trace-mcp@2.0.1
Framework-aware code intelligence MCP server — 60 framework integrations, 81 languages, up to 99% token reduction
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe package has an automatic lifecycle hook that establishes a package-owned background service. This is a concrete extension lifecycle risk, but the inspected source does not establish malware behavior.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installing or upgrading the package invokes postinstall.
Impact
This creates automatic package-owned background-service persistence, which is a guarded agent-extension lifecycle risk.
Mechanism
The lifecycle script writes a package-specific LaunchAgent plist and bootstraps it; a separate script contacts the GitHub release API for an existing app update.
AI rationale
The package has an automatic lifecycle hook that establishes a package-owned background service. This is a concrete extension lifecycle risk, but the inspected source does not establish malware behavior.
Evidence
scripts/postinstall-control-plane.mjsscripts/postinstall-app.mjs
Network endpoints1
api.github.com/repos/${GITHUB_REPO}/releases/latest
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package runs three scripts automatically through a postinstall hook.
- The control-plane script writes a macOS LaunchAgent plist and bootstraps it, causing a package daemon to start at login.
- The app postinstall checks the package release feed for a downloadable application update.
Evidence against
- The launch-agent behavior is limited to macOS and has an environment-variable opt-out.
- No credential collection, secret transmission, or unrelated recipient was identified in the inspected lifecycle code.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/preflight-native.mjs && node scripts/postinstall-app.mjs && node scripts/postinstall-control-plane.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/preflight-native.mjs && node scripts/postinstall-app.mjs && node scripts/postinstall-control-plane.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/postinstall-app.mjsView file
17* not destroy the working installation.
L18: * - `unzip` is invoked with execFileSync (no shell) to avoid argument
L19: * injection via asset names.
...
L23:
L24: import { execFileSync } from 'node:child_process';
L25: import crypto from 'node:crypto';
L26: import fs from 'node:fs';
L27: import http from 'node:http';
L28: import https from 'node:https';
...
L49:
L50: if (process.env.TRACE_MCP_NO_AUTO_UPDATE === '1') process.exit(0);
L51:
Findings
6 High8 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilityscripts/postinstall-app.mjs
HighSemantic Analysis Limitedscripts/calibrate-health-metrics.mjs#virtual:normalized:round1
HighKnown Malware Source Similarityscripts/bench-toon.ts
HighKnown Malware Source Similarityscripts/count-advertised-tools.mjs
HighPrevious Version Dangerous Deltascripts/postinstall-app.mjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Require
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperhooks/trace-mcp-reindex.sh
MediumOversized Source Filedist/index.js
Affected versions and remediation
This report applies to trace-mcp@2.0.1.
See all versions of trace-mcp for other recorded verdicts.
- Review the evidence and your use of trace-mcp@2.0.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.