Loading npm security reports…

first-tree@0.5.18: Suspicious npm security report (Warn) | LPM Firewall

registry / first-tree / 0.5.18

first-tree@0.5.18

First Tree — unified CLI for Context Tree onboarding, agent management, and team messaging. (Source-tree dev build; CI rewrites `name` and `bin` for prod / staging publishes — see docs/local-dev-isolation.md.)

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The package is an agent-management CLI that can install managed skills and session hooks when its context integration is activated. Its postinstall hook deletes selected bundled agent-runtime dependencies only from its global-install tree.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Global npm installation; subsequent explicit CLI/context-integration activation.

Impact

Can alter availability of bundled Codex/Claude runtime artifacts and project agent-skill content; no confirmed exfiltration or foreign control-surface mutation.

Mechanism

global dependency pruning and managed AI-agent skill projection

Rationale

The scanner's claimed command-output exfiltration was not substantiated: command and fetch primitives are used for local runtime checks and configured First Tree API flows. The lifecycle deletion and managed agent-skill projection still warrant a warning.

Evidence

package.jsonscripts/prune-codex-runtime-binary.mjsscripts/prune-claude-runtime-binary.mjsscripts/prune-claude-sdk-deps.mjsdist/connect-token-CENYco9m.mjsdist/cli/index.mjscontext-integration/claude-code/plugins/first-tree-context/hooks/hooks.jsoncontext-integration/codex/plugins/first-tree-context/bin/context-session-start

Network endpoints1

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/connect-token-CENYco9m.mjsView file

18import { accessSync, appendFileSync, chmodSync, closeSync, constants, createReadStream, createWriteStream, existsSync, fsyncSync, linkSync, lstatSync, mkdirSync, mkdtempSync, openS... L19: import * as http from "node:http"; L20: import * as https from "node:https"; ... L22: import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util$2 from "node:util"; ... L61: * L62: * @private L63: * @param {Error} err ... L879: for (var i = 0; i < flen;) { L880: if (f.charCodeAt(i) === 37 && i + 1 < flen) { L881: lastPos = lastPos > -1 ? lastPos : 0;

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/connect-token-CENYco9m.mjsView on unpkg · L18

18Trigger-reachable chain: manifest.exports -> dist/index.mjs -> dist/connect-token-CENYco9m.mjs L18: import { accessSync, appendFileSync, chmodSync, closeSync, constants, createReadStream, createWriteStream, existsSync, fsyncSync, linkSync, lstatSync, mkdirSync, mkdtempSync, openS... L19: import * as http from "node:http"; L20: import * as https from "node:https"; ... L22: import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util$2 from "node:util"; ... L61: * L62: * @private L63: * @param {Error} err ... L879: for (var i = 0; i < flen;) { L880: if (f.charCodeAt(i) === 37 && i + 1 < flen) { L881: lastPos = lastPos > -1 ? lastPos : 0;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/connect-token-CENYco9m.mjsView on unpkg · L18

22import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util$2 from "node:util";

High

Child Process

Package source references child process execution.

dist/connect-token-CENYco9m.mjsView on unpkg · L22

20863process.argv[0], L20864: ...process.execArgv, L20865: ...process.argv.slice(1)

High

Shell

Package source references shell execution.

dist/connect-token-CENYco9m.mjsView on unpkg · L20863

79714/** L79715: * Validate an npm install spec (the part after `@` in `<pkg>@<spec>`). We L79716: * accept either a known dist-tag string (`latest`, `alpha`, …) or an exact ... L79719: * want to forward an attacker-controlled shell metacharacter from a L79720: * (compromised) server welcome frame straight into `spawn`. spawn() already L79721: * argv-escapes, but a `--registry=...` style spec would still be

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/connect-token-CENYco9m.mjsView on unpkg · L79714

18import { accessSync, appendFileSync, chmodSync, closeSync, constants, createReadStream, createWriteStream, existsSync, fsyncSync, linkSync, lstatSync, mkdirSync, mkdtempSync, openS... L19: import * as http from "node:http"; L20: import * as https from "node:https"; ... L22: import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util$2 from "node:util"; ... L61: * L62: * @private L63: * @param {Error} err ... L879: for (var i = 0; i < flen;) { L880: if (f.charCodeAt(i) === 37 && i + 1 < flen) { L881: lastPos = lastPos > -1 ? lastPos : 0;

