registry / tina4-nodejs / 3.13.153
tina4-nodejs@3.13.153
Tina4 for Node.js/TypeScript - native TypeScript conventions and shared Tina4 contracts
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe inspected source supports normal framework and AI integration behavior, with build-only lifecycle hooks and no runtime self-dependency. Scanner claims of credential redirection and payload execution were not established by the source reviewed.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
AI requests occur when application code uses the configured client; context installation is selected through the CLI menu.
Impact
No unauthorized credential transfer, payload execution, or automatic agent configuration change was established.
Mechanism
The client sends its configured key to the selected AI endpoint. The MCP helper writes a local settings entry pointing to localhost.
AI rationale
The inspected source supports normal framework and AI integration behavior, with build-only lifecycle hooks and no runtime self-dependency. Scanner claims of credential redirection and payload execution were not established by the source reviewed.
Evidence
.claude/settings.jsonCLAUDE.mdAGENTS.md
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json points to the framework entrypoints; its prepare and prepublishOnly hooks run builds, and its dependencies do not include a runtime dependency on itself.
- The bundled AI client reads a configured provider and key, uses provider-specific defaults, and sends authentication to its configured AI endpoint; no unrelated credential recipient was identified.
- The AI context installer presents a selection menu before installing context files, and the supported destinations are named in source.
- The MCP helper writes a project Claude settings file with a localhost server URL.
- The reviewed runtime and ORM sources cover framework features such as database adapters, routing, sessions, queues, and development tools; the inspected excerpts did not establish an attack.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
25 flaggedpackages/core/dist/index.jsView file
18let end = s.length;
L19: while (end > 0 && s.charCodeAt(end - 1) === SLASH) end--;
L20: return end === s.length ? s : s.slice(0, end);
...
L78: function warnEnv(message) {
L79: process.stderr.write(`[tina4] ${message}
L80: `);
...
L83: return value.replace(REFERENCE, (whole, name) => {
L84: const resolved = process.env[name] ?? parsed[name];
L85: if (resolved !== void 0) return resolved;
...
L533: }
L534: const logDir = (isAbsolute(dirCandidate) ? dirCandidate : join2(process.cwd(), dirCandidate)).replace(/\/$/, "");
L535: if (!fileCandidate) return { logDir, logFile: null, layout: "directory" };
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
packages/core/dist/index.jsView on unpkg · L18•context = LockMode = 'Exclusive', @LockOwner = 'Session', @LockTimeout = -1`\n );\n return { kind: "mssql" };\n }\n } catch (err) {\n Log.debug(`DB migration lock unavailable (${engine}): ${err instanceof Error ? err.message : err}; using a file lock`);\n }\n return acquireFileLock(dir);\n}\nasync function acquireFileLock(dir) {\n const lockFile = join6(tmpdir(), `tina4-migration-${createHash2("sha256").update(resolve3(dir)).digest("hex")}.lock`);\n const deadline = Date.now() + 6e4;\n for (; ; ) {\n try {\n writeFileSync(lockFile, String(process.pid), { flag: "wx" });\n return { kind: "file", resource: lockFile };\n } catch (err) {\n if (err.code !== "EEXIST") {\n Log.debug(`file migration lock unavailable: ${err instanceof Error ? err.mes
Critical
Findings
3 Critical9 High16 Medium7 Low
CriticalCredential Exfiltrationpackages/core/dist/index.js
CriticalEncrypted Payload Temp Executionpackages/core/dist/index.js
CriticalTrigger Reachable Dangerous Capabilitypackages/core/dist/index.js
HighChild Processpackages/core/dist/index.js
HighShell
HighCredential Redirect Persistencepackages/core/dist/index.js
HighCommand Output Exfiltrationpackages/core/dist/index.js
HighSandbox Evasion Gated Capabilitypackages/core/src/metrics.ts
HighCross File Remote Execution Contextpackages/cli/dist/bin.js
HighTrigger Reachable Credential Exfiltrationpackages/core/dist/index.js
HighRuntime Package Install
Affected versions and remediation
This report applies to tina4-nodejs@3.13.153.
See all versions of tina4-nodejs for other recorded verdicts.
- Review the evidence and your use of tina4-nodejs@3.13.153 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.