@trailhq/trail-code@0.25.0
Your team's shared memory for coding agents: a code map on your machine, and the learnings, decisions and skills your whole team shares. Formerly graft.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe postinstall hook performs a real automatic telemetry send, and an unset telemetry preference leaves the send enabled when other gates pass. The default collector is vendor-aligned and the inspected event is limited to a random install identifier and coarse runtime fields, so the source supports a warning but not a publication block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Installing the package with telemetry gates open.
Impact
The vendor can associate installation events with a persistent pseudonymous identifier and platform details; the inspected event does not send source files or credentials.
Mechanism
The hook queues an installation event and starts a detached process that posts the telemetry batch to the configured collector.
AI rationale
The postinstall hook performs a real automatic telemetry send, and an unset telemetry preference leaves the send enabled when other gates pass. The default collector is vendor-aligned and the inspected event is limited to a random install identifier and coarse runtime fields, so the source supports a warning but not a publication block.
Evidence
package.jsonscripts/postinstall.mjsdist/telemetry/track.jsdist/telemetry/gate.jsdist/telemetry/identity.jsdist/telemetry/send.jsdist/telemetry/key.js~/.graft/telemetry.json
Network endpoints1
events.nanonets.com
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package runs a postinstall hook that records an installation event and starts a detached telemetry flush.
- The event includes a persistent random install identifier and coarse runtime and platform fields.
- Telemetry can send when its gates pass; an unset preference does not disable it, though CI, DO_NOT_TRACK, or an explicit disabled setting closes the gate.
- The default collector is the vendor's analytics host, and the event is sent in a POST request.
- Agent wiring is exposed through an explicit initialization command; the postinstall path records and flushes telemetry.
- The picker defaults its input and output receivers to process.stdin and process.stderr.
Evidence against
- The installation event uses a random install identifier and coarse metadata rather than source files or credentials.
- The configured default collector is events.nanonets.com, which source identifies as the vendor's PostHog host.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVars
Source & flagged code
8 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/claude/pre-bash.jsView file
87async function nodeFs() {
L88: return typeof process.getBuiltinModule === 'function' ? process.getBuiltinModule('node:fs') : await import('node:fs');
L89: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/claude/pre-bash.jsView on unpkg · L87Findings
4 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/claude/init.js
HighSemantic Analysis Limiteddist/app/checkout.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/cli.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/claude/pre-bash.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarydist/vendor/tree-sitter-swift/prebuilds/win32-arm64/tree-sitter-swift.node
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/init/candidates.js
Affected versions and remediation
This report applies to @trailhq/trail-code@0.25.0.
See all versions of @trailhq/trail-code for other recorded verdicts.
- Review the evidence and your use of @trailhq/trail-code@0.25.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.