registry / Remote code execution / tracist
tracist
Upload and continuously stream local AI coding transcripts to Tracist
This report shows the evidence for tracist@0.0.65. 2 of 31 known versions are blocked or flagged. The newest version, 0.0.92, is flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a concrete remote-control channel with arbitrary-root file read/write and local agent prompt execution, activated by a persistent daemon. The lack of install hooks reduces exposure but does not remove the confirmed attack surface.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User runs `tracist install`; the installed daemon connects and receives WebSocket messages.
Impact
Remote service compromise can exfiltrate local files, alter files, and induce local agent actions.
Mechanism
Persistent remote filesystem and AI-agent control channel
Attack narrative
`tracist install` creates a persistent per-user daemon. Its normal streamer defaults to queue mode, opens a WebSocket to the service, and dispatches server messages. A `filesystem_request` supplies an arbitrary absolute root and receives directory/file data; the session check does not bind that root to a project. `file_save_ready` can replace a chosen existing file once its hash is known. Queue messages are supplied to local AI-agent harnesses, enabling remote prompt-driven local actions. These capabilities are not disclosed by the README's transcript-upload description.
AI rationale
This is a concrete remote-control channel with arbitrary-root file read/write and local agent prompt execution, activated by a persistent daemon. The lack of install hooks reduces exposure but does not remove the confirmed attack surface.
Evidence
package.jsonbin/tracist.jsscripts/capture-resume-multiturn.jsscripts/transcript-agent-anchor.jsREADME.md~/.config/systemd/user/tracist.service~/Library/LaunchAgents/dev.tracist.daemon.plist~/.local/share/tracist/runtime~/.local/state/tracist
Network endpoints2
tracist.devwss://tracist.dev/api/transcripts/machines/{machineId}/socket
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- scripts/capture-resume-multiturn.js accepts server `filesystem_request` messages and returns file contents over its WebSocket.
- The request-controlled `root` is not bound to the session working directory; any existing absolute directory can be supplied.
- Server-directed `file_save_ready` writes supplied content after only a hash check.
- Queued server messages are passed to local AI-agent harnesses as prompts.
- bin/tracist.js installs a persistent user daemon that starts this queue-capable streamer.
Evidence against
- package.json has no npm lifecycle hooks.
- Persistence requires the explicit `tracist install` command.
- Transcript uploads use a stated default endpoint and include secret-redaction code.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
8 flagged · loading sourcebin/tracist.jsView file
7const readline = require("node:readline/promises");
L8: const { spawn, spawnSync } = require("node:child_process");
L9: const WebSocket = require("ws");
High
7Trigger-reachable persistence chain: manifest.bin -> bin/tracist.js
L7: const readline = require("node:readline/promises");
L8: const { spawn, spawnSync } = require("node:child_process");
L9: const WebSocket = require("ws");
L10: const {
...
L19: const { formatCompactTimestamp: formatSessionActivityDate } = require("../shared/compact-timestamp.js");
L20: const packageRoot = path.resolve(__dirname, "..");
L21: const pkg = require(path.join(packageRoot, "package.json"));
L22: const uploader = require(path.join(packageRoot, "scripts", "capture-resume-multiturn.js"));
...
L45: const home = os.homedir();
L46: const configBase = process.env.TRACIST_CONFIG_DIR || (process.platform === "win32" ? process.env.APPDATA || path.join(home, "AppData", "Roaming") : process.platform === "darwin" ? ...
L47:
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
bin/tracist.jsView on unpkg · L72"use strict";
L3: const fs = require("node:fs");
L4: const crypto = require("node:crypto");
Findings
2 Critical4 High5 Medium4 Low
CriticalCommand Output Exfiltrationscripts/capture-resume-multiturn.js
CriticalPrevious Version Dangerous Deltascripts/capture-resume-multiturn.js
HighChild Processbin/tracist.js
HighSame File Env Network Executionscripts/capture-resume-multiturn.js
HighSandbox Evasion Gated Capabilityscripts/capture-resume-multiturn.js
HighTrigger Reachable Persistencebin/tracist.js
MediumDynamic Requirebin/tracist.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencebin/tracist.js
MediumStructural Risk Force Deep Review
LowFilesystem
Low
Affected versions and remediation
This report applies to tracist@0.0.65.
The versions list below shows the verdict for each recorded version.
- Avoid installing tracist@0.0.65. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
31 known versions0.0.92latestSuspiciousAI-agent capability abuseWarnPublishedAug 7, 2026, 4:46 AM0.0.87SuspiciousAI-agent capability abuseWarnPublishedAug 6, 2026, 9:03 PM0.0.85SuspiciousAI-agent capability abuseWarnPublishedAug 6, 2026, 7:22 PM0.0.84SuspiciousAI-agent capability abuseWarnPublishedAug 6, 2026, 6:43 PM