registry / first-tree-staging / 0.5.16-staging.888.1

first-tree-staging@0.5.16-staging.888.1

First Tree — unified CLI for Context Tree onboarding, agent management, and team messaging. (Source-tree dev build; CI rewrites `name` and `bin` for prod / staging publishes — see docs/local-dev-isolation.md.)

Static Scan Results

scanned 3mo ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 12 file(s), 617 KB of source, external domains: github.com

Oversized source lightweight scan

dist/connect-token-DM-cFK-M.mjs2.64 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoShellWebSocketHighEntropyStringsUrlStringsgithub.com

Source & flagged code

6 flagged

package.jsonView file

Lines 28-68json

28 "files": [

29 "dist",

30 "skills",

31 "scripts/prune-codex-runtime-binary.mjs",

32 "scripts/prune-claude-runtime-binary.mjs",

33 "scripts/prune-claude-sdk-deps.mjs",

34 "README.md",

35 "LICENSE"

36 ],

37 "publishConfig": {

38 "access": "public"

39 },

40 "scripts": {

41 "dev": "tsx src/cli/index.ts",

42 "build": "tsdown src/cli/index.ts src/index.ts --format esm --no-dts --external @anthropic-ai/claude-agent-sdk --external @botiverse/kimi-code-sdk --external @openai/codex-sdk && node ../../scripts/copy-client-runtime-templates.mjs apps/cli && node ../../scripts/copy-cli-tree-templates.mjs",

43 "typecheck": "tsc --noEmit",

44 "test": "node scripts/run-vitest-batches.mjs",

45 "coverage": "pnpm run build && vitest run --coverage --passWithNoTests",

46 "prepack": "rm -rf skills && cp -R ../../skills .",

47 "postpack": "rm -rf skills",

48 "postinstall": "node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L48

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L48

49 },

50 "license": "Apache-2.0",

51 "repository": {

52 "type": "git",

53 "url": "https://github.com/agent-team-foundation/first-tree.git",

54 "directory": "apps/cli"

55 },

56 "engines": {

57 "node": ">=22.13.0"

58 },

59 "dependencies": {

60 "@anthropic-ai/claude-agent-sdk": "^0.3.187",

61 "@botiverse/kimi-code-sdk": "0.26.0-botiverse.2",

62 "@inquirer/prompts": "^8.3.0",

63 "@openai/codex-sdk": "^0.144.1",

64 "commander": "^13.1.0",

65 "ejs": "^6.0.1",

66 "gray-matter": "^4.0.3",

67 "jose": "^6.0.0",

68 "mdast-util-from-markdown": "^2.0.3",

dist/cli/index.mjsView file

Lines 1-27javascript

1#!/usr/bin/env node

2import { $t as loadCredentials, An as CLIENT_SENTRY_DSN, At as ClientRuntime, B as checkBackgroundService, Bn as buildMessageImageSnapshots, Bt as contextTreeBranchSchema, C as promptMissingFields, Cn as initConfig, Ct as restartClientService, Dn as resolveConfigReadonly, Dt as runWindowsSupervisorLoop, En as resetConfigMeta, F

dist/connect-token-DM-cFK-M.mjsView file

•path = dist/connect-token-DM-cFK-M.mjs kind = oversized_source_file sizeBytes = 2765271 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/connect-token-DM-cFK-M.mjsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli/index.mjsView file

7import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs"; L8: import { execFileSync } from "node:child_process"; L9: import { fileURLToPath } from "node:url";

High

Findings

5 High4 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/cli/index.mjs

HighShelldist/cli/index.mjs

HighSame File Env Network Executiondist/cli/index.mjs

HighOversized Source Filedist/connect-token-DM-cFK-M.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to first-tree-staging@0.5.16-staging.888.1.

See all versions of first-tree-staging for other recorded verdicts.

Review the evidence and your use of first-tree-staging@0.5.16-staging.888.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-17 09:33:45.438Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.