registry / tina4-nodejs / 3.13.88
tina4-nodejs@3.13.88
⚠ Under reviewTina4 for Node.js/TypeScript - 54 built-in features, zero dependencies
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 25 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
16 flaggedpackages/cli/dist/bin.jsView file
40146patternName = generic_password
severity = medium
line = 40146
matchedText = const re... });
Medium
Secret Pattern
Package contains a possible secret pattern.
packages/cli/dist/bin.jsView on unpkg · L4014640149patternName = generic_password
severity = medium
line = 40149
matchedText = const du... });
Medium
Secret Pattern
Hardcoded password in packages/cli/dist/bin.js
packages/cli/dist/bin.jsView on unpkg · L4014940152patternName = generic_password
severity = medium
line = 40152
matchedText = const lo... });
Medium
Secret Pattern
Hardcoded password in packages/cli/dist/bin.js
packages/cli/dist/bin.jsView on unpkg · L40152packages/core/dist/index.jsView file
Findings
4 Critical5 High10 Medium6 Low
CriticalCredential Exfiltrationpackages/core/dist/index.js
CriticalCommand Output Exfiltrationpackages/core/dist/index.js
CriticalTrigger Reachable Dangerous Capabilitypackages/core/dist/index.js
CriticalPrevious Version Dangerous Deltapackages/core/src/ai.ts
HighChild Processpackages/core/dist/index.js
HighShell
HighSandbox Evasion Gated Capabilitypackages/core/src/server.ts
HighCross File Remote Execution Contextpackages/core/dist/index.js
HighRuntime Package Installpackages/core/src/devAdmin.ts
MediumSecret Patternpackages/cli/dist/bin.js
MediumDynamic Requirepackages/core/dist/index.js
Affected versions and remediation
This report applies to tina4-nodejs@3.13.88.
See all versions of tina4-nodejs for other recorded verdicts.
- Review the evidence and your use of tina4-nodejs@3.13.88 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.