Loading npm security reports…

first-tree@0.5.20: AI-agent control-surface risk | LPM Firewall

registry / first-tree / 0.5.20

first-tree@0.5.20

First Tree — unified CLI for Context Tree onboarding, agent management, and team messaging. (Source-tree dev build; CI rewrites `name` and `bin` for prod / staging publishes — see docs/local-dev-isolation.md.)

AI Security Review

scanned 4d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing globally triggers unconsented deletion of installed OpenAI and Anthropic runtime/dependency packages. This alters foreign AI-agent executables in the global package tree.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm install -g first-tree

Impact

Disables or alters bundled Codex/Claude runtime availability and removes SDK peers.

Mechanism

postinstall recursive deletion of foreign AI runtime packages

Policy narrative

On global installation, package.json automatically executes pruning scripts. Those scripts resolve and recursively remove platform packages containing OpenAI Codex and Anthropic Claude runtimes, plus Claude SDK peer packages, from the installed dependency tree. The deletion is not initiated by a user command and modifies foreign AI-agent components.

Rationale

The postinstall hook concretely deletes foreign AI runtime packages during installation. Global-only scope and opt-outs reduce breadth but do not make the unconsented lifecycle mutation safe.

Evidence

package.jsonscripts/prune-codex-runtime-binary.mjsscripts/prune-claude-runtime-binary.mjsscripts/prune-claude-sdk-deps.mjsdist/cli/index.mjscontext-integration/codex/plugins/first-tree-context/hooks/hooks.jsonnode_modules/@openai/codex-*/node_modules/@anthropic-ai/claude-agent-sdk-*/

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/connect-token-CneThoZJ.mjsView file

18import { accessSync, appendFileSync, chmodSync, closeSync, constants, createReadStream, createWriteStream, existsSync, fchmodSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirS... L19: import * as http from "node:http"; L20: import * as https from "node:https"; ... L22: import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util$2 from "node:util"; ... L65: * L66: * @private L67: * @param {Error} err ... L883: for (var i = 0; i < flen;) { L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) { L885: lastPos = lastPos > -1 ? lastPos : 0;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/connect-token-CneThoZJ.mjsView on unpkg · L18

18Trigger-reachable chain: manifest.exports -> dist/index.mjs -> dist/connect-token-CneThoZJ.mjs L18: import { accessSync, appendFileSync, chmodSync, closeSync, constants, createReadStream, createWriteStream, existsSync, fchmodSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirS... L19: import * as http from "node:http"; L20: import * as https from "node:https"; ... L22: import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util$2 from "node:util"; ... L65: * L66: * @private L67: * @param {Error} err ... L883: for (var i = 0; i < flen;) { L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) { L885: lastPos = lastPos > -1 ? lastPos : 0;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/connect-token-CneThoZJ.mjsView on unpkg · L18

•matchType = previous_version_dangerous_delta matchedPackage = first-tree@0.5.19 matchedIdentity = npm:Zmlyc3QtdHJlZQ:0.5.19 similarity = 0.933 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/connect-token-CneThoZJ.mjsView on unpkg

22import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util$2 from "node:util";

High

Child Process

Package source references child process execution.

dist/connect-token-CneThoZJ.mjsView on unpkg · L22

20867process.argv[0], L20868: ...process.execArgv, L20869: ...process.argv.slice(1)

High

Shell

Package source references shell execution.

dist/connect-token-CneThoZJ.mjsView on unpkg · L20867

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/connect-token-CneThoZJ.mjs: import { accessSync, appendFileSync, chmodSync, closeSync, constants, createReadStream, createWriteStream, existsSync, fchmodSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirS... import { createInterface } from "node:readline"; import { chmod, lstat, mkdir, mkdtemp, open, readFile as readFile$1, readdir as readdir$1, readlink, realpath, rename, rm, stat, symlink, writeFile } from "node:fs/promises"; const readlinePromises = []; readlinePromises.push(getContextLinesFromFile(file, ranges, cache)); await Promise.all(readlinePromises).catch(() => { headers["Proxy-Authorization"] = `Basic ${Buffer.from(

