registry / first-tree-staging / 0.5.17-staging.927.1

first-tree-staging@0.5.17-staging.927.1

First Tree — unified CLI for Context Tree onboarding, agent management, and team messaging. (Source-tree dev build; CI rewrites `name` and `bin` for prod / staging publishes — see docs/local-dev-isolation.md.)

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The scanner conflates bundled SDK/Sentry code and explicit maintenance commands with malicious behavior. Source shows scoped, global-install-only pruning and explicit runtime installation, without a concrete malicious chain.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm global install; explicit daemon install-codex or daemon install-claude command

Impact

May remove bundled/unused runtime dependencies from this package's global dependency tree; no exfiltration or foreign agent-control mutation confirmed.

Mechanism

Guarded dependency pruning and user-invoked runtime installation

AI rationale

Evidence

package.jsonscripts/prune-codex-runtime-binary.mjsscripts/prune-claude-runtime-binary.mjsscripts/prune-claude-sdk-deps.mjsdist/cli/index.mjsdist/connect-token-D1b-ZEWH.mjs

Network endpoints1

5d27fb42311f9f8764ccc38823ee3ff4@o4510502633209856.ingest.us.sentry.io/4511646359486464

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with medium false-positive risk.

Evidence for AI clean decision

package.json runs three postinstall pruning scripts.
Pruning scripts delete selected SDK runtime/dependency directories only during global installs.

Evidence against

scripts/prune-*.mjs skip local installs and source workspaces.
Runtime installation is only exposed by explicit daemon install-claude/install-codex CLI commands.
No source evidence of credential harvesting, command-output exfiltration, remote payload execution, or agent-config hijacking.
dist/connect-token-D1b-ZEWH.mjs configures Sentry redaction for tokens, prompts, command output, and local paths.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 12 file(s), 654 KB of source, external domains: github.com

Source & flagged code

9 flagged

package.jsonView file

Lines 28-68json

28 "files": [

29 "dist",

30 "skills",

31 "scripts/prune-codex-runtime-binary.mjs",

32 "scripts/prune-claude-runtime-binary.mjs",

33 "scripts/prune-claude-sdk-deps.mjs",

34 "README.md",

35 "LICENSE"

36 ],

37 "publishConfig": {

38 "access": "public"

39 },

40 "scripts": {

41 "dev": "tsx src/cli/index.ts",

42 "build": "tsdown src/cli/index.ts src/index.ts --format esm --no-dts --external @anthropic-ai/claude-agent-sdk --external @botiverse/kimi-code-sdk --external @openai/codex-sdk && node ../../scripts/copy-client-runtime-templates.mjs apps/cli && node ../../scripts/copy-cli-tree-templates.mjs",

43 "typecheck": "tsc --noEmit",

44 "test": "node scripts/run-vitest-batches.mjs",

45 "coverage": "pnpm run build && vitest run --coverage --passWithNoTests",

46 "prepack": "rm -rf skills && cp -R ../../skills .",

47 "postpack": "rm -rf skills",

48 "postinstall": "node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L48

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L48

49 },

50 "license": "Apache-2.0",

51 "repository": {

52 "type": "git",

53 "url": "https://github.com/agent-team-foundation/first-tree.git",

54 "directory": "apps/cli"

55 },

56 "engines": {

57 "node": ">=22.13.0"

58 },

59 "dependencies": {

60 "@anthropic-ai/claude-agent-sdk": "^0.3.187",

61 "@botiverse/kimi-code-sdk": "0.26.0-botiverse.2",

62 "@inquirer/prompts": "^8.3.0",

63 "@openai/codex-sdk": "^0.144.1",

64 "commander": "^13.1.0",

65 "ejs": "^6.0.1",

66 "gray-matter": "^4.0.3",

67 "jose": "^6.0.0",

68 "mdast-util-from-markdown": "^2.0.3",

dist/connect-token-D1b-ZEWH.mjsView file

18import { parse, stringify } from "yaml"; L19: import * as http from "node:http"; L20: import * as https from "node:https"; ... L22: import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util from "node:util"; ... L60: * L61: * @private L62: * @param {Error} err ... L878: for (var i = 0; i < flen;) { L879: if (f.charCodeAt(i) === 37 && i + 1 < flen) { L880: lastPos = lastPos > -1 ? lastPos : 0;

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/connect-token-D1b-ZEWH.mjsView on unpkg · L18

18Trigger-reachable chain: manifest.exports -> dist/index.mjs -> dist/connect-token-D1b-ZEWH.mjs L18: import { parse, stringify } from "yaml"; L19: import * as http from "node:http"; L20: import * as https from "node:https"; ... L22: import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util from "node:util"; ... L60: * L61: * @private L62: * @param {Error} err ... L878: for (var i = 0; i < flen;) { L879: if (f.charCodeAt(i) === 37 && i + 1 < flen) { L880: lastPos = lastPos > -1 ? lastPos : 0;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/connect-token-D1b-ZEWH.mjsView on unpkg · L18

22import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util from "node:util";

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/connect-token-D1b-ZEWH.mjsView file

Findings

2 Critical5 High5 Medium4 Low

CriticalCommand Output Exfiltrationdist/connect-token-D1b-ZEWH.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/connect-token-D1b-ZEWH.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/connect-token-D1b-ZEWH.mjs

HighShelldist/connect-token-D1b-ZEWH.mjs

HighLoopback Host Fingerprint Telemetrydist/connect-token-D1b-ZEWH.mjs

HighRuntime Package Installdist/connect-token-D1b-ZEWH.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/connect-token-D1b-ZEWH.mjs

Medium

Affected versions and remediation

This report applies to first-tree-staging@0.5.17-staging.927.1.

See all versions of first-tree-staging for other recorded verdicts.

Review the evidence and your use of first-tree-staging@0.5.17-staging.927.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-23 11:13:03.628Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.