trace-mcp@1.48.1
Framework-aware code intelligence MCP server — 60 framework integrations, 81 languages, up to 99% token reduction
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe code establishes first-party background-service persistence during postinstall, but the reviewed evidence does not show credential theft, foreign agent-control writes, or a concrete hostile payload. This is a guarded lifecycle risk rather than proven malware.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installing or upgrading the package runs its postinstall hook.
Impact
A package-controlled service can be started without a separate user command, creating a lifecycle persistence risk.
Mechanism
The postinstall control-plane writes a package-owned launcher and LaunchAgent, then bootstraps it; a separate updater requests package release metadata.
AI rationale
The code establishes first-party background-service persistence during postinstall, but the reviewed evidence does not show credential theft, foreign agent-control writes, or a concrete hostile payload. This is a guarded lifecycle risk rather than proven malware.
Evidence
package.jsonscripts/postinstall-control-plane.mjsscripts/postinstall-app.mjs
Network endpoints1
api.github.com/repos/${GITHUB_REPO}/releases/latest
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package runs three scripts automatically at postinstall.
- The control-plane script writes a macOS LaunchAgent and invokes its bootstrap path, starting the package daemon on first install.
- The postinstall updater contacts GitHub Releases and requires a checksum asset before updating an existing app.
Evidence against
- The service is scoped to trace-mcp paths and has an environment-based opt-out.
- No credential collection, foreign AI-agent configuration write, or secret transmission was identified in the inspected lifecycle code.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
9 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/preflight-native.mjs && node scripts/postinstall-app.mjs && node scripts/postinstall-control-plane.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/preflight-native.mjs && node scripts/postinstall-app.mjs && node scripts/postinstall-control-plane.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/postinstall-app.mjsView file
17* not destroy the working installation.
L18: * - `unzip` is invoked with execFileSync (no shell) to avoid argument
L19: * injection via asset names.
...
L23:
L24: import { execFileSync } from 'node:child_process';
L25: import crypto from 'node:crypto';
L26: import fs from 'node:fs';
L27: import http from 'node:http';
L28: import https from 'node:https';
...
L46: // The compiled app lives in a separate PUBLIC distribution repo (the source
L47: // is private). See scripts/app-dist-repo.mjs. Overridable via env.
L48: const GITHUB_REPO = getAppDistRepo();
Findings
5 High8 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilityscripts/postinstall-app.mjs
HighSemantic Analysis Limitedscripts/calibrate-health-metrics.mjs#virtual:normalized:round1
HighKnown Malware Source Similarityscripts/bench-toon.ts
HighPrevious Version Dangerous Deltascripts/postinstall-app.mjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Require
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperhooks/trace-mcp-reindex.sh
MediumOversized Source Filedist/index.js
MediumOversized Cli Entrypointdist/cli.js
Affected versions and remediation
This report applies to trace-mcp@1.48.1.
See all versions of trace-mcp for other recorded verdicts.
- Review the evidence and your use of trace-mcp@1.48.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.