first-tree-staging@0.5.21-staging.1182.1: Suspicious npm security | LPM Firewall

Loading npm security reports…

first-tree-staging@0.5.21-staging.1182.1: Suspicious npm security | LPM Firewall

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli/index.mjsView file

9import { createHash, randomBytes, randomUUID } from "node:crypto"; L10: import { execFileSync, spawn } from "node:child_process"; L11: import { createInterface } from "node:readline";

High

Child Process

Package source references child process execution.

dist/cli/index.mjsView on unpkg · L9

7809print.line(" If you need to restart the inline daemon:\n"); L7810: print.line(` stop the PowerShell running \`${channelConfig.binName} daemon start\` with Ctrl+C,\n`); L7811: print.line(` then run \`${channelConfig.binName} daemon start\` again.\n\n`);

High

Shell

Package source references shell execution.

dist/cli/index.mjsView on unpkg · L7809

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/cli/index.mjs: import { chmodSync, closeSync, cpSync, createReadStream, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statS... import { chmod, mkdtemp, readFile as readFile$1, stat, writeFile } from "node:fs/promises"; * out of scope for this PR, tracked as follow-up #1069). writeFileSync(descriptor, `${process.pid}\n`, "utf8"); writeFileSync(tempPath, stringify(validated), { mode: 384 }); writeFileSync(backupPath, originalBytes, { writeFileSync(temporary, `${JSON.stringify(parsed, null, 2)}\n`, { mode: 384 }); writeFileSync(launcherPath, materializedFile(name, readFileSync(launch

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/cli/index.mjsView on unpkg

dist/connect-token-PM9gohpa.mjsView file

18import { URL as URL$1 } from "url"; L19: import * as http from "node:http"; L20: import * as https from "node:https"; ... L22: import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util$2 from "node:util"; ... L144: function formatPrettyEntry(json) { L145: const obj = JSON.parse(json); L146: const level = obj.level; ... L169: function createLoggerOutputStream(options) { L170: const getDest = options.getDestination ?? (() => process.stderr); L171: return new Writable({ write(chunk, _, callback) {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/connect-token-PM9gohpa.mjsView on unpkg · L18

18Trigger-reachable chain: manifest.exports -> dist/index.mjs -> dist/connect-token-PM9gohpa.mjs L18: import { URL as URL$1 } from "url"; L19: import * as http from "node:http"; L20: import * as https from "node:https"; ... L22: import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util$2 from "node:util"; ... L144: function formatPrettyEntry(json) { L145: const obj = JSON.parse(json); L146: const level = obj.level; ... L169: function createLoggerOutputStream(options) { L170: const getDest = options.getDestination ?? (() => process.stderr); L171: return new Writable({ write(chunk, _, callback) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/connect-token-PM9gohpa.mjsView on unpkg · L18

Source & flagged code

15 flagged

package.jsonView file

Lines 29-69json

29 "dist",

30 "context-integration",

31 "skills",

32 "scripts/prune-codex-runtime-binary.mjs",

33 "scripts/prune-claude-runtime-binary.mjs",

34 "scripts/prune-claude-sdk-deps.mjs",

35 "README.md",

36 "LICENSE"

37 ],

38 "publishConfig": {

39 "access": "public"

40 },

41 "scripts": {

42 "dev": "tsx src/cli/index.ts",

43 "build": "tsdown src/cli/index.ts src/index.ts --format esm --no-dts --external @anthropic-ai/claude-agent-sdk --external @botiverse/kimi-code-sdk --external @openai/codex-sdk --external fs-native-extensions && node ../../scripts/copy-client-runtime-templates.mjs apps/cli && node ../../scripts/copy-cli-tree-templates.mjs && node ../../scripts/build-context-integration-bundle.mjs --out-dir context-integration",

44 "typecheck": "tsc --noEmit",

45 "test": "node scripts/run-vitest-batches.mjs",

46 "coverage": "pnpm run build && vitest run --coverage --passWithNoTests",

47 "prepack": "rm -rf skills && cp -R ../../skills . && node scripts/materialize-bundled-deps.mjs prepare",

48 "postpack": "node scripts/materialize-bundled-deps.mjs restore && rm -rf skills context-integration",

49 "postinstall": "node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L49

50 },

51 "license": "Apache-2.0",

52 "bundleDependencies": [

53 "@botiverse/kimi-code-sdk"

54 ],

55 "repository": {

56 "type": "git",

57 "url": "https://github.com/agent-team-foundation/first-tree.git",

58 "directory": "apps/cli"

59 },

60 "engines": {

61 "node": ">=22.13.0"

62 },

63 "dependencies": {

64 "@anthropic-ai/claude-agent-sdk": "^0.3.187",

65 "@botiverse/kimi-code-sdk": "0.26.0-botiverse.2",

66 "@antfu/utils": "^9.3.0",

67 "@inquirer/prompts": "^8.3.0",

68 "@openai/codex-sdk": "^0.144.1",

69 "commander": "^13.1.0",

dist/cli/index.mjsView file

9import { createHash, randomBytes, randomUUID } from "node:crypto"; L10: import { execFileSync, spawn } from "node:child_process"; L11: import { createInterface } from "node:readline";

High

Child Process

Package source references child process execution.

dist/cli/index.mjsView on unpkg · L9

7809print.line(" If you need to restart the inline daemon:\n"); L7810: print.line(` stop the PowerShell running \`${channelConfig.binName} daemon start\` with Ctrl+C,\n`); L7811: print.line(` then run \`${channelConfig.binName} daemon start\` again.\n\n`);

High

Shell

Package source references shell execution.

dist/cli/index.mjsView on unpkg · L7809

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/cli/index.mjs: import { chmodSync, closeSync, cpSync, createReadStream, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statS... import { chmod, mkdtemp, readFile as readFile$1, stat, writeFile } from "node:fs/promises"; * out of scope for this PR, tracked as follow-up #1069). writeFileSync(descriptor, `${process.pid}\n`, "utf8"); writeFileSync(tempPath, stringify(validated), { mode: 384 }); writeFileSync(backupPath, originalBytes, { writeFileSync(temporary, `${JSON.stringify(parsed, null, 2)}\n`, { mode: 384 }); writeFileSync(launcherPath, materializedFile(name, readFileSync(launch

High

Entrypoint Foreign Package Code Overwrite

dist/connect-token-PM9gohpa.mjsView file

18import { URL as URL$1 } from "url"; L19: import * as http from "node:http"; L20: import * as https from "node:https"; ... L22: import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util$2 from "node:util"; ... L144: function formatPrettyEntry(json) { L145: const obj = JSON.parse(json); L146: const level = obj.level; ... L169: function createLoggerOutputStream(options) { L170: const getDest = options.getDestination ?? (() => process.stderr); L171: return new Writable({ write(chunk, _, callback) {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/connect-token-PM9gohpa.mjsView on unpkg · L18

18Trigger-reachable chain: manifest.exports -> dist/index.mjs -> dist/connect-token-PM9gohpa.mjs L18: import { URL as URL$1 } from "url"; L19: import * as http from "node:http"; L20: import * as https from "node:https"; ... L22: import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util$2 from "node:util"; ... L144: function formatPrettyEntry(json) { L145: const obj = JSON.parse(json); L146: const level = obj.level; ... L169: function createLoggerOutputStream(options) { L170: const getDest = options.getDestination ?? (() => process.stderr); L171: return new Writable({ write(chunk, _, callback) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/connect-token-PM9gohpa.mjsView on unpkg · L18