tina4-nodejs@3.13.97
Tina4 for Node.js/TypeScript - 54 built-in features, zero dependencies
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe scanner’s claimed credential and command-output exfiltration was not confirmed in inspected source. The confirmed explicit AI-agent mutation and remotely fetched instruction capability warrants a warning, not a malicious block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User runs tina4nodejs ai (including --all), or directly invokes its exported installer functions.
Impact
Downloaded instructions can influence supported coding agents, including through ~/.claude/skills.
Mechanism
Remote skill download and AI context/configuration mutation.
AI rationale
The scanner’s claimed credential and command-output exfiltration was not confirmed in inspected source. The confirmed explicit AI-agent mutation and remotely fetched instruction capability warrants a warning, not a malicious block.
Evidence
package.jsonpackages/cli/src/bin.tspackages/core/src/ai.tspackages/core/src/mcp.ts.claude/skills/**~/.claude/skills/**CLAUDE.md.cursorules.github/copilot-instructions.md.windsurfrulesCONVENTIONS.md.clinerulesAGENTS.md
Network endpoints1
raw.githubusercontent.com
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- packages/core/src/ai.ts downloads remote skill files and writes them to project and global Claude skill paths.
- The AI installer updates context files for Claude, Cursor, Copilot, Windsurf, Aider, Cline, and Codex.
- Remote skill ref is overrideable through TINA4_SKILLS_REF and fetched without a content-integrity check.
- packages/core/src/mcp.ts exposes project file-writing MCP tools when the dev MCP server is enabled.
Evidence against
- package.json has only prepare and prepublishOnly build hooks; no preinstall/install/postinstall hook.
- AI-context and skill writes require the explicit tina4nodejs ai command or imported installer call.
- The inspected AI code sends no environment values, credentials, or command output to a remote endpoint.
- MCP remote access is gated by debug/explicit enablement and requires an opt-in plus valid token for remote peers.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
19 flaggedpackages/cli/dist/bin.jsView file
43050patternName = generic_password
severity = medium
line = 43050
matchedText = const re... });
Medium
Secret Pattern
Package contains a possible secret pattern.
packages/cli/dist/bin.jsView on unpkg · L4305043053patternName = generic_password
severity = medium
line = 43053
matchedText = const du... });
Medium
Secret Pattern
Hardcoded password in packages/cli/dist/bin.js
packages/cli/dist/bin.jsView on unpkg · L4305343056patternName = generic_password
severity = medium
line = 43056
matchedText = const lo... });
Medium
Secret Pattern
Hardcoded password in packages/cli/dist/bin.js
packages/cli/dist/bin.jsView on unpkg · L43056packages/core/dist/index.jsView file
Findings
4 Critical8 High10 Medium6 Low
CriticalCredential Exfiltrationpackages/core/dist/index.js
CriticalCommand Output Exfiltrationpackages/core/dist/index.js
CriticalTrigger Reachable Dangerous Capabilitypackages/core/dist/index.js
CriticalPrevious Version Dangerous Deltapackages/core/src/server.ts
HighChild Processpackages/core/dist/index.js
HighShell
HighSame File Env Network Executionpackages/core/dist/index.js
HighSandbox Evasion Gated Capabilitypackages/core/src/server.ts
HighExternal Ai Agent Control Surface Mutationpackages/core/dist/index.js
HighCross File Remote Execution Contextpackages/core/dist/index.js
HighTrigger Reachable Credential Exfiltration
Affected versions and remediation
This report applies to tina4-nodejs@3.13.97.
See all versions of tina4-nodejs for other recorded verdicts.
- Review the evidence and your use of tina4-nodejs@3.13.97 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.