registry / tina4-nodejs / 3.13.151
tina4-nodejs@3.13.151
Tina4 for Node.js/TypeScript - native TypeScript conventions and shared Tina4 contracts
AI Security Review
scanned 20d ago · by lpm-firewall-aiThe agent setup has a real user-level configuration effect, so it warrants a capability warning under the first-party extension setup policy. The inspected lifecycle hooks only run build commands, and the flagged bundle excerpts do not establish credential theft or payload execution.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs the assistant setup command and selects tools, or explicitly chooses the all option.
Impact
The installed skills can influence assistant context in later work; the configuration changes follow explicit setup.
Mechanism
The setup fetches Tina4 skill files and writes them to project and user-level directories. A separate MCP configuration method writes a localhost server entry to project settings.
AI rationale
The agent setup has a real user-level configuration effect, so it warrants a capability warning under the first-party extension setup policy. The inspected lifecycle hooks only run build commands, and the flagged bundle excerpts do not establish credential theft or payload execution.
Evidence
packages/core/src/ai.tspackages/cli/src/bin.tspackages/core/src/mcp.ts.claude/skills.claude/settings.json
Network endpoints2
raw.githubusercontent.com/tina4stacklocalhost:${port}${this.path}
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package lifecycle hooks run build commands, and its main entry points target the core bundle.
- The reviewed bundle locations list project documentation files as candidates; they do not show agent configuration writes.
- The assistant setup can fetch Tina4 skills and write them to project and global Claude skill directories, but it is reached through the explicit command and prompts for a selection unless the user passes the all option.
- The MCP configuration writer stores a localhost server entry in the project’s Claude settings file.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
26 flaggedpackages/core/dist/index.jsView file
18let end = s.length;
L19: while (end > 0 && s.charCodeAt(end - 1) === SLASH) end--;
L20: return end === s.length ? s : s.slice(0, end);
...
L78: function warnEnv(message) {
L79: process.stderr.write(`[tina4] ${message}
L80: `);
...
L83: return value.replace(REFERENCE, (whole, name) => {
L84: const resolved = process.env[name] ?? parsed[name];
L85: if (resolved !== void 0) return resolved;
...
L533: }
L534: const logDir = (isAbsolute(dirCandidate) ? dirCandidate : join2(process.cwd(), dirCandidate)).replace(/\/$/, "");
L535: if (!fileCandidate) return { logDir, logFile: null, layout: "directory" };
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
packages/core/dist/index.jsView on unpkg · L18•context = LockMode = 'Exclusive', @LockOwner = 'Session', @LockTimeout = -1`\n );\n return { kind: "mssql" };\n }\n } catch (err) {\n Log.debug(`DB migration lock unavailable (${engine}): ${err instanceof Error ? err.message : err}; using a file lock`);\n }\n return acquireFileLock(dir);\n}\nasync function acquireFileLock(dir) {\n const lockFile = join6(tmpdir(), `tina4-migration-${createHash2("sha256").update(resolve3(dir)).digest("hex")}.lock`);\n const deadline = Date.now() + 6e4;\n for (; ; ) {\n try {\n writeFileSync(lockFile, String(process.pid), { flag: "wx" });\n return { kind: "file", resource: lockFile };\n } catch (err) {\n if (err.code !== "EEXIST") {\n Log.debug(`file migration lock unavailable: ${err instanceof Error ? err.mes
Critical
Findings
4 Critical9 High16 Medium7 Low
CriticalCredential Exfiltrationpackages/core/dist/index.js
CriticalEncrypted Payload Temp Executionpackages/core/dist/index.js
CriticalTrigger Reachable Dangerous Capabilitypackages/core/dist/index.js
CriticalPrevious Version Dangerous Deltapackages/cli/dist/bin.js
HighChild Processpackages/core/dist/index.js
HighShell
HighCredential Redirect Persistencepackages/core/dist/index.js
HighCommand Output Exfiltrationpackages/core/dist/index.js
HighSandbox Evasion Gated Capabilitypackages/core/src/metrics.ts
HighCross File Remote Execution Contextpackages/cli/dist/bin.js
HighTrigger Reachable Credential Exfiltration
Affected versions and remediation
This report applies to tina4-nodejs@3.13.151.
See all versions of tina4-nodejs for other recorded verdicts.
- Review the evidence and your use of tina4-nodejs@3.13.151 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.