registry / first-tree-staging / 0.5.23-staging.1220.1
first-tree-staging@0.5.23-staging.1220.1
First Tree — unified CLI for Context Tree onboarding, agent management, and team messaging. (Source-tree dev build; CI rewrites `name` and `bin` for prod / staging publishes — see docs/local-dev-isolation.md.)
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is not concrete malicious behavior, but it has a guarded, persistent AI-agent extension capability. The scanner's credential-redirection claim is not supported by the inspected source.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs the persistent First Tree Context setup flow and enables or trusts the provider plugin.
Impact
Future provider sessions can invoke the First Tree context activation command.
Mechanism
Installs a First Tree provider plugin with a SessionStart launcher.
AI rationale
This is not concrete malicious behavior, but it has a guarded, persistent AI-agent extension capability. The scanner's credential-redirection claim is not supported by the inspected source.
Evidence
package.jsondist/cli/index.mjsdist/connect-token-dRKA2YLy.mjscontext-integration/codex/plugins/first-tree-context/hooks/hooks.jsonscripts/prune-codex-runtime-binary.mjscontext-integration/codex/plugins/first-tree-context/bin/context-session-startscripts/prune-claude-runtime-binary.mjsscripts/prune-claude-sdk-deps.mjs
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package ships a SessionStart hook that executes its First Tree context launcher.
- An explicit persistent setup path installs the first-tree-context plugin into a selected provider.
- The postinstall script deletes bundled AI runtime packages, but only during global installation.
Evidence against
- No credential harvesting or fixed unofficial credential gateway was found in the inspected login flow.
- The login command posts the supplied connect code only to a URL derived from that code or an explicit configuration value.
- The Codex hook path requires provider-side review or trust before setup is complete.
- No install-time write to an AI-agent configuration or hook was found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
16 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/connect-token-dRKA2YLy.mjsView file
18import { createHash, randomBytes, randomUUID } from "node:crypto";
L19: import * as http from "node:http";
L20: import * as https from "node:https";
...
L22: import { AsyncLocalStorage } from "node:async_hooks";
L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
L24: import * as util$2 from "node:util";
...
L251: try {
L252: const resolved = new Intl.DateTimeFormat("en-US", { timeZone: trimmed }).resolvedOptions().timeZone;
L253: if (!resolved) throw new Error(`unrecognized IANA timezone: ${trimmed}`);
...
L348: *
L349: * @private
L350: * @param {Error} err
Findings
2 Critical12 High5 Medium4 Low
CriticalCredential Exfiltrationdist/connect-token-dRKA2YLy.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/connect-token-dRKA2YLy.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/connect-token-dRKA2YLy.mjs
HighShelldist/connect-token-dRKA2YLy.mjs
HighCredential Redirect Persistencedist/connect-token-dRKA2YLy.mjs
HighEntrypoint Foreign Package Code Overwritedist/connect-token-dRKA2YLy.mjs
HighCommand Output Exfiltrationdist/connect-token-dRKA2YLy.mjs
HighRemote Agent Bridgedist/connect-token-dRKA2YLy.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/connect-token-dRKA2YLy.mjs
Affected versions and remediation
This report applies to first-tree-staging@0.5.23-staging.1220.1.
See all versions of first-tree-staging for other recorded verdicts.
- Review the evidence and your use of first-tree-staging@0.5.23-staging.1220.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.