tnega@0.4.1
A minimal eval-first agent harness with spacetime-composable plugin lifecycles.
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis flagged 17 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
8 flaggeddist/tools.jsView file
1521// packages/tools/src/execution.ts
L1522: import { spawn } from "node:child_process";
L1523: function errorMessage(error) {
High
1551cwd: request.cwd,
L1552: shell: true,
L1553: windowsHide: true,
High
dist/bin.jsView file
1236// validation function arguments
L1237: data: new codegen_1.Name("data"),
L1238: // data passed to validation function
...
L2263: id = normalizeId(id);
L2264: return resolver.resolve(baseId, id);
L2265: }
...
L3144: for (i = 0; i < input.length; i++) {
L3145: code = input[i].charCodeAt(0);
L3146: if (code === 48) {
...
L7203: function checkPathExt(path, options) {
L7204: var pathext = options.pathExt !== void 0 ? options.pathExt : process.env.PATHEXT;
L7205: if (!pathext) {
High
Findings
7 High3 Medium7 Low
HighChild Processdist/tools.js
HighShelldist/tools.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/bin.js
HighCross File Remote Execution Contextdist/bin.js
HighSemantic Analysis Limiteddist/bin.js
HighKnown Malware Source Similaritydist/bin.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/bin.js
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to tnega@0.4.1.
See all versions of tnega for other recorded verdicts.
- Review the evidence and your use of tnega@0.4.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.