registry / AI-agent control-surface risk / first-tree
first-tree
First Tree — unified CLI for Context Tree onboarding, agent management, and team messaging. (Source-tree dev build; CI rewrites `name` and `bin` for prod / staging publishes — see docs/local-dev-isolation.md.)
This report shows the evidence for first-tree@0.5.20. 1 of 6 known versions is blocked or flagged. The newest version, 0.5.23, is flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe postinstall hook concretely deletes foreign AI runtime packages during installation. Global-only scope and opt-outs reduce breadth but do not make the unconsented lifecycle mutation safe.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
npm install -g first-tree
Impact
Disables or alters bundled Codex/Claude runtime availability and removes SDK peers.
Mechanism
postinstall recursive deletion of foreign AI runtime packages
Policy narrative
On global installation, package.json automatically executes pruning scripts. Those scripts resolve and recursively remove platform packages containing OpenAI Codex and Anthropic Claude runtimes, plus Claude SDK peer packages, from the installed dependency tree. The deletion is not initiated by a user command and modifies foreign AI-agent components.
AI rationale
The postinstall hook concretely deletes foreign AI runtime packages during installation. Global-only scope and opt-outs reduce breadth but do not make the unconsented lifecycle mutation safe.
Evidence
package.jsonscripts/prune-codex-runtime-binary.mjsscripts/prune-claude-runtime-binary.mjsscripts/prune-claude-sdk-deps.mjsdist/cli/index.mjscontext-integration/codex/plugins/first-tree-context/hooks/hooks.jsonnode_modules/@openai/codex-*/node_modules/@anthropic-ai/claude-agent-sdk-*/node_modules/@anthropic-ai/sdk/node_modules/@modelcontextprotocol/sdk/
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs three scripts via postinstall.
- scripts/prune-codex-runtime-binary.mjs recursively deletes @openai/codex-* during global install.
- scripts/prune-claude-runtime-binary.mjs recursively deletes @anthropic-ai/claude-agent-sdk-* during global install.
- scripts/prune-claude-sdk-deps.mjs deletes two other installed Claude SDK peer packages.
Evidence against
- Pruning is limited to npm global installs and has opt-out environment variables.
- Inspected lifecycle scripts make no network requests or credential reads.
- Context plugin hooks invoke first-tree commands only after explicit context activation.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
17 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/connect-token-CneThoZJ.mjsView file
18import { accessSync, appendFileSync, chmodSync, closeSync, constants, createReadStream, createWriteStream, existsSync, fchmodSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirS...
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
...
L65: *
L66: * @private
L67: * @param {Error} err
...
L883: for (var i = 0; i < flen;) {
L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L885: lastPos = lastPos > -1 ? lastPos : 0;
Findings
3 Critical12 High5 Medium4 Low
CriticalCredential Exfiltrationdist/connect-token-CneThoZJ.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/connect-token-CneThoZJ.mjs
CriticalPrevious Version Dangerous Deltadist/connect-token-CneThoZJ.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/connect-token-CneThoZJ.mjs
HighShelldist/connect-token-CneThoZJ.mjs
HighCredential Redirect Persistencedist/connect-token-CneThoZJ.mjs
HighEntrypoint Foreign Package Code Overwritedist/connect-token-CneThoZJ.mjs
HighCommand Output Exfiltrationdist/connect-token-CneThoZJ.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/connect-token-CneThoZJ.mjs
Affected versions and remediation
This report applies to first-tree@0.5.20.
The versions list below shows the verdict for each recorded version.
- Avoid installing first-tree@0.5.20. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.