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/connect-token-CneThoZJ.mjsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/connect-token-CneThoZJ.mjs: import { accessSync, appendFileSync, chmodSync, closeSync, constants, createReadStream, createWriteStream, existsSync, fchmodSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirS... import { chmod, lstat, mkdir, mkdtemp, open, readFile as readFile$1, readdir as readdir$1, readlink, realpath, rename, rm, stat, symlink, writeFile } from "node:fs/promises"; //#region ../../node_modules/.pnpm/pino-std-serializers@7.1.0/node_modules/pino-std-serializers/lib/err-helpers.js //#region ../../node_modules/.pnpm/pino-std-serializers@7.1.0/node_modules/pino-std-serializers/lib/err-proto.js //#region ../../node_modules/.pnpm/pino-std-

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/connect-token-CneThoZJ.mjsView on unpkg

18import { accessSync, appendFileSync, chmodSync, closeSync, constants, createReadStream, createWriteStream, existsSync, fchmodSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirS... L19: import * as http from "node:http"; L20: import * as https from "node:https"; ... L22: import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util$2 from "node:util"; ... L65: * L66: * @private L67: * @param {Error} err ... L883: for (var i = 0; i < flen;) { L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) { L885: lastPos = lastPos > -1 ? lastPos : 0;

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/connect-token-CneThoZJ.mjsView on unpkg · L18

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. catch (error) { options.log?.(`managed skills lock cleanup failed: ${error instanceof error ? error.message.slice(0, 300) : string(error)}`); } } }); } function freezeresult(resourceconfigversion, result) { return object.freeze({ ok: result.failures.length === 0, resourceconfigversion, installed: object.freeze([...result.installed]), skipped: object.freeze([...result.skipped]), removed: object.freeze([...result.removed]), teamskills: object.freeze([...result.teamskills]), failures: object.freeze([...result.failures]), staleteamsnapshot: result.staleteamsnapshot }); } function processmutexkey(workspace) { try { return realpathsync(resolve(workspace)

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/connect-token-CneThoZJ.mjsView on unpkg

18Trigger-reachable credential exfiltration chain: manifest.exports -> dist/index.mjs -> dist/connect-token-CneThoZJ.mjs L18: import { accessSync, appendFileSync, chmodSync, closeSync, constants, createReadStream, createWriteStream, existsSync, fchmodSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirS... L19: import * as http from "node:http"; L20: import * as https from "node:https"; ... L22: import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util$2 from "node:util"; ... L65: * L66: * @private L67: * @param {Error} err ... L883: for (var i = 0; i < flen;) { L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) { L885: lastPos = lastPos > -1 ? lastPos : 0;

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/connect-token-CneThoZJ.mjsView on unpkg · L18

18Trigger-reachable persistence chain: manifest.exports -> dist/index.mjs -> dist/connect-token-CneThoZJ.mjs L18: import { accessSync, appendFileSync, chmodSync, closeSync, constants, createReadStream, createWriteStream, existsSync, fchmodSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirS... L19: import * as http from "node:http"; L20: import * as https from "node:https"; ... L22: import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util$2 from "node:util"; ... L65: * L66: * @private L67: * @param {Error} err ... L883: for (var i = 0; i < flen;) { L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) { L885: lastPos = lastPos > -1 ? lastPos : 0;

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/connect-token-CneThoZJ.mjsView on unpkg · L18

95299/** L95300: * Validate an npm install spec (the part after `@` in `<pkg>@<spec>`). We L95301: * accept either a known dist-tag string (`latest`, `alpha`, …) or an exact ... L95304: * want to forward an attacker-controlled shell metacharacter from a L95305: * (compromised) server welcome frame straight into `spawn`. spawn() already L95306: * argv-escapes, but a `--registry=...` style spec would still be

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/connect-token-CneThoZJ.mjsView on unpkg · L95299

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/connect-token-CneThoZJ.mjsView on unpkg

•matchType = token_shingles matchedPackage = first-tree-staging@0.5.19-staging.1098.1 matchedPath = dist/connect-token-DteeikB-.mjs matchedIdentity = npm:Zmlyc3QtdHJlZS1zdGFnaW5n:0.5.19-staging.1098.1 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/connect-token-CneThoZJ.mjsView on unpkg

