registry / first-tree-staging / 0.5.19-staging.1084.1

first-tree-staging@0.5.19-staging.1084.1

First Tree — unified CLI for Context Tree onboarding, agent management, and team messaging. (Source-tree dev build; CI rewrites `name` and `bin` for prod / staging publishes — see docs/local-dev-isolation.md.)

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The scanner's exfiltration claim is not supported by the inspected source: the flagged bundle contains normal First Tree CLI, credential, telemetry, and runtime code. The install-time deletion is narrowly guarded to this package's global dependency tree and is not an AI-agent control-surface hijack.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm global install; explicit CLI/daemon commands

Impact

Reduces global install footprint; no unconsented credential or command-output exfiltration found.

Mechanism

guarded dependency pruning and authenticated CLI service calls

AI rationale

Evidence

package.jsonscripts/prune-codex-runtime-binary.mjsscripts/prune-claude-runtime-binary.mjsscripts/prune-claude-sdk-deps.mjsdist/cli/index.mjsdist/connect-token-BFD3xPyQ.mjs

Network endpoints2

dev.cloud.first-tree.ai5d27fb42311f9f8764ccc38823ee3ff4@o4510502633209856.ingest.us.sentry.io/4511646359486464

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json has a postinstall hook that removes bundled runtime dependencies on global installs.
dist/connect-token-BFD3xPyQ.mjs enables Sentry telemetry for explicit daemon startup.

Evidence against

All three postinstall scripts exit unless npm_config_global=true and target only named transitive runtime packages.
Lifecycle scripts make no network requests and contain no credential collection.
Telemetry is initialized only in the daemon-start command and scrubs request, exception, context, and breadcrumb data.
Token helpers persist credentials locally and use them as Authorization headers for the configured First Tree server.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

Source & flagged code

12 flagged

package.jsonView file

Lines 29-69json

29 "dist",

30 "context-integration",

31 "skills",

32 "scripts/prune-codex-runtime-binary.mjs",

33 "scripts/prune-claude-runtime-binary.mjs",

34 "scripts/prune-claude-sdk-deps.mjs",

35 "README.md",

36 "LICENSE"

37 ],

38 "publishConfig": {

39 "access": "public"

40 },

41 "scripts": {

42 "dev": "tsx src/cli/index.ts",

43 "build": "tsdown src/cli/index.ts src/index.ts --format esm --no-dts --external @anthropic-ai/claude-agent-sdk --external @botiverse/kimi-code-sdk --external @openai/codex-sdk --external fs-native-extensions && node ../../scripts/copy-client-runtime-templates.mjs apps/cli && node ../../scripts/copy-cli-tree-templates.mjs && node ../../scripts/build-context-integration-bundle.mjs --out-dir context-integration",

44 "typecheck": "tsc --noEmit",

45 "test": "node scripts/run-vitest-batches.mjs",

46 "coverage": "pnpm run build && vitest run --coverage --passWithNoTests",

47 "prepack": "rm -rf skills && cp -R ../../skills . && node scripts/materialize-bundled-deps.mjs prepare",

48 "postpack": "node scripts/materialize-bundled-deps.mjs restore && rm -rf skills context-integration",

49 "postinstall": "node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L49

50 },

51 "license": "Apache-2.0",

52 "bundleDependencies": [

53 "@botiverse/kimi-code-sdk"

54 ],

55 "repository": {

56 "type": "git",

57 "url": "https://github.com/agent-team-foundation/first-tree.git",

58 "directory": "apps/cli"

59 },

60 "engines": {

61 "node": ">=22.13.0"

62 },

63 "dependencies": {

64 "@anthropic-ai/claude-agent-sdk": "^0.3.187",

65 "@botiverse/kimi-code-sdk": "0.26.0-botiverse.2",

66 "@antfu/utils": "^9.3.0",

67 "@inquirer/prompts": "^8.3.0",

68 "@openai/codex-sdk": "^0.144.1",

69 "commander": "^13.1.0",

dist/connect-token-BFD3xPyQ.mjsView file

•A module-load call serializes the broad process environment, working directory, and command-line arguments and posts them to a literal external destination. dist/connect-token-BFD3xPyQ.mjs: * Internal method that keeps a track of which error we have already added, to avoid circular recursion * Internal method that keeps a track of which error we have already added, to avoid circular recursion method: { _req.method = req.method; const { paths = [], censor = "[REDACTED]", serialize = JSON.stringify, strict = true, remove = false } = options; return JSON.stringify(cloned); const writeSym = Symbol("pino.write"); const endSym = Symbol("pino.end");

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/connect-token-BFD3xPyQ.mjsView on unpkg

18import { accessSync, appendFileSync, chmodSync, closeSync, constants, createReadStream, createWriteStream, existsSync, fchmodSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirS... L19: import * as http from "node:http"; L20: import * as https from "node:https"; ... L22: import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util$2 from "node:util"; ... L65: * L66: * @private L67: * @param {Error} err ... L883: for (var i = 0; i < flen;) { L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) { L885: lastPos = lastPos > -1 ? lastPos : 0;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/connect-token-BFD3xPyQ.mjsView on unpkg · L18

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/connect-token-BFD3xPyQ.mjsView file

Findings

4 Critical6 High5 Medium4 Low

CriticalHardcoded Runtime Data Exfiltrationdist/connect-token-BFD3xPyQ.mjs

CriticalCredential Exfiltrationdist/connect-token-BFD3xPyQ.mjs

CriticalCommand Output Exfiltrationdist/connect-token-BFD3xPyQ.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/connect-token-BFD3xPyQ.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/connect-token-BFD3xPyQ.mjs

HighShelldist/connect-token-BFD3xPyQ.mjs

HighTrigger Reachable Credential Exfiltrationdist/connect-token-BFD3xPyQ.mjs

HighTrigger Reachable Persistencedist/connect-token-BFD3xPyQ.mjs

HighRuntime Package Installdist/connect-token-BFD3xPyQ.mjs

Affected versions and remediation

This report applies to first-tree-staging@0.5.19-staging.1084.1.

See all versions of first-tree-staging for other recorded verdicts.

Review the evidence and your use of first-tree-staging@0.5.19-staging.1084.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-05 21:09:41.911Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.