registry / AI-agent capability abuse / first-tree-staging / 0.5.22-staging.1207.1

first-tree-staging@0.5.22-staging.1207.1

First Tree — unified CLI for Context Tree onboarding, agent management, and team messaging. (Source-tree dev build; CI rewrites `name` and `bin` for prod / staging publishes — see docs/local-dev-isolation.md.)

AI Security Review

scanned 22d ago · by lpm-firewall-ai

Inspected source establishes explicit user-command agent prompt mutation, which the supplied policy classifies as a warning. The guarded command and dependency pruning hooks do not establish malicious install-time control hijacking.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

The user invokes agent config prompt set or append-prompt with file or standard input.

Impact

User-supplied instructions alter the managed agent's future behavior.

Mechanism

The command validates supplied text and patches the selected agent's inline prompt resource binding.

AI rationale

Evidence

dist/cli/index.mjsdist/connect-token-DyE-Q2vY.mjs

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

An explicit agent prompt command reads user input, checks briefing safeguards, and replaces the selected agent's prompt fragment.
Prompt changes are persisted through an authenticated resource patch with an expected version.
The shared bundle detects generated briefing markers before prompt replacement.
The postinstall hook invokes dependency pruning scripts; inspected scripts restrict pruning to global installs.
The bundled Kimi SDK reads agent instruction files as runtime context.

Evidence against

Prompt mutation requires an explicit CLI command and targets the package's managed agent resources.
Inspected install hooks do not modify agent configuration.
No concrete covert exfiltration or malicious execution chain was established.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStrings

Source & flagged code

19 flagged

package.jsonView file

Lines 29-69json

29 "dist",

30 "context-integration",

31 "skills",

32 "scripts/prune-codex-runtime-binary.mjs",

33 "scripts/prune-claude-runtime-binary.mjs",

34 "scripts/prune-claude-sdk-deps.mjs",

35 "README.md",

36 "LICENSE"

37 ],

38 "publishConfig": {

39 "access": "public"

40 },

41 "scripts": {

42 "dev": "tsx src/cli/index.ts",

43 "build": "tsdown src/cli/index.ts src/index.ts --format esm --no-dts --external @anthropic-ai/claude-agent-sdk --external @botiverse/kimi-code-sdk --external @openai/codex-sdk --external @deepseek-ai/dsh-sdk-client --external @deepseek-ai/dsh-session --external @deepseek-ai/dsh-sdk-jsonrpc-demo --external fs-native-extensions && node ../../scripts/copy-client-runtime-templates.mjs apps/cli && node ../../scripts/copy-cli-tree-templates.mjs && node ../../scripts/build-context-integration-bundle.mjs --out-dir context-integration",

44 "typecheck": "tsc --noEmit",

45 "test": "node scripts/run-vitest-batches.mjs",

46 "coverage": "pnpm run build && vitest run --coverage --passWithNoTests",

47 "prepack": "node ../../scripts/copy-skill-payloads.mjs --target skills --clean && node scripts/materialize-bundled-deps.mjs prepare",

48 "postpack": "node scripts/materialize-bundled-deps.mjs restore && rm -rf skills context-integration",

49 "postinstall": "node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L49

50 },

51 "license": "Apache-2.0",

52 "bundleDependencies": [

53 "@botiverse/kimi-code-sdk",

54 "@deepseek-ai/dsh-agent-spine-demo",

55 "@deepseek-ai/dsh-bash-local",

56 "@deepseek-ai/dsh-fs-local",

57 "@deepseek-ai/dsh-llm-deepseek",

58 "@deepseek-ai/dsh-sdk-client",

59 "@deepseek-ai/dsh-sdk-jsonrpc-demo",

60 "@deepseek-ai/dsh-sdk-jsonrpc-server",

61 "@deepseek-ai/dsh-sdk-protocol",

62 "@deepseek-ai/dsh-session",

63 "@deepseek-ai/dsh-session-persistence-jsonl"

64 ],

65 "repository": {

66 "type": "git",

67 "url": "https://github.com/first-tree-ai/first-tree.git",

68 "directory": "apps/cli"

