tnega@0.5.6
A minimal agent harness with spacetime-composable plugin lifecycles.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe runtime accepts OPENAI_API_KEY but defaults requests to opencode.ai, sending the credential to a host outside its own service. This is automatic once the user runs the agent and does not require an explicit endpoint choice.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A user runs the agent with OPENAI_API_KEY set and no explicit model endpoint configured.
Impact
The key is disclosed to a host outside OpenAI and may be used by that service.
Mechanism
The environment resolver accepts OPENAI_API_KEY, while the LLM route defaults to opencode.ai; the agent passes the key to the adapter, which sends it as a Bearer credential.
Attack narrative
When the agent runs without an explicitly configured endpoint, it accepts OPENAI_API_KEY as an LLM credential but routes requests to opencode.ai by default. The agent passes the resolved key to its LLM adapter, which attaches it as a Bearer token. This sends an OpenAI credential to a different service without an explicit endpoint choice.
AI rationale
The runtime accepts OPENAI_API_KEY but defaults requests to opencode.ai, sending the credential to a host outside its own service. This is automatic once the user runs the agent and does not require an explicit endpoint choice.
Evidence
dist/index.js
Network endpoints1
opencode.ai
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- The CLI lists OPENAI_API_KEY as an accepted LLM credential.
- The environment resolver selects OPENAI_API_KEY when higher-priority variables are absent.
- The default LLM endpoint is https://opencode.ai/zen/go/v1 when no endpoint is configured.
- The agent command passes its resolved credential into the LLM adapter, whose requests use it as a Bearer token.
Evidence against
- The prepublishOnly script runs the package test command; no install, preinstall, or postinstall hook is declared.
- The package is an agent harness whose model requests are an expected feature, and routes can be configured.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
21 flaggeddist/tools.jsView file
1674// packages/execution/src/index.ts
L1675: import { spawn, spawnSync } from "node:child_process";
L1676:
High
dist/tool-web-fetch.js#virtual:normalized:round1View file
143if (name === "pwsh") return "pwsh";
L144: if (name === "powershell") return "powershell";
L145: if (name === "cmd") return "cmd";
High
Shell
Package source references shell execution.
dist/tool-web-fetch.js#virtual:normalized:round1View on unpkg · L143dist/office.jsView file
9051if (typeof callback !== "function") {
L9052: callback = new Function("" + callback);
L9053: }
Findings
4 Critical12 High7 Medium7 Low
CriticalSame File Env Network Executiondist/index.js
CriticalDownload Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/cli-runtime.js
HighChild Processdist/tools.js
HighShelldist/tool-web-fetch.js#virtual:normalized:round1
HighEvaldist/office.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighObfuscated Payload Loaderdist/office.js
HighRemote Agent Bridge
Affected versions and remediation
This report applies to tnega@0.5.6.
See all versions of tnega for other recorded verdicts.
- Avoid installing tnega@0.5.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.