registry / first-tree-staging / 0.5.23-staging.1235.1

first-tree-staging@0.5.23-staging.1235.1

First Tree — unified CLI for Context Tree onboarding, agent management, and team messaging. (Source-tree dev build; CI rewrites `name` and `bin` for prod / staging publishes — see docs/local-dev-isolation.md.)

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Readable source is a First Tree staging CLI whose agent-surface writes are explicit user commands, while postinstall only prunes bundled binaries. Scanner theft and unofficial-gateway claims were not confirmed because the connect-token runtime bundle is unreadable as text, so this is a first-party agent-extension warning rather than a publish block.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

The user runs first-tree-staging context enable with --yes or a TTY confirm, or first-tree-staging login <code>.

Impact

After the user applies setup, Claude Code or Codex sessions can load First Tree Context hooks and skills; this is product setup, not an unconsented npm-install hijack.

Mechanism

First-party Claude Code and Codex plugin install plus optional login-time service setup

AI rationale

Evidence

dist/cli/index.mjscontext-integration/claude-code/plugins/first-tree-context/hooks/hooks.jsoncontext-integration/claude-code/plugins/first-tree-context/bin/context-session-start.claude/plugins/cachestate/context/providersclient.yaml

Decision evidence

public snapshot

AI called this Suspicious at 74.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The context enable command, after --yes or a TTY confirm, installs a First Tree Context plugin for Claude Code or Codex.
The Claude Code driver adds a user-scope plugin marketplace and installs first-tree-context.
The bundled Claude SessionStart hook runs the First Tree CLI context activate command.
Login posts the user-supplied connect code to a derived hub URL, stores credentials, and can install a background service.

Evidence against

npm postinstall only runs prune scripts that delete bundled Codex/Claude binaries on global installs and does not write agent config.
Plugin install is not an npm lifecycle hook; it requires an explicit context enable command.
Feishu bot secrets are sent only to the official open.feishu.cn tenant-token endpoint.
package.json has no runtime self-dependency on first-tree-staging.
Scanner credential-theft and unofficial-gateway labels were not confirmed in readable source; the connect-token bundle could not be read as text.

Behavioral surface

Source

ChildProcessCrypto

Source & flagged code

19 flagged

package.jsonView file

Lines 29-69json

29 "dist",

30 "context-integration",

31 "skills",

32 "scripts/prune-codex-runtime-binary.mjs",

33 "scripts/prune-claude-runtime-binary.mjs",

34 "scripts/prune-claude-sdk-deps.mjs",

35 "README.md",

36 "LICENSE"

37 ],

38 "publishConfig": {

39 "access": "public"

40 },

41 "scripts": {

42 "dev": "tsx src/cli/index.ts",

43 "build": "tsdown src/cli/index.ts src/index.ts --format esm --no-dts --external @anthropic-ai/claude-agent-sdk --external @botiverse/kimi-code-sdk --external @openai/codex-sdk --external @deepseek-ai/dsh-sdk-client --external @deepseek-ai/dsh-session --external @deepseek-ai/dsh-sdk-jsonrpc-demo --external fs-native-extensions && node ../../scripts/copy-client-runtime-templates.mjs apps/cli && node ../../scripts/copy-cli-tree-templates.mjs && node ../../scripts/build-context-integration-bundle.mjs --out-dir context-integration",

44 "typecheck": "tsc --noEmit",

45 "test": "node scripts/run-vitest-batches.mjs",

46 "coverage": "pnpm run build && vitest run --coverage --passWithNoTests",

47 "prepack": "node ../../scripts/copy-skill-payloads.mjs --target skills --clean && node scripts/materialize-bundled-deps.mjs prepare",

48 "postpack": "node scripts/materialize-bundled-deps.mjs restore && rm -rf skills context-integration",

49 "postinstall": "node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L49

50 },

51 "license": "Apache-2.0",

52 "bundleDependencies": [

53 "@botiverse/kimi-code-sdk",

54 "@deepseek-ai/dsh-agent-spine-demo",

55 "@deepseek-ai/dsh-bash-local",

56 "@deepseek-ai/dsh-fs-local",

57 "@deepseek-ai/dsh-llm-deepseek",

58 "@deepseek-ai/dsh-sdk-client",

59 "@deepseek-ai/dsh-sdk-jsonrpc-demo",

60 "@deepseek-ai/dsh-sdk-jsonrpc-server",

61 "@deepseek-ai/dsh-sdk-protocol",

62 "@deepseek-ai/dsh-session",

63 "@deepseek-ai/dsh-session-persistence-jsonl"

64 ],

65 "repository": {

66 "type": "git",

67 "url": "https://github.com/first-tree-ai/first-tree.git",

68 "directory": "apps/cli"

