registry / first-tree-staging / 0.5.23-staging.1219.1

first-tree-staging@0.5.23-staging.1219.1

First Tree — unified CLI for Context Tree onboarding, agent management, and team messaging. (Source-tree dev build; CI rewrites `name` and `bin` for prod / staging publishes — see docs/local-dev-isolation.md.)

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The reported token flow is an explicit login exchange of the caller-provided code, not harvesting or forwarding an existing credential. The postinstall hook is scoped to global-install pruning and does not establish malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Package installation runs postinstall; login network activity requires an explicit login command and code.

Impact

The global install may remove selected bundled runtime packages; no confirmed malicious impact was established.

Mechanism

Global-install runtime dependency pruning and explicit token exchange.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 87.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest postinstall invokes only three bundled pruning scripts.
The Codex pruning script exits unless npm marks the install as global, avoiding local consumer-project mutation.
The login command sends the code supplied as its command argument to the selected First Tree server URL.
Short login codes are accepted only with a configured fallback URL; URL-shaped codes are rejected.
The bundled Kimi SDK begins as ordinary Node module imports and is not an install-time entrypoint.

Evidence against

The package has a postinstall hook that removes selected bundled runtime dependencies during global installs.
The CLI permits an operator-supplied FIRST_TREE_SERVER_URL for its explicit login workflow.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinified

Source & flagged code

19 flagged

package.jsonView file

Lines 29-69json

29 "dist",

30 "context-integration",

31 "skills",

32 "scripts/prune-codex-runtime-binary.mjs",

33 "scripts/prune-claude-runtime-binary.mjs",

34 "scripts/prune-claude-sdk-deps.mjs",

35 "README.md",

36 "LICENSE"

37 ],

38 "publishConfig": {

39 "access": "public"

40 },

41 "scripts": {

42 "dev": "tsx src/cli/index.ts",

43 "build": "tsdown src/cli/index.ts src/index.ts --format esm --no-dts --external @anthropic-ai/claude-agent-sdk --external @botiverse/kimi-code-sdk --external @openai/codex-sdk --external @deepseek-ai/dsh-sdk-client --external @deepseek-ai/dsh-session --external @deepseek-ai/dsh-sdk-jsonrpc-demo --external fs-native-extensions && node ../../scripts/copy-client-runtime-templates.mjs apps/cli && node ../../scripts/copy-cli-tree-templates.mjs && node ../../scripts/build-context-integration-bundle.mjs --out-dir context-integration",

44 "typecheck": "tsc --noEmit",

45 "test": "node scripts/run-vitest-batches.mjs",

46 "coverage": "pnpm run build && vitest run --coverage --passWithNoTests",

47 "prepack": "node ../../scripts/copy-skill-payloads.mjs --target skills --clean && node scripts/materialize-bundled-deps.mjs prepare",

48 "postpack": "node scripts/materialize-bundled-deps.mjs restore && rm -rf skills context-integration",

49 "postinstall": "node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L49

50 },

51 "license": "Apache-2.0",

52 "bundleDependencies": [

53 "@botiverse/kimi-code-sdk",

54 "@deepseek-ai/dsh-agent-spine-demo",

55 "@deepseek-ai/dsh-bash-local",

56 "@deepseek-ai/dsh-fs-local",

57 "@deepseek-ai/dsh-llm-deepseek",

58 "@deepseek-ai/dsh-sdk-client",

59 "@deepseek-ai/dsh-sdk-jsonrpc-demo",

60 "@deepseek-ai/dsh-sdk-jsonrpc-server",

61 "@deepseek-ai/dsh-sdk-protocol",

62 "@deepseek-ai/dsh-session",

63 "@deepseek-ai/dsh-session-persistence-jsonl"

64 ],

65 "repository": {

66 "type": "git",

67 "url": "https://github.com/first-tree-ai/first-tree.git",

68 "directory": "apps/cli"

