Loading npm security reports…
tina4-nodejs@3.13.150: Agent extension lifecycle risk – flagged | LPM Firewall
Flagged as agent extension risk
Allowed by default with warning: install-time first-party agent extension setup was detected.
scanned 24d ago · by lpm-firewall-ai The source supports a warning for first-party AI assistant skill setup that writes to a global assistant directory, but does not establish malicious behavior or an install-time attack. The reported credential-exfiltration and encrypted-payload claims were not substantiated by the inspected source excerpts.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs tina4nodejs ai and chooses tools, or supplies --all.
Impact
The installed skills can influence later AI assistant behavior; the inspected code does not establish covert installation or credential exfiltration.
Mechanism
The command fetches skill files from raw.githubusercontent.com under tina4stack and writes them into the project’s .claude/skills and the user’s ~/.claude/skills directories.
AI rationale
The source supports a warning for first-party AI assistant skill setup that writes to a global assistant directory, but does not establish malicious behavior or an install-time attack. The reported credential-exfiltration and encrypted-payload claims were not substantiated by the inspected source excerpts.
Evidence
packages/cli/src/bin.ts packages/core/src/ai.ts .claude/skills ~/.claude/skills
Network endpoints1
raw.githubusercontent.com
public snapshot AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
The manifest’s prepare and prepublishOnly hooks run the build; the inspected CLI exposes AI setup as a separate command. The CLI AI setup prompts for a selection, or installs all context files when explicitly given --all. AI setup fetches skill files from tina4stack on raw.githubusercontent.com and writes them to project and global Claude skill directories. The MCP config writer can modify .claude/settings.json, but the inspected source shows it as a method and does not establish an install-hook caller. The flagged bundle locations concern project context-file candidates; their excerpts do not show credential collection or transmission. Evidence against
The skill installation is activated by the explicit tina4nodejs ai command, not by the package’s install lifecycle hooks. The skill download URL is scoped to the Tina4 GitHub organization; no unrelated credential recipient was established. Behavioral surface
Source ChildProcess Crypto DynamicRequire EnvironmentVars
26 flagged 54 function warnEnv(message) {
L55: process.stderr.write(`[tina4] ${message}
L56: `);
...
L59: return value.replace(REFERENCE, (whole, name) => {
L60: const resolved = process.env[name] ?? parsed[name];
L61: if (resolved !== void 0) return resolved;
...
L250: try {
L251: return new TextDecoder("utf-8", { fatal: true }).decode(buf);
L252: } catch {
...
L509: }
L510: const logDir = (isAbsolute(dirCandidate) ? dirCandidate : join2(process.cwd(), dirCandidate)).replace(/\/$/, "");
L511: if (!fileCandidate) return { logDir, logFile: null, layout: "directory" };
Critical Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
packages/core/dist/index.js View on unpkg · L54 • context = LockMode = 'Exclusive', @LockOwner = 'Session', @LockTimeout = -1`\n );\n return { kind: "mssql" };\n }\n } catch (err) {\n Log.debug(`DB migration lock unavailable (${engine}): ${err instanceof Error ? err.message : err}; using a file lock`);\n }\n return acquireFileLock(dir);\n}\nasync function acquireFileLock(dir) {\n const lockFile = join6(tmpdir(), `tina4-migration-${createHash2("sha256").update(resolve3(dir)).digest("hex")}.lock`);\n const deadline = Date.now() + 6e4;\n for (; ; ) {\n try {\n writeFileSync(lockFile, String(process.pid), { flag: "wx" });\n return { kind: "file", resource: lockFile };\n } catch (err) {\n if (err.code !== "EEXIST") {\n Log.debug(`file migration lock unavailable: ${err instanceof Error ? err.mes
4 Critical 9 High 16 Medium 7 Low
Critical Credential Exfiltration packages/core/dist/index.js
Critical Encrypted Payload Temp Execution packages/core/dist/index.js
Critical Trigger Reachable Dangerous Capability packages/core/dist/index.js
Critical Previous Version Dangerous Delta packages/core/src/server.ts
High Child Process packages/core/dist/index.js
High Shell
High Credential Redirect Persistence packages/core/dist/index.js
High Command Output Exfiltration packages/core/dist/index.js
High Sandbox Evasion Gated Capability packages/core/src/metrics.ts
High Cross File Remote Execution Context packages/cli/dist/bin.js
High Trigger Reachable Credential Exfiltration
Affected versions and remediation This report applies to tina4-nodejs@3.13.150 .
