registry / AI-agent capability abuse / first-tree-staging / 0.5.19-staging.1059.1

first-tree-staging@0.5.19-staging.1059.1

First Tree — unified CLI for Context Tree onboarding, agent management, and team messaging. (Source-tree dev build; CI rewrites `name` and `bin` for prod / staging publishes — see docs/local-dev-isolation.md.)

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

No concrete unconsented install-time exfiltration or foreign AI-agent control-surface mutation was found. The explicit persistent agent-plugin setup remains a dangerous capability appropriate for a warning.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

User runs `first-tree context enable` with a confirmed persistent scope; later provider SessionStart events.

Impact

The plugin can route session context to the configured First Tree service and affect participating agent sessions.

Mechanism

user-authorized coding-agent plugin installation and session hook activation

AI rationale

Evidence

package.jsondist/cli/index.mjsdist/connect-token-dL-Y1oNU.mjscontext-integration/codex/plugins/first-tree-context/hooks/hooks.jsoncontext-integration/claude-code/plugins/first-tree-context/hooks/hooks.jsoncontext-integration/codex/plugins/first-tree-context/bin/context-session-startcontext-integration/claude-code/plugins/first-tree-context/bin/context-session-startscripts/prune-codex-runtime-binary.mjsscripts/prune-claude-runtime-binary.mjsscripts/prune-claude-sdk-deps.mjs

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Explicit `context enable` installs and enables a Codex/Claude plugin.
Plugin SessionStart hooks invoke `context activate` on future agent sessions.
Runtime materializes AGENTS.md/CLAUDE.md in its managed agent workspace.
postinstall deletes selected global SDK runtime/dependency packages.

Evidence against

No lifecycle hook installs agent plugins or sends credentials.
Context enable requires provider, team, scope, plan ID, and `--yes`.
Codex hook setup requires the provider to report the plugin enabled/trusted.
Postinstall is global-install guarded and limits deletion to named SDK packages.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

13 flagged

package.jsonView file

Lines 29-69json

29 "dist",

30 "context-integration",

31 "skills",

32 "scripts/prune-codex-runtime-binary.mjs",

33 "scripts/prune-claude-runtime-binary.mjs",

34 "scripts/prune-claude-sdk-deps.mjs",

35 "README.md",

36 "LICENSE"

37 ],

38 "publishConfig": {

39 "access": "public"

40 },

41 "scripts": {

42 "dev": "tsx src/cli/index.ts",

43 "build": "tsdown src/cli/index.ts src/index.ts --format esm --no-dts --external @anthropic-ai/claude-agent-sdk --external @botiverse/kimi-code-sdk --external @openai/codex-sdk --external fs-native-extensions && node ../../scripts/copy-client-runtime-templates.mjs apps/cli && node ../../scripts/copy-cli-tree-templates.mjs && node ../../scripts/build-context-integration-bundle.mjs --out-dir context-integration",

44 "typecheck": "tsc --noEmit",

45 "test": "node scripts/run-vitest-batches.mjs",

46 "coverage": "pnpm run build && vitest run --coverage --passWithNoTests",

47 "prepack": "rm -rf skills && cp -R ../../skills . && node scripts/materialize-bundled-deps.mjs prepare",

48 "postpack": "node scripts/materialize-bundled-deps.mjs restore && rm -rf skills context-integration",

49 "postinstall": "node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L49

50 },

51 "license": "Apache-2.0",

52 "bundleDependencies": [

53 "@botiverse/kimi-code-sdk"

54 ],

55 "repository": {

56 "type": "git",

57 "url": "https://github.com/agent-team-foundation/first-tree.git",

58 "directory": "apps/cli"

59 },

60 "engines": {

61 "node": ">=22.13.0"

62 },

63 "dependencies": {

64 "@anthropic-ai/claude-agent-sdk": "^0.3.187",

65 "@botiverse/kimi-code-sdk": "0.26.0-botiverse.2",

66 "@antfu/utils": "^9.3.0",

67 "@inquirer/prompts": "^8.3.0",

68 "@openai/codex-sdk": "^0.144.1",

69 "commander": "^13.1.0",

dist/cli/index.mjsView file

Lines 1-29javascript

1#!/usr/bin/env node

2import { $ as planMarkdownImport, $n as ensureFreshAccessToken, $r as flushClientSentry, $t as stopClientService, An as contextIntegrationReleaseManifestSchema, Ar as setConfigValue, At as readContextReviewConfig, B as resolveMemberOrganizationId, Bn as documentContextSchema, Br as SessionRegistry, Bt as readRememberedLocalClientIdForAccount, Cn as classifyContextTreeSetting, Cr as defaultHome, Ct as InvalidContextTreeBindingInputError, Dn

dist/connect-token-dL-Y1oNU.mjsView file

•A module-load call serializes the broad process environment, working directory, and command-line arguments and posts them to a literal external destination. dist/connect-token-dL-Y1oNU.mjs: * Internal method that keeps a track of which error we have already added, to avoid circular recursion * Internal method that keeps a track of which error we have already added, to avoid circular recursion method: { _req.method = req.method; const { paths = [], censor = "[REDACTED]", serialize = JSON.stringify, strict = true, remove = false } = options; return JSON.stringify(cloned); const writeSym = Symbol("pino.write"); const endSym = Symbol("pino.end");

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/connect-token-dL-Y1oNU.mjsView on unpkg

18import { accessSync, appendFileSync, chmodSync, closeSync, constants, createReadStream, createWriteStream, existsSync, fchmodSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirS... L19: import * as http from "node:http"; L20: import * as https from "node:https"; ... L22: import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util$2 from "node:util"; ... L65: * L66: * @private L67: * @param {Error} err ... L883: for (var i = 0; i < flen;) { L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) { L885: lastPos = lastPos > -1 ? lastPos : 0;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/connect-token-dL-Y1oNU.mjsView on unpkg · L18

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli/index.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = first-tree-staging@0.5.19-staging.1008.1 matchedIdentity = npm:Zmlyc3QtdHJlZS1zdGFnaW5n:0.5.19-staging.1008.1 similarity = 0.769 summary = stored previous version shares package body but lacks this dangerous source file

Findings

5 Critical6 High5 Medium4 Low

CriticalHardcoded Runtime Data Exfiltrationdist/connect-token-dL-Y1oNU.mjs

CriticalCredential Exfiltrationdist/connect-token-dL-Y1oNU.mjs

CriticalCommand Output Exfiltrationdist/connect-token-dL-Y1oNU.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/connect-token-dL-Y1oNU.mjs

CriticalPrevious Version Dangerous Deltadist/cli/index.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/cli/index.mjs

HighShelldist/cli/index.mjs

HighTrigger Reachable Credential Exfiltrationdist/connect-token-dL-Y1oNU.mjs

HighTrigger Reachable Persistencedist/connect-token-dL-Y1oNU.mjs

High

Affected versions and remediation

This report applies to first-tree-staging@0.5.19-staging.1059.1.

See all versions of first-tree-staging for other recorded verdicts.

Review the evidence and your use of first-tree-staging@0.5.19-staging.1059.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-04 12:49:18.453Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code