registry / @trailhq/trail-code / 0.23.0
@trailhq/trail-code@0.23.0
Your team's shared memory for coding agents: a code map on your machine, and the learnings, decisions and skills your whole team shares. Formerly graft.
AI Security Review
scanned 20d ago · by lpm-firewall-aiThe postinstall hook does send default-on install telemetry, but the inspected code limits the event data and sends it to the package's product analytics endpoint. The flagged agent configuration behavior is reached through explicit CLI initialization, not the install hook.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
npm install triggers the postinstall hook; Claude configuration setup requires the CLI init flow.
Impact
The event supports install counting. No credential transfer, unconsented agent configuration mutation, or other concrete attack behavior was established.
Mechanism
The hook records an install event and starts a telemetry flush. The inspected payload uses an install identifier and bounded metadata; agent configuration writes occur in the explicit init path.
AI rationale
The postinstall hook does send default-on install telemetry, but the inspected code limits the event data and sends it to the package's product analytics endpoint. The flagged agent configuration behavior is reached through explicit CLI initialization, not the install hook.
Network endpoints1
events.nanonets.com/batch/
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- package.json runs a postinstall hook; that hook records and flushes an install event, while Claude setup is reached through the CLI init command.
- The install event is limited to its event name and global-install flag, with common version and platform metadata and a random install identifier; it is sent to the configured product analytics endpoint.
- Claude configuration setup is performed by runInit and is called from the CLI init flow.
- The other flagged locations describe repo housekeeping, existing Trail wiring detection, agent-file filtering, and bounded Git checkout behavior.
Evidence against
- Postinstall telemetry is automatic and detached; telemetry defaults on unless a gate or user setting disables it.
- Explicit init can write agent configuration and a skill to repo or user locations.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
6 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/claude/shim-template.js#virtual:normalized:round1View file
24return `#!/usr/bin/env node
L25: const path = require("path");
L26: const fs = require("fs");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/claude/shim-template.js#virtual:normalized:round1Findings
4 High5 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/claude/init.js
HighSemantic Analysis Limiteddist/app/checkout.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/cli.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/claude/shim-template.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @trailhq/trail-code@0.23.0.
See all versions of @trailhq/trail-code for other recorded verdicts.
- Review the evidence and your use of @trailhq/trail-code@0.23.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.