tnega@0.5.4
⚠ Under reviewA minimal agent harness with spacetime-composable plugin lifecycles.
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe manifest and inspected older release do not establish an automatic install-time self-dependency chain, and the provider request is tied to an explicit web-search operation. Dynamic evaluation and other runtime behavior in the oversized executable remain unresolved, so this review cannot establish a clean verdict or a concrete attack.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Running the command-line executable or invoking runtime operations; activation of the dynamic evaluation path is unresolved.
Impact
No harmful effect was confirmed; additional source review is needed to resolve the executable’s behavior.
Mechanism
The executable includes dynamic evaluation, but the inspected source does not establish whether it processes untrusted input or causes harmful behavior.
AI rationale
The manifest and inspected older release do not establish an automatic install-time self-dependency chain, and the provider request is tied to an explicit web-search operation. Dynamic evaluation and other runtime behavior in the oversized executable remain unresolved, so this review cannot establish a clean verdict or a concrete attack.
Evidence
package.jsondist/bin.js.lpm-dependency-evidence-0f03ce38-31e8-4978-9443-6643a3711899/2/npm-linux/package.json
Network endpoints1
api.deepseek.com/anthropic/v1/messages
Decision evidence
public snapshotAI called this Manual Review at 61.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json defines a `prepublishOnly` hook, not an install-time lifecycle hook.
- The older self-dependency release also defines `prepublishOnly`, not an install-time lifecycle hook.
- The executable contains an explicit DeepSeek web-search operation that requires a query and API key.
Evidence against
- The oversized executable contains dynamic evaluation, and the inspected excerpts do not establish its complete activation and data flow.
- The broader runtime review remains incomplete, so I could not resolve all flagged runtime operations and bundle behavior.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
20 flaggeddist/tools.jsView file
1667// packages/execution/src/index.ts
L1668: import { spawn, spawnSync } from "node:child_process";
L1669:
High
2049while ($queue.Count) { $p = $queue.Dequeue(); foreach ($c in $all) { if ($c.ParentProcessId -eq $p -and $c.ProcessId -ne $p) { $queue.Enqueue($c.ProcessId); Stop-Process -Id $c.Pro...
L2050: const root32 = process.env.SystemRoot ?? "C:\\Windows";
L2051: await new Promise((resolve4) => {
L2052: const sweeper = spawn(`${root32}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`, [
L2053: "-NoLogo",
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/tools.jsView on unpkg · L2049dist/tool-web-fetch.js#virtual:normalized:round1View file
137if (name === "pwsh") return "pwsh";
L138: if (name === "powershell") return "powershell";
L139: if (name === "cmd") return "cmd";
Findings
3 Critical12 High7 Medium7 Low
CriticalDownload Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/bin.js
HighChild Processdist/tools.js
HighShelldist/tool-web-fetch.js#virtual:normalized:round1
HighEvaldist/office.js
HighSame File Env Network Executiondist/tools.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighObfuscated Payload Loaderdist/office.js
HighRemote Agent Bridgedist/index.js
HighCross File Remote Execution Context
Affected versions and remediation
This report applies to tnega@0.5.4.
See all versions of tnega for other recorded verdicts.
- Review the evidence and your use of tnega@0.5.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.