69 },

dist/cli/index.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = first-tree-staging@0.5.23-staging.1231.1 matchedIdentity = npm:Zmlyc3QtdHJlZS1zdGFnaW5n:0.5.23-staging.1231.1 similarity = 0.975 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/index.mjsView on unpkg

9import { createHash, randomBytes, randomUUID } from "node:crypto"; L10: import { execFileSync, spawn } from "node:child_process"; L11: import { createInterface } from "node:readline";

High

Child Process

Package source references child process execution.

dist/cli/index.mjsView on unpkg · L9

9177print.line(" If you need to restart the inline daemon:\n"); L9178: print.line(` stop the PowerShell running \`${channelConfig.binName} daemon start\` with Ctrl+C,\n`); L9179: print.line(` then run \`${channelConfig.binName} daemon start\` again.\n\n`);

High

Shell

Package source references shell execution.

dist/cli/index.mjsView on unpkg · L9177

dist/connect-token-Cylut-zQ.mjsView file

18import { createHash, randomBytes, randomUUID } from "node:crypto"; L19: import * as http from "node:http"; L20: import * as https from "node:https"; ... L22: import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util$2 from "node:util"; ... L252: try { L253: const resolved = new Intl.DateTimeFormat("en-US", { timeZone: trimmed }).resolvedOptions().timeZone; L254: if (!resolved) throw new Error(`unrecognized IANA timezone: ${trimmed}`); ... L349: * L350: * @private L351: * @param {Error} err

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/connect-token-Cylut-zQ.mjsView on unpkg · L18

18Trigger-reachable chain: manifest.exports -> dist/index.mjs -> dist/connect-token-Cylut-zQ.mjs L18: import { createHash, randomBytes, randomUUID } from "node:crypto"; L19: import * as http from "node:http"; L20: import * as https from "node:https"; ... L22: import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util$2 from "node:util"; ... L252: try { L253: const resolved = new Intl.DateTimeFormat("en-US", { timeZone: trimmed }).resolvedOptions().timeZone; L254: if (!resolved) throw new Error(`unrecognized IANA timezone: ${trimmed}`); ... L349: * L350: * @private L351: * @param {Error} err

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/connect-token-Cylut-zQ.mjsView on unpkg · L18

node_modules/@botiverse/kimi-code-sdk/dist/index.mjsView file

3const __filename = __cjsShimFileURLToPath(import.meta.url); L4: const __dirname = __cjsShimDirname(__filename); L5: import { createRequire } from "node:module"; ... L29: import { createControlledPromise, objectMap, sleep, uniq } from "@antfu/utils"; L30: import { execFile, execFileSync, spawn } from "node:child_process"; L31: import * as posixPath from "node:path/posix"; L32: import * as win32Path from "node:path/win32"; L33: import { createServer } from "node:http"; L34: import * as z$3 from "zod/v4"; ... L117: if (a.length !== 1) throw new Error(`Invalid character: "${a}"`); L118: const t = a.charCodeAt(0); L119: n[t] = true;

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

node_modules/@botiverse/kimi-code-sdk/dist/index.mjsView on unpkg · L3

3Cross-file remote execution chain: node_modules/@botiverse/kimi-code-sdk/dist/index.mjs spawns node_modules/@botiverse/kimi-code-sdk/dist/decode-P3VnPoF0.mjs; helper contains network access plus dynamic code execution. L3: const __filename = __cjsShimFileURLToPath(import.meta.url); L4: const __dirname = __cjsShimDirname(__filename); L5: import { createRequire } from "node:module"; ... L29: import { createControlledPromise, objectMap, sleep, uniq } from "@antfu/utils"; L30: import { execFile, execFileSync, spawn } from "node:child_process"; L31: import * as posixPath from "node:path/posix"; L32: import * as win32Path from "node:path/win32"; L33: import { createServer } from "node:http"; L34: import * as z$3 from "zod/v4"; ... L117: if (a.length !== 1) throw new Error(`Invalid character: "${

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli/index.mjsView file

Findings

3 Critical13 High6 Medium4 Low

CriticalCredential Exfiltrationdist/connect-token-Cylut-zQ.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/connect-token-Cylut-zQ.mjs

CriticalPrevious Version Dangerous Deltadist/cli/index.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/cli/index.mjs

HighShelldist/cli/index.mjs

HighCredential Redirect Persistencedist/connect-token-Cylut-zQ.mjs

HighCommand Output Exfiltrationdist/connect-token-Cylut-zQ.mjs

HighCloud Metadata Accessnode_modules/@botiverse/kimi-code-sdk/dist/index.mjs

HighRemote Agent Bridgedist/connect-token-Cylut-zQ.mjs

High

Affected versions and remediation

This report applies to first-tree-staging@0.5.23-staging.1235.1.

See all versions of first-tree-staging for other recorded verdicts.

Review the evidence and your use of first-tree-staging@0.5.23-staging.1235.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-19 11:27:56.495Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code