69 },

dist/connect-token-DyE-Q2vY.mjsView file

18import { createHash, randomBytes, randomUUID } from "node:crypto"; L19: import * as http from "node:http"; L20: import * as https from "node:https"; ... L22: import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util$2 from "node:util"; ... L66: * L67: * @private L68: * @param {Error} err ... L884: for (var i = 0; i < flen;) { L885: if (f.charCodeAt(i) === 37 && i + 1 < flen) { L886: lastPos = lastPos > -1 ? lastPos : 0;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/connect-token-DyE-Q2vY.mjsView on unpkg · L18

18Trigger-reachable chain: manifest.exports -> dist/index.mjs -> dist/connect-token-DyE-Q2vY.mjs L18: import { createHash, randomBytes, randomUUID } from "node:crypto"; L19: import * as http from "node:http"; L20: import * as https from "node:https"; ... L22: import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util$2 from "node:util"; ... L66: * L67: * @private L68: * @param {Error} err ... L884: for (var i = 0; i < flen;) { L885: if (f.charCodeAt(i) === 37 && i + 1 < flen) { L886: lastPos = lastPos > -1 ? lastPos : 0;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/connect-token-DyE-Q2vY.mjsView on unpkg · L18

22import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util$2 from "node:util";

node_modules/@botiverse/kimi-code-sdk/dist/index.mjsView file

3const __filename = __cjsShimFileURLToPath(import.meta.url); L4: const __dirname = __cjsShimDirname(__filename); L5: import { createRequire } from "node:module"; ... L29: import { createControlledPromise, objectMap, sleep, uniq } from "@antfu/utils"; L30: import { execFile, execFileSync, spawn } from "node:child_process"; L31: import * as posixPath from "node:path/posix"; L32: import * as win32Path from "node:path/win32"; L33: import { createServer } from "node:http"; L34: import * as z$3 from "zod/v4"; ... L117: if (a.length !== 1) throw new Error(`Invalid character: "${a}"`); L118: const t = a.charCodeAt(0); L119: n[t] = true;

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

node_modules/@botiverse/kimi-code-sdk/dist/index.mjsView on unpkg · L3

3Cross-file remote execution chain: node_modules/@botiverse/kimi-code-sdk/dist/index.mjs spawns node_modules/@botiverse/kimi-code-sdk/dist/decode-P3VnPoF0.mjs; helper contains network access plus dynamic code execution. L3: const __filename = __cjsShimFileURLToPath(import.meta.url); L4: const __dirname = __cjsShimDirname(__filename); L5: import { createRequire } from "node:module"; ... L29: import { createControlledPromise, objectMap, sleep, uniq } from "@antfu/utils"; L30: import { execFile, execFileSync, spawn } from "node:child_process"; L31: import * as posixPath from "node:path/posix"; L32: import * as win32Path from "node:path/win32"; L33: import { createServer } from "node:http"; L34: import * as z$3 from "zod/v4"; ... L117: if (a.length !== 1) throw new Error(`Invalid character: "${

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = first-tree-staging@0.5.24-staging.1238.1 matchedIdentity = npm:Zmlyc3QtdHJlZS1zdGFnaW5n:0.5.24-staging.1238.1 similarity = 0.975 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/index.mjsView on unpkg

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/connect-token-DyE-Q2vY.mjsView file

Findings

3 Critical13 High6 Medium4 Low

CriticalCredential Exfiltrationdist/connect-token-DyE-Q2vY.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/connect-token-DyE-Q2vY.mjs

CriticalPrevious Version Dangerous Deltadist/cli/index.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/connect-token-DyE-Q2vY.mjs

HighShelldist/connect-token-DyE-Q2vY.mjs

HighCredential Redirect Persistencedist/connect-token-DyE-Q2vY.mjs

HighCommand Output Exfiltrationdist/connect-token-DyE-Q2vY.mjs

HighCloud Metadata Accessnode_modules/@botiverse/kimi-code-sdk/dist/index.mjs

HighRemote Agent Bridgedist/connect-token-DyE-Q2vY.mjs

Affected versions and remediation

This report applies to first-tree-staging@0.5.22-staging.1207.1.

See all versions of first-tree-staging for other recorded verdicts.

Review the evidence and your use of first-tree-staging@0.5.22-staging.1207.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-01 07:44:36.037Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code