tnega@0.4.22
A minimal agent harness with spacetime-composable plugin lifecycles.
AI Security Review
scanned 27d ago · by lpm-firewall-aiThe manifest has no automatic install hook; prepublishOnly runs package tests, and the runtime self-dependency therefore lacks an install-time trigger. Inspected skill downloading is an explicit, constrained tool action, and the requested agent-related excerpts show no control-surface mutation.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
A caller explicitly invokes the skill installation tool.
Impact
No confirmed malicious effect or package install-time attack surface was established.
Mechanism
The tool accepts a local source or an HTTPS URL, fetches remote content through the http_get tool, validates it, and publishes a skill document.
AI rationale
The manifest has no automatic install hook; prepublishOnly runs package tests, and the runtime self-dependency therefore lacks an install-time trigger. Inspected skill downloading is an explicit, constrained tool action, and the requested agent-related excerpts show no control-surface mutation.
Evidence
dist/index.js
Decision evidence
public snapshotAI called this Clean at 78.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes dist/bin.js and dist/index.js; its only lifecycle script is prepublishOnly, which runs the package test script.
- The three requested agent configuration locations read workspace AGENTS.md and pass an approval review event; the excerpts show no mutation or credential forwarding.
- The skill installer is an explicit tool for copying instruction Markdown; remote sources must use HTTPS and pass through http_get before validation and publication.
- The flagged browser assets are bundled JavaScript libraries; no malicious behavior was established from their inspected source.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
17 flaggeddist/tools.jsView file
1725// packages/execution/src/index.ts
L1726: import { spawn, spawnSync } from "node:child_process";
L1727:
High
2025while ($queue.Count) { $p = $queue.Dequeue(); foreach ($c in $all) { if ($c.ParentProcessId -eq $p -and $c.ProcessId -ne $p) { $queue.Enqueue($c.ProcessId); Stop-Process -Id $c.Pro...
L2026: const root32 = process.env.SystemRoot ?? "C:\\Windows";
L2027: await new Promise((resolve4) => {
L2028: const sweeper = spawn(`${root32}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`, [
L2029: "-NoLogo",
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/tools.jsView on unpkg · L2025dist/web/assets/jszip.min-mt2fwbRy.jsView file
1import{d as vt,g as Bt}from"./index-zaIUjxzJ.js";import{c as yt}from"./_commonjs-dynamic-modules-TDtrdbi3.js";function Rt(ct,wt){for(var _=0;_<wt.length;_++){const N=wt[_];if(typeo...
L2: \0`,G+=l(E,2),G+=D.magic,G+=l(v,2),G+=l(S,2),G+=l(J.crc32,4),G+=l(J.compressedSize,4),G+=l(J.uncompressedSize,4),G+=l(j.length,2),G+=l(T.length,2),{fileRecord:p.LOCAL_FILE_HEADER+G...
Findings
2 Critical10 High7 Medium7 Low
CriticalDownload Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/tools.js
HighEvaldist/web/assets/jszip.min-mt2fwbRy.js
HighSame File Env Network Executiondist/tools.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighObfuscated Payload Loaderdist/index.js
HighRemote Agent Bridgedist/index.js
HighCross File Remote Execution Contextdist/bin.js
HighSemantic Analysis Limiteddist/cli-runtime.js
HighKnown Malware Source Similarity
Affected versions and remediation
This report applies to tnega@0.4.22.
See all versions of tnega for other recorded verdicts.
- Review the evidence and your use of tnega@0.4.22 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.