trace-mcp@1.44.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

trace-mcp@1.44.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/preflight-native.mjs && node scripts/postinstall-app.mjs && node scripts/postinstall-control-plane.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/preflight-native.mjs && node scripts/postinstall-app.mjs && node scripts/postinstall-control-plane.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall-control-plane.mjsView file

17* - TRACE_MCP_NO_POSTINSTALL=1 skips entirely. L18: * - Dev checkouts (.git next to package.json) and `npm link` symlinks are skipped. L19: * - TRACE_MCP_MANAGED_BY=launchd: skip (we're being run by launchd, don't recurse). ... L27: L28: import { execFileSync, spawnSync } from 'node:child_process'; L29: import fs from 'node:fs'; ... L44: const __filename = fileURLToPath(import.meta.url); L45: const __dirname = path.dirname(__filename); L46: ... L50: const TRACE_MCP_HOME = (() => { L51: const override = process.env.TRACE_MCP_DATA_DIR || process.env.TRACE_MCP_HOME; L52: if (override && override.length > 0) {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/postinstall-control-plane.mjsView on unpkg · L17

scripts/postinstall-app.mjsView file

17* not destroy the working installation. L18: * - `unzip` is invoked with execFileSync (no shell) to avoid argument L19: * injection via asset names. ... L23: L24: import { execFileSync } from 'node:child_process'; L25: import crypto from 'node:crypto'; L26: import fs from 'node:fs'; L27: import http from 'node:http'; L28: import https from 'node:https'; ... L46: // The compiled app lives in a separate PUBLIC distribution repo (the source L47: // is private). See scripts/app-dist-repo.mjs. Overridable via env. L48: const GITHUB_REPO = getAppDistRepo();

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall-app.mjsView on unpkg · L17

hooks/trace-mcp-reindex.shView file

•path = hooks/trace-mcp-reindex.sh kind = build_helper sizeBytes = 5195 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/trace-mcp-reindex.shView on unpkg

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 19434558 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 20655333 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 7-47json

7 "main": "dist/index.js",

8 "types": "dist/index.d.ts",

9 "bin": {

10 "trace-mcp": "dist/cli.js"

11 },

12 "scripts": {

13 "build": "tsup",

14 "dev": "tsup --watch",

15 "test": "vitest run",

16 "test:watch": "vitest",

17 "test:recall": "vitest run tests/recall-harness/recall.test.ts",

18 "test:recall:report": "tsx tests/recall-harness/runner.ts",

19 "typecheck": "tsc --noEmit",

20 "lint": "tsc --noEmit",

21 "format": "biome format --write",

22 "format:check": "biome format",

23 "biome:ci": "biome ci",

24 "serve": "tsx src/cli.ts serve",

25 "replay:check": "tsx scripts/replay-eval.ts",

26 "replay:update-baseline": "tsx scripts/replay-eval.ts --update-baseline",

27 "postinstall": "node scripts/preflight-native.mjs && node scripts/postinstall-app.mjs && node scripts/postinstall-control-plane.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 "prepublishOnly": "pnpm run build",

29 "prepare": "simple-git-hooks"

30 },

31 "simple-git-hooks": {

32 "pre-commit": "pnpm exec lint-staged"

33 },

34 "lint-staged": {

35 "*.{ts,tsx,js,jsx,mjs,cjs,json,jsonc,css}": [

36 "biome check --write --no-errors-on-unmatched"

37 ]

38 },

39 "engines": {

40 "node": ">=20.0.0"

41 },

42 "packageManager": "pnpm@10.33.0",

43 "license": "MIT",

44 "author": "Nikolai Vysotskyi",

45 "repository": {

46 "type": "git",

47 "url": "https://github.com/nikolai-vysotskyi/trace-mcp"

scripts/postinstall-control-plane.mjsView file

Lines 1-37javascript

1#!/usr/bin/env node

2

3/**

4 * postinstall hook for `npm install -g trace-mcp`.

5 *

6 * Self-heals the control plane so users don't have to run `trace-mcp init`

7 * manually after each install or upgrade. Specifically:

8 *

9 * 1. Writes ~/.trace-mcp/launcher.env with absolute Node + dist/cli.js paths.

10 * 2. Installs the launcher shim at ~/.trace-mcp/bin/trace-mcp (POSIX) or

11 * ~/.trace-mcp/bin/trace-mcp.cmd (Windows) by copying from hooks/.

scripts/postinstall-app.mjsView file

Lines 1-37javascript

1#!/usr/bin/env node

2

3/**

4 * postinstall hook for `npm install -g trace-mcp`.

5 * If the Electron menu bar app is already installed in ~/Applications/,

6 * re-download the latest release zip and replace it — so `npm update -g`

7 * automatically keeps the GUI app in sync.

8 *

9 * Hardening:

10 * - TRACE_MCP_NO_AUTO_UPDATE=1 skips the update entirely.

11 * - SHA-256 of the downloaded zip is verified against a sibling

hooks/trace-mcp-reindex.shView file

•path = hooks/trace-mcp-reindex.sh kind = build_helper sizeBytes = 5195 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/trace-mcp-reindex.shView on unpkg

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 19434558 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 20655333 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg