Tina4 for Node.js/TypeScript - native TypeScript conventions and shared Tina4 contracts
AI Security Review
scanned 2d ago · by lpm-firewall-ai
The package includes a reviewer-directed instruction to warn rather than block when reviewing work that departs from its rules. This is explicit reviewer manipulation, which is evidence of malicious intent even though the inspected credential and lifecycle leads did not establish a separate attack chain.
Could bias a security review toward a non-blocking verdict.
Mechanism
The file directs reviewers to warn rather than block when reviewed work departs from its prescribed rules.
Attack narrative
The shipped CLAUDE.md addresses work being reviewed and instructs reviewers to warn, “do not block,” creating a direct attempt to steer the security verdict.
AI rationale
The package includes a reviewer-directed instruction to warn rather than block when reviewing work that departs from its rules. This is explicit reviewer manipulation, which is evidence of malicious intent even though the inspected credential and lifecycle leads did not establish a separate attack chain.
Evidence
CLAUDE.md
Decision evidence
public snapshot
AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
CLAUDE.md tells a reviewer to warn and “do not block” when reviewing work that departs from its preferred rules.
package.json includes CLAUDE.md in the package files.
Evidence against
The package lifecycle scripts shown run build commands; no install-time data transmission was identified.
The inspected AI configuration uses provider-specific endpoints and a key explicitly configured for that provider; no credential exfiltration was confirmed in the reviewed excerpts.
The CLI dispatches commands only when run as the entry point, not when imported.
Avoid installing tina4-nodejs@3.13.157. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
23690// src/portTakeover.ts
L23691: import { execFileSync } from "node:child_process";
L23692: import { existsSync as existsSync10, readFileSync as readFileSync7, writeFileSync as writeFileSync6, mkdirSync as mkdirSync9, unlinkSync as unlinkSync5 } from "node:fs";
High
Child Process
Package source references child process execution.
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
packages/core/dist/index.js:
const authHeader = req2.headers.authorization ?? "";
const authHeader = headers.authorization ?? headers.Authorization ?? "";
// ../orm/src/databaseUrl.ts
`DatabaseUrl: ${subject}${at} - expected scheme://[user[:password]@]host[:port]/database. The URL itself is not shown because it may contain a password.`
var ENGINE_ALIASES, DEFAULT_PORTS, REDACTED, SECRET_KEYWORD_PATTERN, DatabaseUrl;
var init_databaseUrl = __esm({
"../orm/src/databaseUrl.ts"() {
DatabaseUrl = class _DatabaseUrl {
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
5License, v. 2.0. If a copy of the MPL was not distributed with this
L6: file, You can obtain one at https://mozilla.org/MPL/2.0/.
L7: */
...
L12: import * as path from "node:path";
L13: import { spawnSync } from "node:child_process";
L14: import { fileURLToPath } from "node:url";
...
L48: export function enginePath(): string | null {
L49: const names = process.platform === "win32" ? ["tina4.exe", "tina4"] : ["tina4"];
L50: for (const directory of (process.env.PATH || "").split(path.delimiter)) {
L51: for (const name of names) {
...
L84: if (processResult.status !== 0) {
L85: const detail = (processResult.stderr || processResult.stdout || "").trim().split("\n")[0];
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.