250: try {
L251: return new TextDecoder("utf-8", { fatal: true }).decode(buf);
L252: } catch {
...
L509: }
L510: const logDir = (isAbsolute(dirCandidate) ? dirCandidate : join2(process.cwd(), dirCandidate)).replace(/\/$/, "");
L511: if (!fileCandidate) return { logDir, logFile: null, layout: "directory" };
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
packages/core/dist/index.jsView on unpkg · L5454Trigger-reachable chain: manifest.main -> packages/core/dist/index.js
L54: function warnEnv(message) {
L55: process.stderr.write(`[tina4] ${message}
L56: `);
...
L59: return value.replace(REFERENCE, (whole, name) => {
L60: const resolved = process.env[name] ?? parsed[name];
L61: if (resolved !== void 0) return resolved;
...
L250: try {
L251: return new TextDecoder("utf-8", { fatal: true }).decode(buf);
L252: } catch {
...
L509: }
L510: const logDir = (isAbsolute(dirCandidate) ? dirCandidate : join2(process.cwd(), dirCandidate)).replace(/\/$/, "");
L511: if (!fileCandidate) return { logDir, logFile: null, layout: "directory" };
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
Findings
3 Critical9 High16 Medium7 Low
CriticalCredential Exfiltrationpackages/core/dist/index.js
CriticalTrigger Reachable Dangerous Capabilitypackages/core/dist/index.js
CriticalPrevious Version Dangerous Deltapackages/core/src/server.ts
HighChild Processpackages/core/dist/index.js
HighShell
HighCredential Redirect Persistencepackages/core/dist/index.js
HighCommand Output Exfiltrationpackages/core/dist/index.js
HighSandbox Evasion Gated Capabilitypackages/core/src/metrics.ts
HighCross File Remote Execution Contextpackages/cli/dist/bin.js
HighTrigger Reachable Credential Exfiltrationpackages/core/dist/index.js
HighRuntime Package Install
Affected versions and remediation
This report applies to tina4-nodejs@3.13.144.
See all versions of tina4-nodejs for other recorded verdicts.
- Review the evidence and your use of tina4-nodejs@3.13.144 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.