registry / @adrianfathurs/plugin-agent-tracker / 1.0.4

@adrianfathurs/plugin-agent-tracker@1.0.4

NPM package to record AI prompting and dev activity into Mandays telemetry backend.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The postinstall script installs a global Claude hook integration without an affirmative consent step, and the hooks enable later telemetry disclosure. The inspected transfer contains usage metadata rather than prompt content, so the evidence supports a warning for agent extension lifecycle risk, not a block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing the package through npm runs its postinstall script; later Claude prompt and stop events invoke the installed hooks.

Impact

The integration is enabled without an affirmative setup step and can disclose user and project identifiers to the configured endpoint. No prompt text transfer was found in the inspected request body.

Mechanism

The hook setup modifies ~/.claude/settings.json, and the CLI records a Git email, project name, prompt count, and turn duration for telemetry.

AI rationale

Evidence

package.jsondist/setup-hooks.jssrc/setup-hooks.tsdist/cli.jssrc/cli.tsdist/index.js~/.claude/settings.json~/.agent-tracker/.turns

Network endpoints1

localhost:3000

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The postinstall hook runs setup-hooks.js automatically during installation.
The setup code reads and writes the user's global Claude settings and adds prompt-submit and stop hooks without a consent check.
Those hooks invoke the package CLI; its runtime records the Git email, project name, prompt count, and turn duration as telemetry.
Telemetry is sent to a configurable base URL, defaulting to http://localhost:3000; the inspected code does not send prompt text.

Evidence against

The recorded telemetry fields are usage metadata, and no prompt or response content is included in the inspected request body.
The package provides an uninstall command that removes its own hooks while retaining other hooks.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

5 flagged

package.jsonView file

Lines 1-29json

2 "name": "@adrianfathurs/plugin-agent-tracker",

3 "version": "1.0.4",

4 "description": "NPM package to record AI prompting and dev activity into Mandays telemetry backend.",

5 "main": "dist/index.js",

6 "types": "dist/index.d.ts",

7 "bin": {

8 "track-prompt": "dist/cli.js"

9 },

10 "scripts": {

11 "build": "tsc && chmod +x dist/cli.js dist/setup-hooks.js",

12 "postinstall": "node dist/setup-hooks.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L12

13 "prepublishOnly": "npm run build"

14 },

15 "keywords": ["telemetry", "mandays", "agent-tracker", "cli"],

16 "author": "",

17 "license": "MIT",

18 "dependencies": {

19 "axios": "^1.7.0"

20 },

21 "devDependencies": {

22 "@types/node": "^20.0.0",

23 "rimraf": "^5.0.0",

24 "typescript": "^5.0.0"

25 },

26 "publishConfig": {

27 "access": "public"

28 }

29}

dist/setup-hooks.jsView file

Lines 18-58javascript

18 command: 'npx --no-install track-prompt stop',

19 timeout: 15,

20 async: true, // request telemetry berjalan di background saat turn selesai

21};

22function fixPermissions() {

dist/cli.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: function uninstallhooks() { const claudeconfigdir = node_path_1.default.join(node_os_1.default.homedir(), '.claude'); const settingspath = node_path_1.default.join(claudeconfigdir, 'settings.json'); let changed = false; try { if (!node_fs_1.default.existssync(settingspath)) return false; const settings = json.parse(node_fs_1.default.readfilesync(settingspath, 'utf8')); if (!settings.hooks) return false; for (const event of object.keys(settings.hooks)) { const entries = settings.hooks[event]; if (!array.isarray(entries)) continue; const kept = entries.map((entry) => ({

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @adrianfathurs/plugin-agent-tracker@1.0.3 matchedIdentity = npm:[redacted]:1.0.3 similarity = 0.714 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

dist/index.jsView file

•matchType = normalized_sha256 matchedPackage = @adrianfathurs/plugin-agent-tracker@1.0.2 matchedPath = dist/index.js matchedIdentity = npm:[redacted]:1.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/setup-hooks.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/setup-hooks.jsView file

38function setupClaudeCodeHook() { L39: const claudeConfigDir = node_path_1.default.join(node_os_1.default.homedir(), '.claude'); L40: const settingsPath = node_path_1.default.join(claudeConfigDir, 'settings.json'); ... L47: catch { L48: console.warn('⚠️ [Agent Tracker] ~/.claude/settings.json bukan JSON valid, dilewati.'); L49: return; ... L82: if (!node_fs_1.default.existsSync(claudeConfigDir)) { L83: node_fs_1.default.mkdirSync(claudeConfigDir, { recursive: true }); L84: } L85: node_fs_1.default.writeFileSync(settingsPath, JSON.stringify(settings, null, 2)); L86: console.log('✅ [Agent Tracker] Hook UserPromptSubmit terpasang di ~/.claude/settings.json'); L87: }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/setup-hooks.jsView on unpkg · L38

Findings

1 Critical4 High3 Medium4 Low

CriticalAi Agent Control Hijackdist/setup-hooks.js

HighInstall Time Lifecycle Scriptspackage.json

HighExternal Ai Agent Control Surface Mutationdist/cli.js

HighKnown Malware Source Similaritydist/index.js

HighPrevious Version Dangerous Deltadist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @adrianfathurs/plugin-agent-tracker@1.0.4.

See all versions of @adrianfathurs/plugin-agent-tracker for other recorded verdicts.

Review the evidence and your use of @adrianfathurs/plugin-agent-tracker@1.0.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-20 07:06:35.766Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.