tnega@0.4.10
A minimal agent harness with spacetime-composable plugin lifecycles.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspected source supports a warning for automatic first-party agent extension setup, not a malicious verdict. The scanner's blocking claims were not substantiated by concrete attack behavior, and the package lacks an install hook required for the lifecycle self-dependency blocking rule.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Initializing an agent runtime with skills enabled, including the default configuration.
Impact
Persistent instructions can influence later agent behavior. Existing skills are preserved; no automatic replacement or update behavior was identified.
Mechanism
The skills plugin installs bundled instruction files and exposes available skills in agent prompts without a separate setup consent prompt.
AI rationale
Inspected source supports a warning for automatic first-party agent extension setup, not a malicious verdict. The scanner's blocking claims were not substantiated by concrete attack behavior, and the package lacks an install hook required for the lifecycle self-dependency blocking rule.
Evidence
dist/index.js.tnega
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Agent runtime initialization enables the skills plugin by default, which automatically installs bundled skills.
- Skill storage defaults to .tnega under the user's home directory and can be configured through TNEGA_HOME.
- Installation writes persistent instruction files while preserving existing skills.
- The skills plugin adds available skill instructions to the agent's system prompt.
- package.json has no registry-install lifecycle hook; its older self-dependency does not establish the required malicious lifecycle chain.
- The indicated agent locations read AGENTS.md for approval constraints rather than modifying it.
Evidence against
- No concrete credential theft, covert remote payload execution, or foreign agent configuration mutation was identified.
- The flagged VBScript asset implements syntax tokenization; spreadsheet dynamic evaluation belongs to compatibility utilities.
- Shell execution is provided through a configurable sandbox wrapper.
Behavioral surface
ChildProcessCryptoDynamicRequire
Source & flagged code
18 flaggeddist/tools.jsView file
1609// packages/execution/src/index.ts
L1610: import { spawn, spawnSync } from "node:child_process";
L1611: import { lookup } from "node:dns/promises";
High
1777while ($queue.Count) { $p = $queue.Dequeue(); foreach ($c in $all) { if ($c.ParentProcessId -eq $p -and $c.ProcessId -ne $p) { $queue.Enqueue($c.ProcessId); Stop-Process -Id $c.Pro...
L1778: const root32 = process.env.SystemRoot ?? "C:\\Windows";
L1779: await new Promise((resolve4) => {
L1780: const sweeper = spawn(`${root32}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`, [
L1781: "-NoLogo",
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/tools.jsView on unpkg · L1777dist/web/assets/exceljs.min-BuXEDMZu.jsView file
9`))},S.constants={DH_CHECK_P_NOT_SAFE_PRIME:2,DH_CHECK_P_NOT_PRIME:1,DH_UNABLE_TO_CHECK_GENERATOR:4,DH_NOT_SUITABLE_GENERATOR:8,NPN_ENABLED:1,ALPN_ENABLED:1,RSA_PKCS1_PADDING:1,RSA...
L10: \0`,et+=u(Y,2),et+=b.magic,et+=u(M,2),et+=u(v,2),et+=u(V.crc32,4),et+=u(V.compressedSize,4),et+=u(V.uncompressedSize,4),et+=u(y.length,2),et+=u(j.length,2),{fileRecord:N.LOCAL_FILE...
L11: Use Chrome, Firefox or Internet Explorer 11`)}}).call(this)}).call(this,s("_process"),typeof Kt<"u"?Kt:typeof self<"u"?self:typeof window<"u"?window:{})},{_process:467,"safe-buffer...
Findings
3 Critical10 High7 Medium7 Low
CriticalDownload Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/execution-sandbox.js
HighChild Processdist/tools.js
HighEvaldist/web/assets/exceljs.min-BuXEDMZu.js
HighSame File Env Network Executiondist/tools.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighObfuscated Payload Loaderdist/index.js
HighRemote Agent Bridgedist/index.js
HighCross File Remote Execution Contextdist/bin.js
HighSemantic Analysis Limited
Affected versions and remediation
This report applies to tnega@0.4.10.
See all versions of tnega for other recorded verdicts.
- Review the evidence and your use of tnega@0.4.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.