trace-mcp@3.36.4
Framework-aware code intelligence MCP server — 88 framework integrations, 81 languages, 72.7% fewer input tokens to review a pull request, comprehension at parity
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe similarity signals are not proof of malicious behavior, and the required source excerpts are consistent with package benchmarks, update checks, and package-owned configuration references. The postinstall hook warrants scrutiny, but inspected evidence does not establish a concrete attack surface.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Package installation runs the postinstall script chain.
Impact
No confirmed attack impact was established from the inspected source.
Mechanism
The inspected package manifest invokes native preflight, app update, and package control-plane setup; no inspected evidence shows credential exfiltration or a foreign agent configuration write.
AI rationale
The similarity signals are not proof of malicious behavior, and the required source excerpts are consistent with package benchmarks, update checks, and package-owned configuration references. The postinstall hook warrants scrutiny, but inspected evidence does not establish a concrete attack surface.
Evidence
package.jsondist/extract-worker.jsdist/proxy.jsscripts/bench-name-tokens.tsscripts/state-trace-replay.ts
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- package.json defines postinstall as a chain of package-owned native preflight, app update, and control-plane setup scripts.
- dist/extract-worker.js and dist/proxy.js contain Claude and Codex configuration path constants at the indicated locations; these excerpts do not show a configuration write.
- scripts/bench-name-tokens.ts reads repository instruction files as benchmark inputs, and scripts/state-trace-replay.ts enumerates session directories for replay.
- The remaining cited scripts describe screenshot capture, update verification, fixture recording, indexing and response benchmarks, documentation generation, and daemon performance measurement.
- No inspected source established credential collection, exfiltration, malicious payload execution, or an unconsented write to a foreign agent control surface.
Evidence against
- The package has an automatic postinstall hook that also runs a control-plane setup script.
- The control-plane script describes installing a package-owned launcher and macOS LaunchAgent; no cited source shows this targeting a foreign agent configuration.
Behavioral surface
Source & flagged code
26 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/preflight-native.mjs && node scripts/postinstall-app.mjs && node scripts/postinstall-control-plane.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/preflight-native.mjs && node scripts/postinstall-app.mjs && node scripts/postinstall-control-plane.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/proxy.jsView file
27686// src/daemon/lifecycle.ts
L27687: import { execSync, execFileSync as execFileSync2, spawn } from "child_process";
L27688: import fs14 from "fs";
High
Findings
20 High9 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/proxy.js
HighShelldist/proxy.js
HighSame File Env Network Executionscripts/capture-screenshots.mjs#virtual:normalized:round1
HighCommand Output Exfiltrationscripts/capture-screenshots.mjs#virtual:normalized:round1
HighSandbox Evasion Gated Capabilityscripts/verify-upgrade-path.mjs
HighRuntime Package Installscripts/record-wire-fixtures.ts
HighSemantic Analysis Limitedscripts/bench-index-throughput.ts#virtual:normalized:round1
HighKnown Malware Source Similarityscripts/capture-screenshots.mjs
HighKnown Malware Source Similarityscripts/verify-upgrade-path.mjs
Affected versions and remediation
This report applies to trace-mcp@3.36.4.
See all versions of trace-mcp for other recorded verdicts.
- Review the evidence and your use of trace-mcp@3.36.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.