tnega@0.4.20
A minimal agent harness with spacetime-composable plugin lifecycles.
AI Security Review
scanned 20d ago · by lpm-firewall-aiThe manifest has no consumer install lifecycle hook; its prepublishOnly command runs package tests. The flagged agent code supplies workspace guidance to an approval flow, while the other inspected findings show error reporting, event serialization, sandbox defaults, and browser preview code rather than attack behavior.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The approval code runs when a project or CLI agent reviews a tool request; it reads that workspace's AGENTS.md as review context.
Impact
No unauthorized account action, credential transfer, install-time mutation, or other concrete attack was identified.
Mechanism
The review path passes project constraints to the approval reviewer and applies permission checks. The inspected sites do not mutate agent configuration or disclose credentials.
AI rationale
The manifest has no consumer install lifecycle hook; its prepublishOnly command runs package tests. The flagged agent code supplies workspace guidance to an approval flow, while the other inspected findings show error reporting, event serialization, sandbox defaults, and browser preview code rather than attack behavior.
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines a prepublishOnly test command and a runtime self-dependency; it has no preinstall, install, or postinstall hook.
- The flagged agent sites read workspace AGENTS.md as approval constraints. The approval flow sends constraints for review and can ask for a decision; these sites do not write agent configuration.
- The flagged runtime excerpts format error stacks or serialize events. The execution wrapper defaults process confinement to true.
- The flagged browser assets contain document-library loading, syntax tokenizer code, and local application API helpers.
- The coding-agent entrypoint registers skill tools for its configured working directory.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
19 flaggeddist/tools.jsView file
1725// packages/execution/src/index.ts
L1726: import { spawn, spawnSync } from "node:child_process";
L1727:
High
2025while ($queue.Count) { $p = $queue.Dequeue(); foreach ($c in $all) { if ($c.ParentProcessId -eq $p -and $c.ProcessId -ne $p) { $queue.Enqueue($c.ProcessId); Stop-Process -Id $c.Pro...
L2026: const root32 = process.env.SystemRoot ?? "C:\\Windows";
L2027: await new Promise((resolve4) => {
L2028: const sweeper = spawn(`${root32}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`, [
L2029: "-NoLogo",
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/tools.jsView on unpkg · L2025dist/web/assets/exceljs.min-C1Gg15Ia.jsView file
9`))},S.constants={DH_CHECK_P_NOT_SAFE_PRIME:2,DH_CHECK_P_NOT_PRIME:1,DH_UNABLE_TO_CHECK_GENERATOR:4,DH_NOT_SUITABLE_GENERATOR:8,NPN_ENABLED:1,ALPN_ENABLED:1,RSA_PKCS1_PADDING:1,RSA...
L10: \0`,et+=u(Y,2),et+=b.magic,et+=u(M,2),et+=u(v,2),et+=u(V.crc32,4),et+=u(V.compressedSize,4),et+=u(V.uncompressedSize,4),et+=u(y.length,2),et+=u(j.length,2),{fileRecord:N.LOCAL_FILE...
L11: Use Chrome, Firefox or Internet Explorer 11`)}}).call(this)}).call(this,s("_process"),typeof Kt<"u"?Kt:typeof self<"u"?self:typeof window<"u"?window:{})},{_process:467,"safe-buffer...
Findings
3 Critical11 High7 Medium7 Low
CriticalDownload Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/execution-sandbox.js
HighChild Processdist/tools.js
HighEvaldist/web/assets/exceljs.min-C1Gg15Ia.js
HighSame File Env Network Executiondist/tools.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighObfuscated Payload Loaderdist/index.js
HighRemote Agent Bridgedist/index.js
HighCross File Remote Execution Contextdist/bin.js
HighSemantic Analysis Limited
Affected versions and remediation
This report applies to tnega@0.4.20.
See all versions of tnega for other recorded verdicts.
- Review the evidence and your use of tnega@0.4.20 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.