tina4-nodejs@3.13.57
Tina4 for Node.js/TypeScript - 54 built-in features, zero dependencies
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection found a concrete debug-only credential-disclosure vulnerability, not malicious install-time behavior or covert exfiltration. The package should be warned rather than blocked.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Run the framework with `TINA4_DEBUG=true` on a reachable interface, then request `/__dev/api/file?path=.env`.
Impact
Remote disclosure of project files and credentials in an exposed debug deployment.
Mechanism
Debug dashboard exposes path-contained file reads without authentication.
AI rationale
Source inspection found a concrete debug-only credential-disclosure vulnerability, not malicious install-time behavior or covert exfiltration. The package should be warned rather than blocked.
Evidence
package.jsonpackages/core/src/devAdmin.tspackages/core/src/server.tspackages/core/src/router.tspackages/core/src/mcp.tspackages/core/src/docsAutoDiscovery.ts
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for warning
- `packages/core/src/devAdmin.ts` enables `/__dev` when `TINA4_DEBUG` is true.
- Unauthenticated GET `/__dev/api/file` reads any file under `process.cwd()`, including `.env`.
- Default server host is `0.0.0.0`, so a debug deployment can be remotely reachable.
- `packages/core/src/docsAutoDiscovery.ts` writes a project-local MCP discovery file at debug startup.
Evidence against
- `package.json` has no preinstall/install/postinstall hooks.
- Write/delete dev routes receive the router's secure-by-default protection.
- MCP calls check loopback or explicit remote-enable plus token.
- Observed registry requests are package/version lookup and search functionality.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinified
Source & flagged code
7 flaggedpackages/core/public/js/tina4-dev-admin.min.jsView file
402`);for(;l>=0;){const O=r.slice(0,l).replace(/\r$/,"");if(r=r.slice(l+1),O!==""){if(O.startsWith("event:"))s=O.slice(6).trim();else if(O.startsWith("data:")){const c=O.slice(5).trim...
L403: `)}}}finally{t.releaseLock()}}async function Zb(i){try{return(await i.text()).slice(0,200)}catch{return""}}async function zb(i){const e=await fetch(`${Xn}/supervise/diff?id=${encod...
L404: `&&(t="");else{let n=t.indexOf(`
High
Child Process
Package source references child process execution.
packages/core/public/js/tina4-dev-admin.min.jsView on unpkg · L402395`,r=i.state.doc.line(r.number+(t?1:-1)),s=i.bidiSpans(r),O=i.visualLineSide(r,!t)}if(l){if(!l(c))return a}else{if(!n)return O;l=n(c)}a=O}}function DS(i,e,t){let n=i.state.charCateg...
L396: `&&i.lineWrapping&&(n&&(n=S.single(n.main.anchor-1,n.main.head-1)),t={from:s.from,to:s.to,insert:ne.of([" "])}),t)return wl(i,t,n,o);if(n&&!Es(n,s)){let a=!1,l="select";return i.in...
L397: `))};if((V.mac||V.android)&&d.from==o-1&&/^\. ?$/.test(n.text)&&e.contentDOM.getAttribute("autocorrect")=="off"&&(d={from:a,to:l,insert:ne.of([n.text.replace("."," ")])}),this.pend...
...
L402: `);for(;l>=0;){const O=r.slice(0,l).replace(/\r$/,"");if(r=r.slice(l+1),O!==""){if(O.startsWith("event:"))s=O.slice(6).trim();else if(O.startsWith("data:")){const c=O.slice(5).trim...
L403: `)}}}finally{t.releaseLock()}}
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
Findings
1 Critical5 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltapackages/core/src/server.ts
HighChild Processpackages/core/public/js/tina4-dev-admin.min.js
HighShell
HighSame File Env Network Executionpackages/core/public/js/tina4-dev-admin.min.js
HighSandbox Evasion Gated Capabilitypackages/core/src/server.ts
HighRuntime Package Installpackages/core/src/devAdmin.ts
MediumDynamic Requirepackages/core/src/fakeData.ts
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptopackages/core/src/websocket.ts
LowFilesystem
Affected versions and remediation
This report applies to tina4-nodejs@3.13.57.
See all versions of tina4-nodejs for other recorded verdicts.
- Review the evidence and your use of tina4-nodejs@3.13.57 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.