registry / @orangeworks/orangetree / 0.21.1

@orangeworks/orangetree@0.21.1

Branching session-tree work-tracking tool (local-first, TypeScript)

AI Security Review

scanned 5d ago · by lpm-firewall-ai

No confirmed malicious attack surface; the risky primitives are aligned with a local-first Claude work-tracking/server tool. Execution occurs when the CLI/server is run, not during npm install.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs orangetree CLI or starts dist/server.js.

Impact

User-authorized agent actions and local app state changes; no evidence of covert credential theft or unconsented exfiltration.

Mechanism

local web app orchestrates Claude CLI/SDK, optional remote tunnel, and project file operations

Rationale

Static inspection found powerful but package-purpose behavior: a CLI/local server for OrangeTree that drives Claude, manages project files, optional cloud pairing/tunnel, and update checks. No lifecycle execution, hidden payload, covert harvesting, or unaligned exfiltration was found.

Evidence

package.jsondist/bin/orangetree.jsdist/server.js~/.orangetree/config.json~/.orangetree/daemon.json~/.orangetree/newt.json~/.orangetree/bot-profiles/*/profile.json~/.orangetree-bots/*project work roots

Network endpoints4

api.orangetree.devorangetree.devregistry.npmjs.org/-/package/@orangeworks/orangetree/dist-tagsgithub.com/fosrl/newt/releases/download/

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with medium false-positive risk.

Evidence for block

dist/server.js runs a Claude-agent orchestration UI with default OTREE_PERMISSION_MODE=bypassPermissions.
dist/server.js can spawn claude/newt, manage local server processes, and perform global npm update when invoked.
Remote/cloud mode posts to orangetree API and can expose a gated server when enabled by config/env.

Evidence against

package.json has no install/preinstall/postinstall lifecycle hooks.
dist/bin/orangetree.js only starts/stops/status/updates the daemon on explicit CLI invocation.
Claude credential handling uses CLAUDE_CONFIG_DIR and comments/code store profile metadata, not copied credentials.
Remote API is gated by token/cloud session unless local loopback, with root-jail path checks for file APIs.
Network endpoints are package-aligned: orangetree cloud, npm registry update check, newt release source.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 59 file(s), 1.50 MB of source, external domains: 127.0.0.1, api.orangetree.dev, github.com, json-schema.org, orangetree.dev, registry.npmjs.org, www.w3.org

Source & flagged code

4 flagged

dist/bin/orangetree.jsView file

Lines 44-107javascript

44 const o = raw;

45 const p = o.pairing ?? {};

46 return {

47 version: typeof o.version === "number" ? o.version : CONFIG_VERSION,

48 workRoot: asTrimmedString(o.workRoot),

49 remoteEnabled: asBool(o.remoteEnabled, d.remoteEnabled),

50 cloudApiBase: asHttpUrl(o.cloudApiBase),

51 remoteAuth: o.remoteAuth === "token" ? "token" : "cloud",

52 port: asPort(o.port),

53 bindHost: asTrimmedString(o.bindHost),

54 openBrowser: asBool(o.openBrowser, d.openBrowser),

55 pairing: {

56 onboardingToken: asTrimmedString(p.onboardingToken),

57 consumedAt: typeof p.consumedAt === "number" ? p.consumedAt : null

58 }

59 };

60}

61function loadConfig(appDataRoot) {

62 const path = configPath(appDataRoot);

63 if (!existsSync(path)) return defaults();

64 try {

65 return normalize(JSON.parse(readFileSync(path, "utf8")));

66 } catch {

67 return defaults();

68 }

69}

70function applyConfigToEnv(appDataRoot) {

71 const cfg = loadConfig(appDataRoot);

72 const fill = (key, value) => {

73 if (value != null && process.env[key] === void 0) process.env[key] = value;

74 };

75 fill("OTREE_CLOUD_API", cfg.cloudApiBase);