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/connect-token-CENYco9m.mjsView on unpkg · L18

dist/cli/index.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = first-tree@0.5.14 matchedIdentity = npm:Zmlyc3QtdHJlZQ:0.5.14 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/index.mjsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 29-69json

29 "dist",

30 "context-integration",

31 "skills",

32 "scripts/prune-codex-runtime-binary.mjs",

33 "scripts/prune-claude-runtime-binary.mjs",

34 "scripts/prune-claude-sdk-deps.mjs",

35 "README.md",

36 "LICENSE"

37 ],

38 "publishConfig": {

39 "access": "public"

40 },

41 "scripts": {

42 "dev": "tsx src/cli/index.ts",

43 "build": "tsdown src/cli/index.ts src/index.ts --format esm --no-dts --external @anthropic-ai/claude-agent-sdk --external @botiverse/kimi-code-sdk --external @openai/codex-sdk --external fs-native-extensions && node ../../scripts/copy-client-runtime-templates.mjs apps/cli && node ../../scripts/copy-cli-tree-templates.mjs && node ../../scripts/build-context-integration-bundle.mjs --out-dir context-integration",

44 "typecheck": "tsc --noEmit",

45 "test": "node scripts/run-vitest-batches.mjs",

46 "coverage": "pnpm run build && vitest run --coverage --passWithNoTests",

47 "prepack": "rm -rf skills && cp -R ../../skills .",

48 "postpack": "rm -rf skills context-integration",

49 "postinstall": "node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L49

50 },

51 "license": "Apache-2.0",

52 "repository": {

53 "type": "git",

54 "url": "https://github.com/agent-team-foundation/first-tree.git",

55 "directory": "apps/cli"

56 },

57 "engines": {

58 "node": ">=22.13.0"

59 },

60 "dependencies": {

61 "@anthropic-ai/claude-agent-sdk": "^0.3.187",

62 "@botiverse/kimi-code-sdk": "0.26.0-botiverse.2",

63 "@inquirer/prompts": "^8.3.0",

64 "@openai/codex-sdk": "^0.144.1",

65 "commander": "^13.1.0",

66 "ejs": "^6.0.1",

67 "fs-native-extensions": "^1.5.0",

68 "gray-matter": "^4.0.3",

69 "jose": "^6.0.0",

dist/connect-token-CENYco9m.mjsView file

18import { accessSync, appendFileSync, chmodSync, closeSync, constants, createReadStream, createWriteStream, existsSync, fsyncSync, linkSync, lstatSync, mkdirSync, mkdtempSync, openS... L19: import * as http from "node:http"; L20: import * as https from "node:https"; ... L22: import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util$2 from "node:util"; ... L61: * L62: * @private L63: * @param {Error} err ... L879: for (var i = 0; i < flen;) { L880: if (f.charCodeAt(i) === 37 && i + 1 < flen) { L881: lastPos = lastPos > -1 ? lastPos : 0;

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/connect-token-CENYco9m.mjsView on unpkg · L18

18Trigger-reachable chain: manifest.exports -> dist/index.mjs -> dist/connect-token-CENYco9m.mjs L18: import { accessSync, appendFileSync, chmodSync, closeSync, constants, createReadStream, createWriteStream, existsSync, fsyncSync, linkSync, lstatSync, mkdirSync, mkdtempSync, openS... L19: import * as http from "node:http"; L20: import * as https from "node:https"; ... L22: import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util$2 from "node:util"; ... L61: * L62: * @private L63: * @param {Error} err ... L879: for (var i = 0; i < flen;) { L880: if (f.charCodeAt(i) === 37 && i + 1 < flen) { L881: lastPos = lastPos > -1 ? lastPos : 0;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/connect-token-CENYco9m.mjsView on unpkg · L18

dist/cli/index.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = first-tree@0.5.14 matchedIdentity = npm:Zmlyc3QtdHJlZQ:0.5.14 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/index.mjsView on unpkg