See all versions of tina4-nodejs for other recorded verdicts.
Review the evidence and your use of tina4-nodejs@3.13.150 before allowing it. Restrict the permissions described in this report. Choose an independently verified alternative or release. This report does not establish that other versions are safe. Evidence last updated: 2026-10-11 17:10:38.877Z (UTC) .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced .
78% Suspicious
AI assessment confidence
Package metadata npm Author Tina4 Team
Maintainers tina4stack
Version 3.13.150
Latest on npm 3.13.157
Published Oct 11, 2026
License MPL-2.0
Dependencies 9
Integrity verified
Package size 2.76 MB
Files 401
Keywords tina4 framework web api orm graphql websocket typescript
Filesystem
Network
Shell
WebSocket
Supply chain HighEntropyStrings Minified PossibleObfuscation UrlStrings
scanned 194 file(s), 9.50 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.openai.com, app.example.com, cdn.jsdelivr.net, generativelanguage.googleapis.com, github.com, mcp.tina4.com, profile.tina4.com, raw.githubusercontent.com, registry.npmjs.org, schemas.xmlsoap.org, tina4.com, www.w3.org
Encrypted Payload Temp Execution
Source decrypts an embedded payload, writes it to disk, and executes it through a child process.
packages/core/dist/index.js
54 Trigger-reachable chain: manifest.main -> packages/core/dist/index.js
L54: function warnEnv(message) {
L55: process.stderr.write(`[tina4] ${message}
L56: `);
...
L59: return value.replace(REFERENCE, (whole, name) => {
L60: const resolved = process.env[name] ?? parsed[name];
L61: if (resolved !== void 0) return resolved;
...
L250: try {
L251: return new TextDecoder("utf-8", { fatal: true }).decode(buf);
L252: } catch {
...
L509: }
L510: const logDir = (isAbsolute(dirCandidate) ? dirCandidate : join2(process.cwd(), dirCandidate)).replace(/\/$/, "");
L511: if (!fileCandidate) return { logDir, logFile: null, layout: "directory" };
Critical Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
packages/core/dist/index.js View on unpkg · L54 23150 // src/portTakeover.ts
L23151: import { execFileSync } from "node:child_process";
L23152: import { existsSync as existsSync10, readFileSync as readFileSync7, writeFileSync as writeFileSync6, mkdirSync as mkdirSync9, unlinkSync as unlinkSync4 } from "node:fs";
High Child Process
Package source references child process execution.
packages/core/dist/index.js View on unpkg · L23150 • Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
packages/core/dist/index.js:
const authHeader = req2.headers.authorization ?? "";
const authHeader = headers.authorization ?? headers.Authorization ?? "";
// ../orm/src/databaseUrl.ts
`DatabaseUrl: ${subject}${at} - expected scheme://[user[:password]@]host[:port]/database. The URL itself is not shown because it may contain a password.`
var ENGINE_ALIASES, DEFAULT_PORTS, REDACTED, SECRET_KEYWORD_PATTERN, DatabaseUrl;
var init_databaseUrl = __esm({
"../orm/src/databaseUrl.ts"() {
DatabaseUrl = class _DatabaseUrl {
High Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
packages/core/dist/index.js View on unpkg 54 function warnEnv(message) {
L55: process.stderr.write(`[tina4] ${message}
L56: `);
...
L59: return value.replace(REFERENCE, (whole, name) => {
L60: const resolved = process.env[name] ?? parsed[name];
L61: if (resolved !== void 0) return resolved;
...
L250: try {
L251: return new TextDecoder("utf-8", { fatal: true }).decode(buf);
L252: } catch {
...