18import { accessSync, appendFileSync, chmodSync, closeSync, constants, createReadStream, createWriteStream, existsSync, fchmodSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirS... L19: import * as http from "node:http"; L20: import * as https from "node:https"; ... L22: import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util$2 from "node:util"; ... L65: * L66: * @private L67: * @param {Error} err ... L883: for (var i = 0; i < flen;) { L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) { L885: lastPos = lastPos > -1 ? lastPos : 0;

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/connect-token-CneThoZJ.mjsView on unpkg · L18

Source & flagged code

17 flagged

package.jsonView file

Lines 29-69json

29 "dist",

30 "context-integration",

31 "skills",

32 "scripts/prune-codex-runtime-binary.mjs",

33 "scripts/prune-claude-runtime-binary.mjs",

34 "scripts/prune-claude-sdk-deps.mjs",

35 "README.md",

36 "LICENSE"

37 ],

38 "publishConfig": {

39 "access": "public"

40 },

41 "scripts": {

42 "dev": "tsx src/cli/index.ts",

43 "build": "tsdown src/cli/index.ts src/index.ts --format esm --no-dts --external @anthropic-ai/claude-agent-sdk --external @botiverse/kimi-code-sdk --external @openai/codex-sdk --external fs-native-extensions && node ../../scripts/copy-client-runtime-templates.mjs apps/cli && node ../../scripts/copy-cli-tree-templates.mjs && node ../../scripts/build-context-integration-bundle.mjs --out-dir context-integration",

44 "typecheck": "tsc --noEmit",

45 "test": "node scripts/run-vitest-batches.mjs",

46 "coverage": "pnpm run build && vitest run --coverage --passWithNoTests",

47 "prepack": "rm -rf skills && cp -R ../../skills . && node scripts/materialize-bundled-deps.mjs prepare",

48 "postpack": "node scripts/materialize-bundled-deps.mjs restore && rm -rf skills context-integration",

49 "postinstall": "node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L49

50 },

51 "license": "Apache-2.0",

52 "bundleDependencies": [

53 "@botiverse/kimi-code-sdk"

54 ],

55 "repository": {

56 "type": "git",

57 "url": "https://github.com/agent-team-foundation/first-tree.git",

58 "directory": "apps/cli"

59 },

60 "engines": {

61 "node": ">=22.13.0"

62 },

63 "dependencies": {

64 "@anthropic-ai/claude-agent-sdk": "^0.3.187",

65 "@botiverse/kimi-code-sdk": "0.26.0-botiverse.2",

66 "@antfu/utils": "^9.3.0",

67 "@inquirer/prompts": "^8.3.0",

68 "@openai/codex-sdk": "^0.144.1",

69 "commander": "^13.1.0",

dist/connect-token-CneThoZJ.mjsView file

18import { accessSync, appendFileSync, chmodSync, closeSync, constants, createReadStream, createWriteStream, existsSync, fchmodSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirS... L19: import * as http from "node:http"; L20: import * as https from "node:https"; ... L22: import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util$2 from "node:util"; ... L65: * L66: * @private L67: * @param {Error} err ... L883: for (var i = 0; i < flen;) { L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) { L885: lastPos = lastPos > -1 ? lastPos : 0;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/connect-token-CneThoZJ.mjsView on unpkg · L18

18Trigger-reachable chain: manifest.exports -> dist/index.mjs -> dist/connect-token-CneThoZJ.mjs L18: import { accessSync, appendFileSync, chmodSync, closeSync, constants, createReadStream, createWriteStream, existsSync, fchmodSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirS... L19: import * as http from "node:http"; L20: import * as https from "node:https"; ... L22: import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util$2 from "node:util"; ... L65: * L66: * @private L67: * @param {Error} err ... L883: for (var i = 0; i < flen;) { L884: if (f.charCodeAt(i) === 37 && i + 1 < flen) { L885: lastPos = lastPos > -1 ? lastPos : 0;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/connect-token-CneThoZJ.mjsView on unpkg · L18