69 },

dist/connect-token-BrA6-lQA.mjsView file

18import { createHash, randomBytes, randomUUID } from "node:crypto"; L19: import * as http from "node:http"; L20: import * as https from "node:https"; ... L22: import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util$2 from "node:util"; ... L251: try { L252: const resolved = new Intl.DateTimeFormat("en-US", { timeZone: trimmed }).resolvedOptions().timeZone; L253: if (!resolved) throw new Error(`unrecognized IANA timezone: ${trimmed}`); ... L348: * L349: * @private L350: * @param {Error} err

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/connect-token-BrA6-lQA.mjsView on unpkg · L18

18Trigger-reachable chain: manifest.exports -> dist/index.mjs -> dist/connect-token-BrA6-lQA.mjs L18: import { createHash, randomBytes, randomUUID } from "node:crypto"; L19: import * as http from "node:http"; L20: import * as https from "node:https"; ... L22: import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util$2 from "node:util"; ... L251: try { L252: const resolved = new Intl.DateTimeFormat("en-US", { timeZone: trimmed }).resolvedOptions().timeZone; L253: if (!resolved) throw new Error(`unrecognized IANA timezone: ${trimmed}`); ... L348: * L349: * @private L350: * @param {Error} err

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/connect-token-BrA6-lQA.mjsView on unpkg · L18

node_modules/@botiverse/kimi-code-sdk/dist/index.mjsView file

3const __filename = __cjsShimFileURLToPath(import.meta.url); L4: const __dirname = __cjsShimDirname(__filename); L5: import { createRequire } from "node:module"; ... L29: import { createControlledPromise, objectMap, sleep, uniq } from "@antfu/utils"; L30: import { execFile, execFileSync, spawn } from "node:child_process"; L31: import * as posixPath from "node:path/posix"; L32: import * as win32Path from "node:path/win32"; L33: import { createServer } from "node:http"; L34: import * as z$3 from "zod/v4"; ... L117: if (a.length !== 1) throw new Error(`Invalid character: "${a}"`); L118: const t = a.charCodeAt(0); L119: n[t] = true;

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

node_modules/@botiverse/kimi-code-sdk/dist/index.mjsView on unpkg · L3

3Cross-file remote execution chain: node_modules/@botiverse/kimi-code-sdk/dist/index.mjs spawns node_modules/@botiverse/kimi-code-sdk/dist/decode-P3VnPoF0.mjs; helper contains network access plus dynamic code execution. L3: const __filename = __cjsShimFileURLToPath(import.meta.url); L4: const __dirname = __cjsShimDirname(__filename); L5: import { createRequire } from "node:module"; ... L29: import { createControlledPromise, objectMap, sleep, uniq } from "@antfu/utils"; L30: import { execFile, execFileSync, spawn } from "node:child_process"; L31: import * as posixPath from "node:path/posix"; L32: import * as win32Path from "node:path/win32"; L33: import { createServer } from "node:http"; L34: import * as z$3 from "zod/v4"; ... L117: if (a.length !== 1) throw new Error(`Invalid character: "${

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = first-tree-staging@0.5.23-staging.1231.1 matchedIdentity = npm:Zmlyc3QtdHJlZS1zdGFnaW5n:0.5.23-staging.1231.1 similarity = 0.975 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/index.mjsView on unpkg

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/connect-token-BrA6-lQA.mjsView file

Findings

3 Critical13 High6 Medium4 Low

CriticalCredential Exfiltrationdist/connect-token-BrA6-lQA.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/connect-token-BrA6-lQA.mjs

CriticalPrevious Version Dangerous Deltadist/cli/index.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/connect-token-BrA6-lQA.mjs

HighShelldist/connect-token-BrA6-lQA.mjs

HighCredential Redirect Persistencedist/connect-token-BrA6-lQA.mjs

HighCommand Output Exfiltrationdist/connect-token-BrA6-lQA.mjs

HighCloud Metadata Accessnode_modules/@botiverse/kimi-code-sdk/dist/index.mjs

HighRemote Agent Bridgedist/connect-token-BrA6-lQA.mjs

Affected versions and remediation

This report applies to first-tree-staging@0.5.23-staging.1219.1.

See all versions of first-tree-staging for other recorded verdicts.

Review the evidence and your use of first-tree-staging@0.5.23-staging.1219.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-19 11:26:22.504Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.