registry / @adrianfathurs/plugin-agent-tracker / 1.0.1

@adrianfathurs/plugin-agent-tracker@1.0.1

NPM package to record AI prompting and dev activity into Mandays telemetry backend.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The postinstall hook makes an unrequested global Claude configuration change that enables tracker activity, so a warning is warranted. The inspected payload contains identifiers and counts rather than prompt content, and the source does not establish a publisher-controlled recipient or another concrete attack.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package runs its postinstall hook; subsequent pre-prompt events may run the configured tracker command.

Impact

Agent and project identifiers and activity counts may be sent automatically to the configured endpoint.

Mechanism

The hook writes a command into the user's global Claude settings. The command gathers the Git email and project name and submits them with prompt counts to the configured telemetry endpoint.

AI rationale

Evidence

package.jsondist/setup-hooks.jssrc/setup-hooks.tsdist/cli.jsdist/index.js~/.claude/settings.json

Network endpoints1

localhost:3000

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package postinstall automatically runs the setup script.
The setup script targets the global Claude settings file and writes a pre-prompt tracker command to it.
The CLI gathers the Git email and project name, then calls the tracker.
The tracker sends agent and project identifiers, event type, prompt count, and duration to its configured endpoint.
The endpoint defaults to localhost but can be overridden through configuration or an environment variable.

Evidence against

The inspected telemetry request contains no prompt text.
The default telemetry endpoint is localhost; the source does not establish a publisher-controlled recipient.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 13.1 KB of source

Source & flagged code

5 flagged

package.jsonView file

Lines 1-30json

2 "name": "@adrianfathurs/plugin-agent-tracker",

3 "version": "1.0.1",

4 "description": "NPM package to record AI prompting and dev activity into Mandays telemetry backend.",

5 "main": "dist/index.js",

6 "types": "dist/index.d.ts",

7 "bin": {

8 "track-prompt": "dist/cli.js"

9 },

10 "scripts": {

11 "build": "tsc && chmod +x dist/cli.js dist/setup-hooks.js",

12 "postinstall": "node dist/setup-hooks.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L12

13 "prepublishOnly": "npm run build",

Medium

Suspicious Lifecycle Evidence

The package postinstall automatically runs the setup script.

package.jsonView on unpkg · L12

14 "init-config": "node -e \"const fs=require('fs'),os=require('os'),p=require('path').join(os.homedir(),'.agent-tracker');fs.mkdirSync(p,{recursive:true});fs.writeFileSync(p+'/config.json',JSON.stringify({authToken:'tracker-agent-developer',baseUrl:'http://localhost:3000'},null,2));console.log('Config created at',p+'/config.json');\""

15 },

16 "keywords": ["telemetry", "mandays", "agent-tracker", "cli"],

17 "author": "",

18 "license": "MIT",

19 "dependencies": {

20 "axios": "^1.7.0"

21 },

22 "devDependencies": {

23 "@types/node": "^20.0.0",

24 "rimraf": "^5.0.0",

25 "typescript": "^5.0.0"

26 },

27 "publishConfig": {

28 "access": "public"

29 }

30}

dist/setup-hooks.jsView file

Lines 5-46javascript

5Object.defineProperty(exports, "__esModule", { value: true });

6const node_fs_1 = __importDefault(require("node:fs"));

7const node_path_1 =

src/setup-hooks.tsView file

Lines 3-43typescript

3import os from 'node:os';

5function fixPermissions() {

6 try {

7 // Otomatis berikan izin eksekusi (755 / rwxr-xr-x) ke file JS hasil build

8 const cliPath =

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/setup-hooks.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

12"postinstall": "node dist/setup-hooks.js", "prepublishOnly": "npm run build"

Medium

Suspicious Lifecycle Evidence

The package postinstall automatically runs the setup script.

package.jsonView on unpkg · L12

dist/setup-hooks.jsView file

25function setupClaudeCodeHook() { L26: const claudeConfigDir = node_path_1.default.join(node_os_1.default.homedir(), '.claude'); L27: const settingsPath = node_path_1.default.join(claudeConfigDir, 'settings.json'); ... L29: if (!node_fs_1.default.existsSync(claudeConfigDir)) { L30: node_fs_1.default.mkdirSync(claudeConfigDir, { recursive: true }); L31: } ... L43: settings.hooks.prePrompt = 'npx track-prompt 1'; L44: node_fs_1.default.writeFileSync(settingsPath, JSON.stringify(settings, null, 2)); L45: console.log('✅ [Agent Tracker] Successfully hooked into AI environment!');

Findings

1 Critical1 High6 Medium4 Low

CriticalAi Agent Control Hijackdist/setup-hooks.js

HighInstall Time Lifecycle Scriptspackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSuspicious Lifecycle Evidencepackage.json

MediumAi Review Evidencedist/setup-hooks.js

MediumAi Review Evidencesrc/setup-hooks.ts

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @adrianfathurs/plugin-agent-tracker@1.0.1.

See all versions of @adrianfathurs/plugin-agent-tracker for other recorded verdicts.

Review the evidence and your use of @adrianfathurs/plugin-agent-tracker@1.0.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-20 04:38:18.919Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.