registry / first-tree-staging / 0.5.19-staging.1008.1
first-tree-staging@0.5.19-staging.1008.1
First Tree — unified CLI for Context Tree onboarding, agent management, and team messaging. (Source-tree dev build; CI rewrites `name` and `bin` for prod / staging publishes — see docs/local-dev-isolation.md.)
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe scanner’s command-output/exfiltration claim is not substantiated by the reviewed source; the large shared bundle contains normal CLI, SDK, and telemetry primitives. The package nevertheless has a real first-party agent-extension setup capability that merits a warning under the stated policy.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User invokes First Tree context-integration operations.
Impact
A user-authorized First Tree plugin can run at supported agent-session start and contact its configured service.
Mechanism
Provider CLI plugin installation and SessionStart hook activation.
AI rationale
The scanner’s command-output/exfiltration claim is not substantiated by the reviewed source; the large shared bundle contains normal CLI, SDK, and telemetry primitives. The package nevertheless has a real first-party agent-extension setup capability that merits a warning under the stated policy.
Evidence
package.jsondist/cli/index.mjsdist/connect-token-rPhey6FP.mjsscripts/prune-codex-runtime-binary.mjsscripts/prune-claude-runtime-binary.mjsscripts/prune-claude-sdk-deps.mjs
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/cli/index.mjs installs the first-tree-context plugin into Codex or Claude Code via provider CLI commands.
- The plugin has a SessionStart activation bridge that contacts a configured First Tree server.
- package.json postinstall deletes selected Codex/Claude SDK dependency packages during global installs.
Evidence against
- Plugin installation is part of explicit context-integration operations, not the npm lifecycle hook.
- Provider installs are named first-tree-context, validated, journaled, and rollback-aware.
- Postinstall scripts require npm_config_global=true and target enumerated SDK packages only.
- No install-time network, credential harvesting, shell payload, or foreign AI-agent config mutation was found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinified
Source & flagged code
9 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/connect-token-rPhey6FP.mjsView file
18import { accessSync, appendFileSync, chmodSync, closeSync, constants, createReadStream, createWriteStream, existsSync, fsyncSync, linkSync, lstatSync, mkdirSync, mkdtempSync, openS...
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
...
L61: *
L62: * @private
L63: * @param {Error} err
...
L879: for (var i = 0; i < flen;) {
L880: if (f.charCodeAt(i) === 37 && i + 1 < flen) {
L881: lastPos = lastPos > -1 ? lastPos : 0;
Findings
3 Critical4 High5 Medium4 Low
CriticalCommand Output Exfiltrationdist/connect-token-rPhey6FP.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/connect-token-rPhey6FP.mjs
CriticalPrevious Version Dangerous Deltadist/cli/index.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/connect-token-rPhey6FP.mjs
HighShelldist/connect-token-rPhey6FP.mjs
HighRuntime Package Installdist/connect-token-rPhey6FP.mjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/connect-token-rPhey6FP.mjs
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to first-tree-staging@0.5.19-staging.1008.1.
See all versions of first-tree-staging for other recorded verdicts.
- Review the evidence and your use of first-tree-staging@0.5.19-staging.1008.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.