tnega@0.4.21
A minimal agent harness with spacetime-composable plugin lifecycles.
AI Security Review
scanned 27d ago · by lpm-firewall-aiThe source inspected supports ordinary CLI, bundled parser, and sandbox functionality, with no confirmed attack behavior. The manifest's prepublishOnly hook runs package tests and does not provide an automatic consumer install trigger.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The CLI's applicable review flow invokes the instruction-file reader.
Impact
No malicious side effect or unconsented control-surface mutation was established.
Mechanism
It reads AGENTS.md from the workspace and returns an empty string when the file is absent; the adjacent code submits an approval review event.
AI rationale
The source inspected supports ordinary CLI, bundled parser, and sandbox functionality, with no confirmed attack behavior. The manifest's prepublishOnly hook runs package tests and does not provide an automatic consumer install trigger.
Evidence
AGENTS.md
Decision evidence
public snapshotAI called this Clean at 76.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and prepublishOnly runs the package test build; it declares no install-time hook in the inspected scripts.
- The three flagged AGENTS.md locations read a workspace instruction file and treat a missing file as empty; the adjacent code is ordinary approval review plumbing.
- The required tools and web assets are bundled code, and the VBScript file begins with a parser implementation.
- The execution sandbox imports process and DNS APIs, consistent with the package's execution sandbox component; this alone does not establish an attack.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
18 flaggeddist/tools.jsView file
1725// packages/execution/src/index.ts
L1726: import { spawn, spawnSync } from "node:child_process";
L1727:
High
2025while ($queue.Count) { $p = $queue.Dequeue(); foreach ($c in $all) { if ($c.ParentProcessId -eq $p -and $c.ProcessId -ne $p) { $queue.Enqueue($c.ProcessId); Stop-Process -Id $c.Pro...
L2026: const root32 = process.env.SystemRoot ?? "C:\\Windows";
L2027: await new Promise((resolve4) => {
L2028: const sweeper = spawn(`${root32}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`, [
L2029: "-NoLogo",
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/tools.jsView on unpkg · L2025dist/web/assets/jszip.min-D5LbH8ZR.jsView file
1import{d as vt,g as Bt}from"./index-CLbKZYx7.js";import{c as yt}from"./_commonjs-dynamic-modules-TDtrdbi3.js";function Rt(ct,wt){for(var _=0;_<wt.length;_++){const N=wt[_];if(typeo...
L2: \0`,G+=l(E,2),G+=D.magic,G+=l(v,2),G+=l(S,2),G+=l(J.crc32,4),G+=l(J.compressedSize,4),G+=l(J.uncompressedSize,4),G+=l(j.length,2),G+=l(T.length,2),{fileRecord:p.LOCAL_FILE_HEADER+G...
Findings
3 Critical10 High7 Medium7 Low
CriticalDownload Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/execution-sandbox.js
HighChild Processdist/tools.js
HighEvaldist/web/assets/jszip.min-D5LbH8ZR.js
HighSame File Env Network Executiondist/tools.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighObfuscated Payload Loaderdist/index.js
HighRemote Agent Bridgedist/index.js
HighCross File Remote Execution Contextdist/bin.js
HighSemantic Analysis Limited
Affected versions and remediation
This report applies to tnega@0.4.21.
See all versions of tnega for other recorded verdicts.
- Review the evidence and your use of tnega@0.4.21 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.