registry / @trailhq/trail-code / 0.28.0
@trailhq/trail-code@0.28.0
⚠ Under reviewYour team's shared memory for coding agents: a code map on your machine, and the learnings, decisions and skills your whole team shares. Formerly graft.
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe install hook sends gated package telemetry, while reviewed agent configuration changes are in setup and removal helpers. The shipped native binaries remain materially unresolved after bounded analysis, so a clean verdict is not supported.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Loading a native Swift parser on a supported platform may activate the unresolved native code.
Impact
The native binaries' behavior cannot be fully determined from the inspected evidence.
Mechanism
The available offline analysis is incomplete and does not resolve all native call targets.
AI rationale
The install hook sends gated package telemetry, while reviewed agent configuration changes are in setup and removal helpers. The shipped native binaries remain materially unresolved after bounded analysis, so a clean verdict is not supported.
Evidence
.lpm-inspection-BUaxEO/3-cebd63f7c915.txtdist/vendor/tree-sitter-swift/prebuilds/win32-x64/tree-sitter-swift.node
Network endpoints1
events.nanonets.com
Decision evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json runs scripts/postinstall.mjs during installation; that hook imports the telemetry module and invokes the install-event helper.
- The install event is gated by a published key, DO_NOT_TRACK, CI checks, and a saved disabled preference; telemetry posts to the package's configured Nanonets events host.
- The package includes native tree-sitter Swift binaries. The inspected x64 Windows analysis reports uninspected call targets, so their behavior is unresolved.
- The inspected agent configuration writes occur in setup or removal helpers; the reviewed excerpts do not establish that those helpers run during installation.
Evidence against
- The telemetry sender uses an event batch and the package's Nanonets events endpoint; the reviewed source does not show unrelated credential or project-file collection.
- The inspected note-flattening helper removes control characters and normalizes text before returning a line.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVars
Source & flagged code
8 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/claude/pre-bash.jsView file
100async function nodeFs() {
L101: return typeof process.getBuiltinModule === 'function' ? process.getBuiltinModule('node:fs') : await import('node:fs');
L102: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/claude/pre-bash.jsView on unpkg · L100Findings
4 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/claude/init.js
HighSemantic Analysis Limiteddist/app/checkout.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/cli.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/claude/pre-bash.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarydist/vendor/tree-sitter-swift/prebuilds/win32-arm64/tree-sitter-swift.node
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/init/candidates.js
Affected versions and remediation
This report applies to @trailhq/trail-code@0.28.0.
See all versions of @trailhq/trail-code for other recorded verdicts.
- Review the evidence and your use of @trailhq/trail-code@0.28.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.