registry / AI-agent control-surface risk / first-tree-staging

first-tree-staging

First Tree — unified CLI for Context Tree onboarding, agent management, and team messaging. (Source-tree dev build; CI rewrites `name` and `bin` for prod / staging publishes — see docs/local-dev-isolation.md.)

This report shows the evidence for first-tree-staging@0.5.19-staging.1098.1. 1 of 135 known versions is blocked or flagged. The newest version, 0.5.24-staging.1243.1, is allowed. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The confirmed postinstall deletion of foreign Codex and Claude runtime dependencies meets the install-time AI-agent control-surface mutation block boundary. Scanner claims about runtime exfiltration were not needed for this verdict.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm install -g first-tree-staging

Impact

Can disable or alter globally installed Codex/Claude agent runtimes and SDK dependencies.

Mechanism

postinstall resolves and recursively deletes foreign AI-agent runtime dependency directories

Policy narrative

On a global installation, postinstall scripts resolve package roots from the global node_modules hierarchy and recursively delete OpenAI Codex platform packages, Anthropic Claude platform packages, and Claude SDK peer packages. The deletion occurs automatically without an explicit First Tree command and targets foreign AI-agent runtime components.

AI rationale

Evidence

package.jsonscripts/prune-codex-runtime-binary.mjsscripts/prune-claude-runtime-binary.mjsscripts/prune-claude-sdk-deps.mjs

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs three scripts in postinstall.
scripts/prune-codex-runtime-binary.mjs deletes resolved @openai/codex-* package roots during global installs.
scripts/prune-claude-runtime-binary.mjs deletes resolved @anthropic-ai/claude-agent-sdk-* roots during global installs.
scripts/prune-claude-sdk-deps.mjs also removes third-party SDK peer package roots.

Evidence against

Pruning is skipped outside global installs and can be disabled by environment flags.
No lifecycle-script network or credential-exfiltration behavior was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 12 file(s), 895 KB of source, external domains: github.com

Source & flagged code

13 flagged

package.jsonView file

Lines 29-69json

29 "dist",

30 "context-integration",

31 "skills",

32 "scripts/prune-codex-runtime-binary.mjs",

33 "scripts/prune-claude-runtime-binary.mjs",

34 "scripts/prune-claude-sdk-deps.mjs",

35 "README.md",

36 "LICENSE"

37 ],

38 "publishConfig": {

39 "access": "public"

40 },

41 "scripts": {

42 "dev": "tsx src/cli/index.ts",

43 "build": "tsdown src/cli/index.ts src/index.ts --format esm --no-dts --external @anthropic-ai/claude-agent-sdk --external @botiverse/kimi-code-sdk --external @openai/codex-sdk --external fs-native-extensions && node ../../scripts/copy-client-runtime-templates.mjs apps/cli && node ../../scripts/copy-cli-tree-templates.mjs && node ../../scripts/build-context-integration-bundle.mjs --out-dir context-integration",

44 "typecheck": "tsc --noEmit",

45 "test": "node scripts/run-vitest-batches.mjs",

46 "coverage": "pnpm run build && vitest run --coverage --passWithNoTests",

47 "prepack": "rm -rf skills && cp -R ../../skills . && node scripts/materialize-bundled-deps.mjs prepare",

48 "postpack": "node scripts/materialize-bundled-deps.mjs restore && rm -rf skills context-integration",

49 "postinstall": "node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L49

50 },

51 "license": "Apache-2.0",

52 "bundleDependencies": [

53 "@botiverse/kimi-code-sdk"

54 ],

55 "repository": {

56 "type": "git",

57 "url": "https://github.com/agent-team-foundation/first-tree.git",

58 "directory": "apps/cli"

59 },

60 "engines": {

61 "node": ">=22.13.0"

62 },

63 "dependencies": {

64 "@anthropic-ai/claude-agent-sdk": "^0.3.187",

65 "@botiverse/kimi-code-sdk": "0.26.0-botiverse.2",

66 "@antfu/utils": "^9.3.0",

67 "@inquirer/prompts": "^8.3.0",

68 "@openai/codex-sdk": "^0.144.1",

69 "commander": "^13.1.0",

dist/cli/index.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = first-tree-staging@0.5.19-staging.1087.1 matchedIdentity = npm:Zmlyc3QtdHJlZS1zdGFnaW5n:0.5.19-staging.1087.1 similarity = 0.875 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/index.mjsView on unpkg

9import { chmodSync, closeSync, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, w... L10: import { execFileSync, spawn } from "node:child_process"; L11: import { createInterface } from "node:readline";

High

Child Process

Package source references child process execution.

dist/cli/index.mjsView on unpkg · L9

7894print.line(" If you need to restart the inline daemon:\n"); L7895: print.line(` stop the PowerShell running \`${channelConfig.binName} daemon start\` with Ctrl+C,\n`); L7896: print.line(` then run \`${channelConfig.binName} daemon start\` again.\n\n`);

High

Shell

Package source references shell execution.

dist/cli/index.mjsView on unpkg · L7894

dist/connect-token-DteeikB-.mjsView file

•A module-load call serializes the broad process environment, working directory, and command-line arguments and posts them to a literal external destination. dist/connect-token-DteeikB-.mjs: * Internal method that keeps a track of which error we have already added, to avoid circular recursion * Internal method that keeps a track of which error we have already added, to avoid circular recursion method: { _req.method = req.method; const { paths = [], censor = "[REDACTED]", serialize = JSON.stringify, strict = true, remove = false } = options; return JSON.stringify(cloned); const writeSym = Symbol("pino.write"); const endSym = Symbol("pino.end");

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/connect-token-DteeikB-.mjsView on unpkg

18import { accessSync, appendFileSync, chmodSync, closeSync, constants, createReadStream, createWriteStream, existsSync, fchmodSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirS... L19: import * as http from "node:http"; L20: import * as https from "node:https"; ... L22: import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util$2 from "node:util"; ... L65: * L66: * @private L67: * @param {Error} err ... L883: for (var i = 0; i < flen;) { L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) { L885: lastPos = lastPos > -1 ? lastPos : 0;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/connect-token-DteeikB-.mjsView on unpkg · L18

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli/index.mjsView file

Findings

5 Critical6 High5 Medium4 Low

CriticalHardcoded Runtime Data Exfiltrationdist/connect-token-DteeikB-.mjs

CriticalCredential Exfiltrationdist/connect-token-DteeikB-.mjs

CriticalCommand Output Exfiltrationdist/connect-token-DteeikB-.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/connect-token-DteeikB-.mjs

CriticalPrevious Version Dangerous Deltadist/cli/index.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/cli/index.mjs

HighShelldist/cli/index.mjs

HighTrigger Reachable Credential Exfiltrationdist/connect-token-DteeikB-.mjs

HighTrigger Reachable Persistencedist/connect-token-DteeikB-.mjs

High

Affected versions and remediation

This report applies to first-tree-staging@0.5.19-staging.1098.1.

The versions list below shows the verdict for each recorded version.

Avoid installing first-tree-staging@0.5.19-staging.1098.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-06 13:26:45.748Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

135 known versions

0.5.24-staging.1243.1latestManual Review—AllowUnder ReviewOct 11, 2026, 11:46 AM 0.5.24-staging.1242.1Manual Review—AllowUnder ReviewOct 11, 2026, 9:35 AM 0.5.24-staging.1238.1SuspiciousAgent extension lifecycle riskWarnPublishedSep 21, 2026, 8:45 AM 0.5.23-staging.1236.1SuspiciousAgent extension lifecycle risk

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code