L509: }
L510: const logDir = (isAbsolute(dirCandidate) ? dirCandidate : join2(process.cwd(), dirCandidate)).replace(/\/$/, "");
L511: if (!fileCandidate) return { logDir, logFile: null, layout: "directory" };
High Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
packages/core/dist/index.js View on unpkg · L54 54 Trigger-reachable credential exfiltration chain: manifest.main -> packages/core/dist/index.js
L54: function warnEnv(message) {
L55: process.stderr.write(`[tina4] ${message}
L56: `);
...
L59: return value.replace(REFERENCE, (whole, name) => {
L60: const resolved = process.env[name] ?? parsed[name];
L61: if (resolved !== void 0) return resolved;
...
L250: try {
L251: return new TextDecoder("utf-8", { fatal: true }).decode(buf);
L252: } catch {
...
L509: }
L510: const logDir = (isAbsolute(dirCandidate) ? dirCandidate : join2(process.cwd(), dirCandidate)).replace(/\/$/, "");
L511: if (!fileCandidate) return { logDir, logFile: null, layout: "directory" };
High Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
packages/core/dist/index.js View on unpkg · L54 28551 patternName = generic_password
severity = medium
line = 28551
4113 try {
L4114: const req2 = createRequire(import.meta.url);
L4115: pg = req2("pg");
Medium Dynamic Require
Package source references dynamic require/import behavior.
packages/core/dist/index.js View on unpkg · L4113 28554 patternName = generic_password
severity = medium
line = 28554
Medium Secret Pattern
Hardcoded password in packages/core/dist/index.js
packages/core/dist/index.js View on unpkg · L28554 28557 patternName = generic_password
severity = medium
line = 28557
Medium Secret Pattern
Hardcoded password in packages/core/dist/index.js
packages/core/dist/index.js View on unpkg · L28557 54 function warnEnv(message) {
L55: process.stderr.write(`[tina4] ${message}
L56: `);
...
L59: return value.replace(REFERENCE, (whole, name) => {
L60: const resolved = process.env[name] ?? parsed[name];
L61: if (resolved !== void 0) return resolved;
...
L250: try {
L251: return new TextDecoder("utf-8", { fatal: true }).decode(buf);
L252: } catch {
...
L509: }
L510: const logDir = (isAbsolute(dirCandidate) ? dirCandidate : join2(process.cwd(), dirCandidate)).replace(/\/$/, "");
L511: if (!fileCandidate) return { logDir, logFile: null, layout: "directory" };
Low Weak Crypto
Package source references weak cryptographic algorithms.
packages/core/dist/index.js View on unpkg · L54 5 License, v. 2.0. If a copy of the MPL was not distributed with this
L6: file, You can obtain one at https://mozilla.org/MPL/2.0/.
L7: */
...
L12: import * as path from "node:path";
L13: import { spawnSync } from "node:child_process";
L14: import { fileURLToPath } from "node:url";
...
L48: export function enginePath(): string | null {
L49: const names = process.platform === "win32" ? ["tina4.exe", "tina4"] : ["tina4"];
L50: for (const directory of (process.env.PATH || "").split(path.delimiter)) {
L51: for (const name of names) {
...
L84: if (processResult.status !== 0) {
L85: const detail = (processResult.stderr || processResult.stdout || "").trim().split("\n")[0];
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
packages/core/src/metrics.ts View on unpkg · L5 55 Cross-file remote execution chain: packages/cli/dist/bin.js spawns packages/core/dist/index.js; helper contains network access plus dynamic code execution.
L55: function warnEnv(message) {
L56: process.stderr.write(`[tina4] ${message}
L57: `);
...
L60: return value.replace(REFERENCE, (whole, name) => {
L61: const resolved = process.env[name] ?? parsed[name];
L62: if (resolved !== void 0) return resolved;
...
L251: try {
L252: return new TextDecoder("utf-8", { fatal: true }).decode(buf);
L253: } catch {
...
