tnega@0.4.5
A minimal eval-first agent harness with spacetime-composable plugin lifecycles.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspected behavior is consistent with an agent harness, including workspace approval rules and user-invoked execution tools. The self-dependency merits attention but this release lacks the automatic install hook required for the defined blocking chain, and no separate concrete attack was found.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Explicit CLI commands or caller-invoked runtime tools; no registry-install lifecycle trigger was found.
Impact
No confirmed credential theft, foreign agent configuration mutation, or malicious install behavior was established.
Mechanism
Workspace rule reading, configured approval review, request-driven process execution, and service authentication show package-aligned behavior.
AI rationale
Inspected behavior is consistent with an agent harness, including workspace approval rules and user-invoked execution tools. The self-dependency merits attention but this release lacks the automatic install hook required for the defined blocking chain, and no separate concrete attack was found.
Evidence
AGENTS.md
Network endpoints1
api.deepseek.com/anthropic/v1/messages
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no preinstall, install, or postinstall hook; its runtime self-dependency therefore does not establish the specified malicious lifecycle chain.
- The flagged code in dist/bin.js, dist/cli-runtime.js, and dist/index.js reads workspace AGENTS.md for approval constraints without modifying it; approval defaults to manual.
- dist/tools.js provides request-driven execution and applies configured tool authorization policies.
- dist/web/assets/jszip.min-B3xE1mmA.js implements ZIP loading through its archive API.
- Web search selects a DeepSeek credential and sends it to the fixed DeepSeek API endpoint.
- The CLI activates agent execution through an explicit run command requiring a prompt.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
16 flaggeddist/tools.jsView file
1620// packages/execution/src/index.ts
L1621: import { spawn } from "node:child_process";
L1622: import { lookup } from "node:dns/promises";
High
1722...spawnOptions(request.cwd, "pipe"),
L1723: shell: true
L1724: }),
High
dist/web/assets/jszip.min-B3xE1mmA.jsView file
1import{b as vt,g as Bt}from"./index-Bu31tFeR.js";import{c as yt}from"./_commonjs-dynamic-modules-TDtrdbi3.js";function Rt(ct,wt){for(var _=0;_<wt.length;_++){const N=wt[_];if(typeo...
L2: \0`,G+=l(E,2),G+=D.magic,G+=l(v,2),G+=l(S,2),G+=l(J.crc32,4),G+=l(J.compressedSize,4),G+=l(J.uncompressedSize,4),G+=l(j.length,2),G+=l(T.length,2),{fileRecord:p.LOCAL_FILE_HEADER+G...
High
Eval
Findings
3 Critical8 High7 Medium7 Low
CriticalDownload Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/bin.js
HighChild Processdist/tools.js
HighShelldist/tools.js
HighEvaldist/web/assets/jszip.min-B3xE1mmA.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighObfuscated Payload Loaderdist/index.js
HighCross File Remote Execution Contextdist/bin.js
HighSemantic Analysis Limiteddist/cli-runtime.js
MediumDynamic Requiredist/web/assets/PptxViewJS.es-CBZC7nOU.js
Affected versions and remediation
This report applies to tnega@0.4.5.
See all versions of tnega for other recorded verdicts.
- Review the evidence and your use of tnega@0.4.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.