tnega@0.5.5
⚠ Under reviewA minimal agent harness with spacetime-composable plugin lifecycles.
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe inspected source does not prove malicious behavior or an install-time attack. Important runtime coverage remains unresolved, so this review cannot support a clean verdict.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The command-line entrypoint runs when invoked; package checks run during publishing.
Impact
The inspected evidence does not establish harmful impact, while incomplete runtime coverage prevents a clean determination.
Mechanism
The available excerpts show normal entrypoint and error-handling code, language tokenizers, and a dead evaluation call; they do not resolve all runtime paths.
AI rationale
The inspected source does not prove malicious behavior or an install-time attack. Important runtime coverage remains unresolved, so this review cannot support a clean verdict.
Decision evidence
public snapshotAI called this Manual Review at 61.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest exposes a CLI and runs package checks through `prepublishOnly`; the inspected scripts do not establish an npm install hook.
- The declared self-dependency points to an older release whose inspected manifest shows build and publish checks, with no install lifecycle script in the inspected excerpt.
- The flagged SQL and VBScript assets begin with language-tokenizer logic; the flagged `eval` excerpt is inside a function that returns before that call.
Evidence against
- Static analysis reports incomplete coverage of large runtime bundles and execution paths, which leaves behavior unresolved but does not establish an attack.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationTelemetry
Source & flagged code
20 flaggeddist/tools.jsView file
1667// packages/execution/src/index.ts
L1668: import { spawn, spawnSync } from "node:child_process";
L1669:
High
2049while ($queue.Count) { $p = $queue.Dequeue(); foreach ($c in $all) { if ($c.ParentProcessId -eq $p -and $c.ProcessId -ne $p) { $queue.Enqueue($c.ProcessId); Stop-Process -Id $c.Pro...
L2050: const root32 = process.env.SystemRoot ?? "C:\\Windows";
L2051: await new Promise((resolve4) => {
L2052: const sweeper = spawn(`${root32}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`, [
L2053: "-NoLogo",
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/tools.jsView on unpkg · L2049dist/tool-web-fetch.js#virtual:normalized:round1View file
137if (name === "pwsh") return "pwsh";
L138: if (name === "powershell") return "powershell";
L139: if (name === "cmd") return "cmd";
Findings
3 Critical12 High7 Medium7 Low
CriticalDownload Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/bin.js
HighChild Processdist/tools.js
HighShelldist/tool-web-fetch.js#virtual:normalized:round1
HighEvaldist/office.js
HighSame File Env Network Executiondist/tools.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighObfuscated Payload Loaderdist/office.js
HighRemote Agent Bridgedist/index.js
HighCross File Remote Execution Context
Affected versions and remediation
This report applies to tnega@0.5.5.
See all versions of tnega for other recorded verdicts.
- Review the evidence and your use of tnega@0.5.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.