trace-mcp@3.1.1
Framework-aware code intelligence MCP server — 60 framework integrations, 81 languages, up to 99% token reduction
AI Security Review
scanned 25d ago · by lpm-firewall-aiAutomatic installation-time daemon persistence and remote application-update behavior create a real supply-chain risk that warrants a warning. The available guards and package-scoped paths do not establish a concrete malicious attack.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
npm installation or upgrade runs the postinstall hook.
Impact
A package-controlled daemon can persist and start without a separate user command. No credential theft, broad agent-control mutation, or confirmed remote code execution was established.
Mechanism
The hook writes the package launch agent and invokes launchd bootstrap; a separate hook requests release metadata and can download a matching application asset.
AI rationale
Automatic installation-time daemon persistence and remote application-update behavior create a real supply-chain risk that warrants a warning. The available guards and package-scoped paths do not establish a concrete malicious attack.
Evidence
package.jsonscripts/postinstall-control-plane.mjsscripts/postinstall-app.mjs~/Library/LaunchAgents/com.trace-mcp.server.plist~/.trace-mcp/launcher.env~/.trace-mcp/bin/trace-mcp
Network endpoints1
api.github.com/repos/${GITHUB_REPO}/releases/latest
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package runs three scripts automatically after installation.
- The control-plane installer writes a per-user launch agent configuration and bootstraps it, starting a daemon on first installation.
- The application updater fetches release metadata from GitHub during installation.
Evidence against
- The launch-agent path is limited to this package's named service and has an opt-out sentinel.
- The updater checks for a matching checksum before replacing an existing macOS application.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/preflight-native.mjs && node scripts/postinstall-app.mjs && node scripts/postinstall-control-plane.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/preflight-native.mjs && node scripts/postinstall-app.mjs && node scripts/postinstall-control-plane.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/postinstall-app.mjsView file
17* not destroy the working installation.
L18: * - `unzip` is invoked with execFileSync (no shell) to avoid argument
L19: * injection via asset names.
...
L23:
L24: import { execFileSync } from 'node:child_process';
L25: import crypto from 'node:crypto';
L26: import fs from 'node:fs';
L27: import http from 'node:http';
L28: import https from 'node:https';
...
L49:
L50: if (process.env.TRACE_MCP_NO_AUTO_UPDATE === '1') process.exit(0);
L51:
Findings
6 High8 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilityscripts/postinstall-app.mjs
HighSemantic Analysis Limitedscripts/calibrate-health-metrics.mjs#virtual:normalized:round1
HighKnown Malware Source Similarityscripts/bench-toon.ts
HighKnown Malware Source Similarityscripts/count-advertised-tools.mjs
HighPrevious Version Dangerous Deltascripts/postinstall-app.mjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Require
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperhooks/trace-mcp-reindex.sh
MediumOversized Source Filedist/index.js
Affected versions and remediation
This report applies to trace-mcp@3.1.1.
See all versions of trace-mcp for other recorded verdicts.
- Review the evidence and your use of trace-mcp@3.1.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.