Loading npm security reports…

@untitledmarkdown/trace: Suspicious npm security report (Warn) | LPM Firewall

registry / @untitledmarkdown/trace / 0.1.0

@untitledmarkdown/trace@0.1.0

Trace — record of work for AI coding agents. Install the full CLI with npm.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 6.06 KB of source, external domains: github.com, www.npmjs.com

Source & flagged code

4 flagged

package.jsonView file

Lines 17-49json

17 "repository": {

18 "type": "git",

19 "url": "https://github.com/untitledmarkdown/trace.git"

20 },

21 "bugs": {

22 "url": "https://github.com/untitledmarkdown/trace/issues"

23 },

24 "bin": {

25 "trace": "bin/trace.js"

26 },

27 "files": [

28 "bin",

29 "scripts",

30 "vendor",

31 "README.md"

32 ],

33 "engines": {

34 "node": ">=18"

35 },

36 "scripts": {

37 "postinstall": "node scripts/install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L37

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L37

38 },

39 "os": [

40 "darwin",

41 "linux",

42 "win32"

43 ],

44 "cpu": [

45 "x64",

46 "arm64"

47 ]

48}

bin/trace.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2"use strict";

4const { spawnSync } = require("child_process");

5const fs = require("fs");

vendor/trace.exeView file

•path = vendor/trace.exe kind = native_binary sizeBytes = 10263040 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/trace.exeView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code