Loading npm security reports…

first-tree-staging@0.5.20-staging.1142.1: Suspicious npm security | LPM Firewall

registry / first-tree-staging / 0.5.20-staging.1142.1

first-tree-staging@0.5.20-staging.1142.1

First Tree — unified CLI for Context Tree onboarding, agent management, and team messaging. (Source-tree dev build; CI rewrites `name` and `bin` for prod / staging publishes — see docs/local-dev-isolation.md.)

AI Security Review

scanned 9d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Explicit First Tree context setup can install and enable its `first-tree-context` extension for Codex or Claude Code. Login exchanges a user-provided code with the configured staging service.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

User runs `first-tree-staging context enable` or `first-tree-staging login <code>`.

Impact

The extension gains the capabilities granted by the selected coding-agent platform; credentials are sent only to the configured First Tree service during login.

Mechanism

User-invoked agent-plugin installation and authenticated service connection.

Rationale

Not malicious: the scanner's credential-exfiltration conclusion conflates intended authenticated CLI traffic with harvesting. Warn because the package deliberately provisions a persistent coding-agent extension when explicitly invoked.

Evidence

package.jsondist/cli/index.mjsdist/connect-token-D2wTjPuj.mjsscripts/prune-codex-runtime-binary.mjsscripts/prune-claude-runtime-binary.mjsscripts/prune-claude-sdk-deps.mjs

Network endpoints1

dev.cloud.first-tree.ai

Decision evidence

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli/index.mjsView file

9import { chmodSync, closeSync, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, w... L10: import { execFileSync, spawn } from "node:child_process"; L11: import { createInterface } from "node:readline";

High

Child Process

Package source references child process execution.

dist/cli/index.mjsView on unpkg · L9

7791print.line(" If you need to restart the inline daemon:\n"); L7792: print.line(` stop the PowerShell running \`${channelConfig.binName} daemon start\` with Ctrl+C,\n`); L7793: print.line(` then run \`${channelConfig.binName} daemon start\` again.\n\n`);

High

Shell

Package source references shell execution.

dist/cli/index.mjsView on unpkg · L7791

dist/connect-token-D2wTjPuj.mjsView file

•A module-load call serializes the broad process environment, working directory, and command-line arguments and posts them to a literal external destination. dist/connect-token-D2wTjPuj.mjs: * Internal method that keeps a track of which error we have already added, to avoid circular recursion * Internal method that keeps a track of which error we have already added, to avoid circular recursion method: { _req.method = req.method; const { paths = [], censor = "[REDACTED]", serialize = JSON.stringify, strict = true, remove = false } = options; return JSON.stringify(cloned); const writeSym = Symbol("pino.write"); const endSym = Symbol("pino.end");

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/connect-token-D2wTjPuj.mjsView on unpkg

18import { accessSync, appendFileSync, chmodSync, closeSync, constants, createReadStream, createWriteStream, existsSync, fchmodSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirS... L19: import * as http from "node:http"; L20: import * as https from "node:https"; ... L22: import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util$2 from "node:util"; ... L65: * L66: * @private L67: * @param {Error} err ... L883: for (var i = 0; i < flen;) { L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) { L885: lastPos = lastPos > -1 ? lastPos : 0;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/connect-token-D2wTjPuj.mjsView on unpkg · L18