trace-mcp@1.48.4
Framework-aware code intelligence MCP server — 60 framework integrations, 81 languages, up to 99% token reduction
AI Security Review
scanned 25d ago · by lpm-firewall-aiPostinstall installs this package's own KeepAlive launch agent and can swap its desktop app for a checksum-checked GitHub release, which is first-party install-time persistence rather than a foreign agent-config hijack. Opt-outs and checksum gates keep it short of a hidden malware chain, so the right action is a warning.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
npm install or update executes the package.json postinstall script.
Impact
A background serve-http process is installed to run at login and stay alive. An existing Trace MCP app can be replaced from the publisher's release repository during install.
Mechanism
postinstall-control-plane.mjs writes a KeepAlive LaunchAgent and bootstraps it. postinstall-app.mjs fetches nikolai-vysotskyi/trace-mcp-app-dist latest release, verifies SHA-256, unzips, and swaps the app bundle when one is already present.
AI rationale
Postinstall installs this package's own KeepAlive launch agent and can swap its desktop app for a checksum-checked GitHub release, which is first-party install-time persistence rather than a foreign agent-config hijack. Opt-outs and checksum gates keep it short of a hidden malware chain, so the right action is a warning.
Evidence
package.jsonscripts/postinstall-control-plane.mjsscripts/postinstall-app.mjsscripts/app-dist-repo.mjs~/Library/LaunchAgents/com.trace-mcp.server.plist~/.trace-mcp/launcher.env~/.trace-mcp/bin/trace-mcp
Network endpoints2
api.github.com/repos/nikolai-vysotskyi/trace-mcp-app-dist/releases/latest127.0.0.1:3741/health
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- npm postinstall always runs preflight-native.mjs, postinstall-app.mjs, and postinstall-control-plane.mjs.
- On macOS the control-plane script writes ~/Library/LaunchAgents/com.trace-mcp.server.plist with RunAtLoad and KeepAlive, then launchctl-enables and bootstraps it so serve-http starts during install.
- If a desktop app bundle is already installed, postinstall-app downloads the latest GitHub release zip, checks a sibling SHA-256 asset, unzips it, and replaces the app when Gatekeeper trust is not downgraded.
- TRACE_MCP_NO_POSTINSTALL, a daemon.disabled file, CI, and dev-checkout detection can skip parts of this install behavior.
Evidence against
- The launch agent and launcher shim are this package's own daemon, not a write to Claude, Codex, or another foreign agent settings file.
- The app update runs only when an existing install is found, requires a checksum asset, and aborts on digest mismatch.
- Dependencies do not include a runtime self-dependency on trace-mcp.
- Plugin hook JSON ships inside the package and is not applied by the postinstall scripts.
Behavioral surface
Source & flagged code
9 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/preflight-native.mjs && node scripts/postinstall-app.mjs && node scripts/postinstall-control-plane.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/preflight-native.mjs && node scripts/postinstall-app.mjs && node scripts/postinstall-control-plane.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/postinstall-app.mjsView file
17* not destroy the working installation.
L18: * - `unzip` is invoked with execFileSync (no shell) to avoid argument
L19: * injection via asset names.
...
L23:
L24: import { execFileSync } from 'node:child_process';
L25: import crypto from 'node:crypto';
L26: import fs from 'node:fs';
L27: import http from 'node:http';
L28: import https from 'node:https';
...
L46: // The compiled app lives in a separate PUBLIC distribution repo (the source
L47: // is private). See scripts/app-dist-repo.mjs. Overridable via env.
L48: const GITHUB_REPO = getAppDistRepo();
Findings
5 High8 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilityscripts/postinstall-app.mjs
HighSemantic Analysis Limitedscripts/calibrate-health-metrics.mjs#virtual:normalized:round1
HighKnown Malware Source Similarityscripts/bench-toon.ts
HighPrevious Version Dangerous Deltascripts/postinstall-app.mjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Require
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperhooks/trace-mcp-reindex.sh
MediumOversized Source Filedist/index.js
MediumOversized Cli Entrypointdist/cli.js
Affected versions and remediation
This report applies to trace-mcp@1.48.4.
See all versions of trace-mcp for other recorded verdicts.
- Review the evidence and your use of trace-mcp@1.48.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.