registry / AI-agent capability abuse / tracist / 0.0.53

tracist@0.0.53

Upload and continuously stream local AI coding transcripts to Tracist

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

This is not malicious npm lifecycle behavior, but source confirms an undocumented high-impact remote AI-agent and workspace-control capability in the normal authenticated streaming path. Warn rather than block because activation requires explicit user execution and authentication.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs `tracist`/`tracist upload` after authentication; daemon persistence additionally requires `tracist install`.

Impact

A compromised or malicious Tracist service could read or modify scoped project files and cause local coding agents to execute remote prompts with approvals bypassed.

Mechanism

Remote queue control over authenticated WebSockets invokes filesystem and AI-agent actions.

AI rationale

Evidence

package.jsonbin/tracist.jsscripts/capture-resume-multiturn.jstools/secret-redaction.js~/.config/systemd/user/tracist.service~/Library/LaunchAgents/dev.tracist.daemon.plist

Network endpoints3

tracist.devwss://tracist.dev/api/transcripts/machines/<machineId>/socketwss://tracist.dev/api/transcripts/machines/<machineId>/sessions/<sessionId>/socket

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

scripts/capture-resume-multiturn.js accepts server-sent filesystem read requests.
It accepts server-queued file saves within a session working directory.
Queued prompts launch/resume AI agents with bypass-permission flags, including Codex sandbox/approval bypass.
bin/tracist.js runs the control-capable streamer by default after user authentication.
bin/tracist.js can install a persistent user daemon on explicit `install`.

Evidence against

package.json `prepare` only builds package-local runtime files; it does not install or start the daemon.
The documented purpose is transcript upload and the network host defaults to tracist.dev.
Secret-redaction code is applied to outbound transcript content.
Persistence requires the explicit `tracist install` command.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

Source & flagged code

7 flagged

bin/tracist.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2"use strict";

3const fs = require("node:fs");

4const crypto = require("node:crypto");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/tracist.jsView on unpkg · L2

5const os = require("node:os");

6const path = require("node:path");

7const readline = require("node:readline/promises");

8const { spawn, spawnSync } = require("node:child_process");

9const WebSocket = require("ws");

High

Child Process

Package source references child process execution.

bin/tracist.jsView on unpkg · L7

10const {

11 connectDaemonControl,

12 startDaemonControlServer

13} = require("../lib/daemon-control.js");

14const {

15 ClientUpgradeRequiredError,

16 assertSupportedClientVersion,

17 compareClientVersions

18} = require("../lib/client-version.js");

19const { formatCompactTimestamp: formatSessionActivityDate } = require("../shared/compact-timestamp.js");

20const packageRoot = path.resolve(__dirname, "..");

21const pkg = require(path.join(packageRoot, "package.json"));

22const uploader = require(path.join(packageRoot, "scripts", "capture-resume-multiturn.js"));

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/tracist.jsView on unpkg · L7

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/tracist.jsView on unpkg · L7

23const defaultOrigin = "https://tracist.dev";

24const daemonNodeArguments = ["--max-old-space-size=256", "--max-semi-space-size=8"];

25const daemonUpgradeRetryMs = 5 * 60 * 1e3;

26const daemonUpgradeMaxRetryMs = 6 * 60 * 60 * 1e3;

27const daemonRuntimeFiles = [

scripts/capture-resume-multiturn.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2const fs = require("node:fs");

3const os = require("node:os");

4const path

Source & flagged code

7 flagged · loading source

bin/tracist.jsView file

7const readline = require("node:readline/promises"); L8: const { spawn, spawnSync } = require("node:child_process"); L9: const WebSocket = require("ws");

High

Child Process

Package source references child process execution.

bin/tracist.jsView on unpkg · L7

7Trigger-reachable persistence chain: manifest.bin -> bin/tracist.js L7: const readline = require("node:readline/promises"); L8: const { spawn, spawnSync } = require("node:child_process"); L9: const WebSocket = require("ws"); L10: const { ... L19: const { formatCompactTimestamp: formatSessionActivityDate } = require("../shared/compact-timestamp.js"); L20: const packageRoot = path.resolve(__dirname, ".."); L21: const pkg = require(path.join(packageRoot, "package.json")); L22: const uploader = require(path.join(packageRoot, "scripts", "capture-resume-multiturn.js")); ... L45: const home = os.homedir(); L46: const configBase = process.env.TRACIST_CONFIG_DIR || (process.platform === "win32" ? process.env.APPDATA || path.join(home, "AppData", "Roaming") : process.platform === "darwin" ? ... L47:

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/tracist.jsView on unpkg · L7

2"use strict"; L3: const fs = require("node:fs"); L4: const crypto = require("node:crypto");

Findings

1 Critical4 High5 Medium6 Low

CriticalCommand Output Exfiltrationscripts/capture-resume-multiturn.js

HighChild Processbin/tracist.js

HighSame File Env Network Executionscripts/capture-resume-multiturn.js

HighSandbox Evasion Gated Capabilityscripts/capture-resume-multiturn.js

HighTrigger Reachable Persistencebin/tracist.js

MediumDynamic Requirebin/tracist.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencebin/tracist.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

Low

Affected versions and remediation

This report applies to tracist@0.0.53.

See all versions of tracist for other recorded verdicts.

Review the evidence and your use of tracist@0.0.53 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-05 10:11:42.059Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.