76 if (cfg.workRoot && existsSync(cfg.workRoot)) fill("OTREE_ROOT", cfg.workRoot);

77 if (cfg.remoteEnabled) {

78 fill("OTREE_REMOTE_ENABLED", "1");

79 fill("OTREE_REMOTE_AUTH", cfg.remoteAuth);

80 }

81 fill("OTREE_PORT", cfg.port != null ? String(cfg.port) : null);

82 fill("OTREE_BIND", cfg.bindHost);

83 if (cfg.openBrowser === false) fill("OTREE_OPEN", "0");

84 return cfg;

85}

87// lib/daemon.ts

88import { spawn, spawnSync } from "node:child_process";

89import { closeSync, existsSync as existsSync2, mkdirSync, openSync, readFileSync as readFileSync2, renameSync, rmSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/bin/orangetree.jsView on unpkg · L87

90import { request } from "node:http";

91import { homedir } from "node:os";

92import { dirname, join as join2 } from "node:path";

93var PKG = "@orangeworks/orangetree";

94var HEALTH_PATH = "/api/daemon/status";

95var SHUTDOWN_PATH = "/api/shutdown";

96var LOCAL_HEADER = { "X-Otree-Local": "1" };

97var STARTING_GRACE_MS = 15e3;

98var LOCK_STALE_MS = 3e4;

99function dataRoot() {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bin/orangetree.jsView on unpkg · L64

100 return process.env.OTREE_DATA ?? join2(homedir(), ".orangetree");

101}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/orangetree.jsView on unpkg · L87

102function paths(root = dataRoot()) {

103 return { json: join2(root, "daemon.json"), lock: join2(root, "daemon.lock"), log: join2(root, "daemon.log") };

104}

105function readState(root = dataRoot()) {

106 const p = paths(root).json;

107 if (!existsSync2(p)) return null;

Lines 292-332javascript

292 spawn(cmd2, args, { stdio: "ignore", detached: true, windowsHide: true }).unref();

293 } catch {

294 }

295}

296function ensureShortcut(root) {

297 if (process.env.OTREE_NO_SHORTCUT === "1") return;

298

Source & flagged code

4 flagged · loading source

dist/bin/orangetree.jsView file

High

Child Process

Package source references child process execution.

dist/bin/orangetree.jsView on unpkg · L87

312const ps = `$s=(New-Object -ComObject WScript.Shell).CreateShortcut(${psStr(lnk)});$s.TargetPath=${psStr(wscript)};$s.Arguments=${psStr(`//B //Nologo "${vbs}"`)};$s.Description='Or... L313: spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", ps], { stdio: "ignore", windowsHide: true }); L314: }

High

Shell

Package source references shell execution.

dist/bin/orangetree.jsView on unpkg · L312

87// lib/daemon.ts L88: import { spawn, spawnSync } from "node:child_process"; L89: import { closeSync, existsSync as existsSync2, mkdirSync, openSync, readFileSync as readFileSync2, renameSync, rmSync, writeFileSync } from "node:fs"; L90: import { request } from "node:http"; L91: import { homedir } from "node:os"; ... L99: function dataRoot() { L100: return process.env.OTREE_DATA ?? join2(homedir(), ".orangetree"); L101: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/orangetree.jsView on unpkg · L87

64Cross-file remote execution chain: dist/bin/orangetree.js spawns dist/server.js; helper contains network access plus dynamic code execution. L64: try { L65: return normalize(JSON.parse(readFileSync(path, "utf8"))); L66: } catch { ... L72: const fill = (key, value) => { L73: if (value != null && process.env[key] === void 0) process.env[key] = value; L74: }; ... L87: // lib/daemon.ts L88: import { spawn, spawnSync } from "node:child_process"; L89: import { closeSync, existsSync as existsSync2, mkdirSync, openSync, readFileSync as readFileSync2, renameSync, rmSync, writeFileSync } from "node:fs"; L90: import { request } from "node:http"; L91: import { homedir } from "node:os"; ... L99: function dataRoot() {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bin/orangetree.jsView on unpkg · L64

