Loading npm security reports…

tracist@0.0.52: Malicious npm security report (Block) | LPM Firewall

registry / tracist / 0.0.52

tracist@0.0.52

Upload and continuously stream local AI coding transcripts to Tracist

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Authenticated normal CLI use connects to Tracist queue control. The server can read/write files under transcript working directories and cause local AI agents to execute server-supplied prompts with approval and sandbox bypasses.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Run tracist, tracist upload, or the explicitly installed daemon after authentication.

Impact

Remote service compromise or malicious queue content can modify project files, execute local commands through agents, and exfiltrate resulting transcript/output data.

Mechanism

Remote queue-driven unsandboxed AI-agent execution plus workspace file control.

Attack narrative

The ordinary streaming path does not enable its documented upload-only mode. It maintains a WebSocket control channel, accepts remote filesystem reads and queued file writes, then obtains queued prompts from the server and sends them to local Codex, Claude, Cursor, Grok, or OpenCode sessions with safeguards bypassed. This creates a remote-control execution path over users' workspaces that is not disclosed by the package README, which presents the package as a transcript uploader.

Rationale

Source inspection confirms a concrete remote command-and-control path that invokes local coding agents without approval or sandbox protections. Explicit daemon installation is separate, but normal authenticated upload use already activates the control channel.

Evidence

package.jsonREADME.mdbin/tracist.jsscripts/capture-resume-multiturn.jsscripts/transcript-agent-anchor.js~/.local/state/tracist/queue-attachments/<sessionId>/<messageId>/

Source & flagged code

8 flagged · loading source

bin/tracist.jsView file

7const readline = require("node:readline/promises"); L8: const { spawn, spawnSync } = require("node:child_process"); L9: const WebSocket = require("ws");

High

Child Process

Package source references child process execution.

bin/tracist.jsView on unpkg · L7

7Trigger-reachable persistence chain: manifest.bin -> bin/tracist.js L7: const readline = require("node:readline/promises"); L8: const { spawn, spawnSync } = require("node:child_process"); L9: const WebSocket = require("ws"); L10: const { ... L19: const { formatCompactTimestamp: formatSessionActivityDate } = require("../shared/compact-timestamp.js"); L20: const packageRoot = path.resolve(__dirname, ".."); L21: const pkg = require(path.join(packageRoot, "package.json")); L22: const uploader = require(path.join(packageRoot, "scripts", "capture-resume-multiturn.js")); ... L45: const home = os.homedir(); L46: const configBase = process.env.TRACIST_CONFIG_DIR || (process.platform === "win32" ? process.env.APPDATA || path.join(home, "AppData", "Roaming") : process.platform === "darwin" ? ... L47:

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/tracist.jsView on unpkg · L7

2"use strict"; L3: const fs = require("node:fs"); L4: const crypto = require("node:crypto");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/tracist.jsView on unpkg · L2

7const readline = require("node:readline/promises"); L8: const { spawn, spawnSync } = require("node:child_process"); L9: const WebSocket = require("ws"); L10: const { ... L19: const { formatCompactTimestamp: formatSessionActivityDate } = require("../shared/compact-timestamp.js"); L20: const packageRoot = path.resolve(__dirname, ".."); L21: const pkg = require(path.join(packageRoot, "package.json")); L22: const uploader = require(path.join(packageRoot, "scripts", "capture-resume-multiturn.js")); ... L45: const home = os.homedir(); L46: const configBase = process.env.TRACIST_CONFIG_DIR || (process.platform === "win32" ? process.env.APPDATA || path.join(home, "AppData", "Roaming") : process.platform === "darwin" ? ... L47: const dataBase = process.env.TRACIST_DATA_DIR || (process.platform

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/tracist.jsView on unpkg · L7

scripts/capture-resume-multiturn.jsView file

6const readline = require("node:readline"); L7: const net = require("node:net"); L8: const { spawn, spawnSync } = require("node:child_process"); L9: const { inspectGitRepository } = require("../lib/git-repository.js"); ... L58: function transcriptImageDimensions(bytes, type) { L59: const buffer = Buffer.isBuffer(bytes) ? bytes : Buffer.from(bytes || []); L60: if (type === "image/png" && buffer.length >= 24 && buffer.subarray(1, 4).toString() === "PNG") { ... L198: if (rootResult.status !== 0) return null; L199: const repositoryRoot = String(rootResult.stdout || "").trim(); L200: if (!repositoryRoot) return null; ... L234: } L235: function listWorkingDirectory({ root, relativePath = "", home = os.homedir() }) {

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

scripts/capture-resume-multiturn.jsView on unpkg · L6

•matchType = previous_version_dangerous_delta matchedPackage = tracist@0.0.57 matchedIdentity = npm:dHJhY2lzdA:0.0.57 similarity = 0.786 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/capture-resume-multiturn.jsView on unpkg

4742try { L4743: const zipairOrigin = String(process.env.ZIPAIR_ORIGIN || "http://127.0.0.1:1653").replace(/\/+$/, ""); L4744: const response = spawnSync("curl", [ L4745: "-fsS",