registry / first-tree-staging / 0.5.17-staging.926.1
first-tree-staging@0.5.17-staging.926.1
First Tree — unified CLI for Context Tree onboarding, agent management, and team messaging. (Source-tree dev build; CI rewrites `name` and `bin` for prod / staging publishes — see docs/local-dev-isolation.md.)
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package has a real, persistent AI-agent workspace bootstrap surface, warranting a warning. Its postinstall behavior is scoped global dependency pruning, and the scanner's claimed exfiltration was not supported by the inspected source.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Starting or resuming a First Tree-managed agent session
Impact
A First Tree session can persist its runtime contract and bundled skills in the selected workspace.
Mechanism
first-party agent workspace bootstrap and instruction-file installation
AI rationale
The package has a real, persistent AI-agent workspace bootstrap surface, warranting a warning. Its postinstall behavior is scoped global dependency pruning, and the scanner's claimed exfiltration was not supported by the inspected source.
Evidence
package.jsonscripts/prune-codex-runtime-binary.mjsscripts/prune-claude-runtime-binary.mjsscripts/prune-claude-sdk-deps.mjsdist/connect-token-Bg4vCnQM.mjsAGENTS.mdCLAUDE.md.first-tree-workspace/identity.json.agents/skills/
Network endpoints3
localhost:8000download.first-tree.ai/releasesregistry.npmjs.org
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/connect-token-Bg4vCnQM.mjs writes workspace AGENTS.md and CLAUDE.md.
- Runtime bootstrap installs bundled skills under .agents/skills and manages workspace state.
- Embedded runtime contract instructs agents to use its chat CLI and describes PR completion behavior.
- These mutations occur when a First Tree agent session starts/resumes, not at npm install.
Evidence against
- package.json postinstall only invokes three pruning scripts.
- Pruning scripts require npm_config_global=true and remove named bundled SDK dependencies only.
- No source evidence that postinstall performs network access, credential harvesting, or agent-control writes.
- Scanner's alleged command-output/loopback exfiltration was not confirmed; loopback and host-fingerprint matches are bundled observability code.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/connect-token-Bg4vCnQM.mjsView file
18import { parse, stringify } from "yaml";
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util from "node:util";
...
L60: *
L61: * @private
L62: * @param {Error} err
...
L878: for (var i = 0; i < flen;) {
L879: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L880: lastPos = lastPos > -1 ? lastPos : 0;
Findings
3 Critical5 High5 Medium4 Low
CriticalCommand Output Exfiltrationdist/connect-token-Bg4vCnQM.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/connect-token-Bg4vCnQM.mjs
CriticalPrevious Version Dangerous Deltadist/cli/index.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/connect-token-Bg4vCnQM.mjs
HighShelldist/connect-token-Bg4vCnQM.mjs
HighLoopback Host Fingerprint Telemetrydist/connect-token-Bg4vCnQM.mjs
HighRuntime Package Installdist/connect-token-Bg4vCnQM.mjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistence
Affected versions and remediation
This report applies to first-tree-staging@0.5.17-staging.926.1.
See all versions of first-tree-staging for other recorded verdicts.
- Review the evidence and your use of first-tree-staging@0.5.17-staging.926.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.