L510: }
L511: const logDir = (isAbsolute(dirCandidate) ? dirCandidate : join3(process.cwd(), dirCandidate)).replace(/\/$/, "");
L512: if (!fileCandidate) return { logDir, logFile: null, layout: "directory" };
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
packages/cli/dist/bin.js View on unpkg · L55 28595 patternName = generic_password
severity = medium
line = 28595
28598 patternName = generic_password
severity = medium
line = 28598
28601 patternName = generic_password
severity = medium
line = 28601
2935 const { execFileSync } = await import("node:child_process");
L2936: const output = execFileSync("npx", ["tina4nodejs", "generate", kind, name], {
L2937: cwd: resolve(process.cwd()),
High Runtime Package Install
Package source invokes a package manager install command at runtime.
packages/core/src/devAdmin.ts View on unpkg · L2935 packages/cli/src/bin.ts#virtual:normalized:round1 View file • stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 25
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
packages/cli/src/bin.ts#virtual:normalized:round1 View on unpkg • matchType = previous_version_dangerous_delta
matchedPackage = tina4-nodejs@3.13.148
matchedIdentity = npm:dGluYTQtbm9kZWpz:3.13.148
similarity = 0.925
summary = stored previous version shares package body but lacks this dangerous source file
Critical Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
packages/core/src/server.ts View on unpkg packages/cli/src/commands/generate.ts View file 2788 patternName = generic_password
severity = medium
line = 2788
Medium Secret Pattern
Hardcoded password in packages/cli/src/commands/generate.ts
packages/cli/src/commands/generate.ts View on unpkg · L2788 2791 patternName = generic_password
severity = medium
line = 2791
Medium Secret Pattern
Hardcoded password in packages/cli/src/commands/generate.ts
packages/cli/src/commands/generate.ts View on unpkg · L2791 2794 patternName = generic_password
severity = medium
line = 2794
Medium Secret Pattern
Hardcoded password in packages/cli/src/commands/generate.ts
packages/cli/src/commands/generate.ts View on unpkg · L2794 15703 patternName = generic_password
severity = medium
line = 15703
Medium Secret Pattern
Hardcoded password in packages/orm/dist/index.js
packages/orm/dist/index.js View on unpkg · L15703 15706 patternName = generic_password
severity = medium
line = 15706
Medium Secret Pattern
Hardcoded password in packages/orm/dist/index.js
packages/orm/dist/index.js View on unpkg · L15706 15709 patternName = generic_password
severity = medium
line = 15709
Medium Secret Pattern
Hardcoded password in packages/orm/dist/index.js
packages/orm/dist/index.js View on unpkg · L15709 packages/core/dist/index.js
High Runtime Package Install packages/core/src/devAdmin.ts
High Semantic Analysis Limited packages/cli/src/bin.ts#virtual:normalized:round1
Medium Secret Pattern packages/core/dist/index.js
Medium Dynamic Require packages/core/dist/index.js
Medium Structural Risk Force Deep Review
Medium Secret Pattern packages/core/dist/index.js
Medium Secret Pattern packages/core/dist/index.js
Medium Secret Pattern packages/cli/dist/bin.js
Medium Secret Pattern packages/cli/dist/bin.js
Medium Secret Pattern packages/cli/dist/bin.js
Medium Secret Pattern packages/cli/src/commands/generate.ts
Medium Secret Pattern packages/cli/src/commands/generate.ts
Medium Secret Pattern packages/cli/src/commands/generate.ts
Medium Secret Pattern packages/orm/dist/index.js
Medium Secret Pattern packages/orm/dist/index.js
Medium Secret Pattern packages/orm/dist/index.js
Low Non Install Lifecycle Scripts
Low Weak Crypto packages/core/dist/index.js
Runtime surface package.json Entrypoints main → packages/core/dist/index.js types → ./types/core/src/index.d.ts exports map bin → tina4nodejs
Runtime node >=22.0.0
Artifact 10.9 MB · 401 files 2 signature(s) · provenance
Install lifecycle prepare prepublishOnly
Behavioral surface ChildProcess Crypto DynamicRequire EnvironmentVars Filesystem Network Shell WebSocket HighEntropyStrings Minified PossibleObfuscation UrlStrings CopyleftLicense