Findings

4 High2 Medium5 Low

HighChild Processdist/bin/orangetree.js

HighShelldist/bin/orangetree.js

HighSame File Env Network Executiondist/bin/orangetree.js

HighCross File Remote Execution Contextdist/bin/orangetree.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/bin/orangetree.jsView file

Lines 44-107javascript

44 const o = raw;

45 const p = o.pairing ?? {};

46 return {

47 version: typeof o.version === "number" ? o.version : CONFIG_VERSION,

48 workRoot: asTrimmedString(o.workRoot),

49 remoteEnabled: asBool(o.remoteEnabled, d.remoteEnabled),

50 cloudApiBase: asHttpUrl(o.cloudApiBase),

51 remoteAuth: o.remoteAuth === "token" ? "token" : "cloud",

52 port: asPort(o.port),

53 bindHost: asTrimmedString(o.bindHost),

54 openBrowser: asBool(o.openBrowser, d.openBrowser),

55 pairing: {

56 onboardingToken: asTrimmedString(p.onboardingToken),

57 consumedAt: typeof p.consumedAt === "number" ? p.consumedAt : null

58 }

59 };

60}

61function loadConfig(appDataRoot) {

62 const path = configPath(appDataRoot);

63 if (!existsSync(path)) return defaults();

64 try {

65 return normalize(JSON.parse(readFileSync(path, "utf8")));

66 } catch {

67 return defaults();

68 }

69}

70function applyConfigToEnv(appDataRoot) {

71 const cfg = loadConfig(appDataRoot);

72 const fill = (key, value) => {

73 if (value != null && process.env[key] === void 0) process.env[key] = value;

74 };

75 fill("OTREE_CLOUD_API", cfg.cloudApiBase);

76 if (cfg.workRoot && existsSync(cfg.workRoot)) fill("OTREE_ROOT", cfg.workRoot);

77 if (cfg.remoteEnabled) {

78 fill("OTREE_REMOTE_ENABLED", "1");

79 fill("OTREE_REMOTE_AUTH", cfg.remoteAuth);

80 }

81 fill("OTREE_PORT", cfg.port != null ? String(cfg.port) : null);

82 fill("OTREE_BIND", cfg.bindHost);

83 if (cfg.openBrowser === false) fill("OTREE_OPEN", "0");

84 return cfg;

85}

87// lib/daemon.ts

88import { spawn, spawnSync } from "node:child_process";

89import { closeSync, existsSync as existsSync2, mkdirSync, openSync, readFileSync as readFileSync2, renameSync, rmSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/bin/orangetree.jsView on unpkg · L87

90import { request } from "node:http";

91import { homedir } from "node:os";

92import { dirname, join as join2 } from "node:path";

93var PKG = "@orangeworks/orangetree";

94var HEALTH_PATH = "/api/daemon/status";

95var SHUTDOWN_PATH = "/api/shutdown";

96var LOCAL_HEADER = { "X-Otree-Local": "1" };

97var STARTING_GRACE_MS = 15e3;

98var LOCK_STALE_MS = 3e4;

99function dataRoot() {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bin/orangetree.jsView on unpkg · L64

100 return process.env.OTREE_DATA ?? join2(homedir(), ".orangetree");

101}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/orangetree.jsView on unpkg · L87

102function paths(root = dataRoot()) {

103 return { json: join2(root, "daemon.json"), lock: join2(root, "daemon.lock"), log: join2(root, "daemon.log") };

104}

105function readState(root = dataRoot()) {

106 const p = paths(root).json;

107 if (!existsSync2(p)) return null;

Lines 292-332javascript

292 spawn(cmd2, args, { stdio: "ignore", detached: true, windowsHide: true }).unref();

293 } catch {

294 }

295}

296function ensureShortcut(root) {

297 if (process.env.OTREE_NO_SHORTCUT === "1") return;

298