registry / tina4-nodejs / 3.13.61
tina4-nodejs@3.13.61
⚠ Under reviewTina4 for Node.js/TypeScript - 54 built-in features, zero dependencies
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
9 flaggedpackages/core/public/js/tina4-dev-admin.min.jsView file
402`);for(;l>=0;){const O=r.slice(0,l).replace(/\r$/,"");if(r=r.slice(l+1),O!==""){if(O.startsWith("event:"))s=O.slice(6).trim();else if(O.startsWith("data:")){const c=O.slice(5).trim...
L403: `)}}}finally{t.releaseLock()}}async function Zb(i){try{return(await i.text()).slice(0,200)}catch{return""}}async function zb(i){const e=await fetch(`${Xn}/supervise/diff?id=${encod...
L404: `&&(t="");else{let n=t.indexOf(`
High
Child Process
Package source references child process execution.
packages/core/public/js/tina4-dev-admin.min.jsView on unpkg · L402395`,r=i.state.doc.line(r.number+(t?1:-1)),s=i.bidiSpans(r),O=i.visualLineSide(r,!t)}if(l){if(!l(c))return a}else{if(!n)return O;l=n(c)}a=O}}function DS(i,e,t){let n=i.state.charCateg...
L396: `&&i.lineWrapping&&(n&&(n=S.single(n.main.anchor-1,n.main.head-1)),t={from:s.from,to:s.to,insert:ne.of([" "])}),t)return wl(i,t,n,o);if(n&&!Es(n,s)){let a=!1,l="select";return i.in...
L397: `))};if((V.mac||V.android)&&d.from==o-1&&/^\. ?$/.test(n.text)&&e.contentDOM.getAttribute("autocorrect")=="off"&&(d={from:a,to:l,insert:ne.of([n.text.replace("."," ")])}),this.pend...
...
L402: `);for(;l>=0;){const O=r.slice(0,l).replace(/\r$/,"");if(r=r.slice(l+1),O!==""){if(O.startsWith("event:"))s=O.slice(6).trim();else if(O.startsWith("data:")){const c=O.slice(5).trim...
L403: `)}}}finally{t.releaseLock()}}
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
Findings
1 Critical7 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltapackages/core/src/ai.ts
HighChild Processpackages/core/public/js/tina4-dev-admin.min.js
HighShell
HighSame File Env Network Executionpackages/core/public/js/tina4-dev-admin.min.js
HighCommand Output Exfiltrationpackages/core/src/ai.ts
HighSandbox Evasion Gated Capabilitypackages/core/src/server.ts
HighCross File Remote Execution Contextpackages/core/src/ai.ts
HighRuntime Package Installpackages/core/src/devAdmin.ts
MediumDynamic Requirepackages/core/src/fakeData.ts
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to tina4-nodejs@3.13.61.
See all versions of tina4-nodejs for other recorded verdicts.
- Review the evidence and your use of tina4-nodejs@3.13.61 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.