registry / AI-agent capability abuse / tracist / 0.0.55

tracist@0.0.55

Upload and continuously stream local AI coding transcripts to Tracist

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

No covert install-time behavior or evidence of malicious intent was found, and the core transcript-upload function is disclosed. However, the persistent remote control channel exposes broad file and agent-control capabilities beyond simple upload.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

User runs `tracist install`, then the daemon authenticates and streams transcripts.

Impact

A compromised or malicious Tracist server/token context could exfiltrate user-readable files or cause workspace changes via the daemon.

Mechanism

Remote queue control over local filesystem and agent sessions

AI rationale

Evidence

package.jsonbin/tracist.jsscripts/capture-resume-multiturn.jsREADME.md~/.claude/projects~/.cursor/projects~/.codex/sessions~/.config/systemd/user/tracist.service~/Library/LaunchAgents/dev.tracist.daemon.plist

Network endpoints2

tracist.devwss://tracist.dev/api/transcripts/machines/<machineId>/socket

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

scripts/capture-resume-multiturn.js accepts server filesystem list/read requests.
Server-provided saves can overwrite existing files under an arbitrary supplied root.
Persistent queue dispatch forwards server messages into local agent sessions.
bin/tracist.js install creates a user daemon and auto-updates its private runtime.

Evidence against

README.md accurately describes transcript upload and explicit install.
package.json has only prepare; no preinstall/install/postinstall hook.
Daemon installation requires explicit `tracist install`.
Transcript uploads target the declared Tracist service and use token redaction.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

Source & flagged code

7 flagged

bin/tracist.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2"use strict";

3const fs = require("node:fs");

4const crypto = require("node:crypto");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/tracist.jsView on unpkg · L2

5const os = require("node:os");

6const path = require("node:path");

7const readline = require("node:readline/promises");

8const { spawn, spawnSync } = require("node:child_process");

9const WebSocket = require("ws");

High

Child Process

Package source references child process execution.

bin/tracist.jsView on unpkg · L7

10const {

11 connectDaemonControl,

12 startDaemonControlServer

13} = require("../lib/daemon-control.js");

14const {

15 ClientUpgradeRequiredError,

16 assertSupportedClientVersion,

17 compareClientVersions

18} = require("../lib/client-version.js");

19const { formatCompactTimestamp: formatSessionActivityDate } = require("../shared/compact-timestamp.js");

20const packageRoot = path.resolve(__dirname, "..");

21const pkg = require(path.join(packageRoot, "package.json"));

22const uploader = require(path.join(packageRoot, "scripts", "capture-resume-multiturn.js"));

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/tracist.jsView on unpkg · L7

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/tracist.jsView on unpkg · L7

23const defaultOrigin = "https://tracist.dev";

24const daemonNodeArguments = ["--max-old-space-size=256", "--max-semi-space-size=8"];

25const daemonUpgradeRetryMs = 5 * 60 * 1e3;

26const daemonUpgradeMaxRetryMs = 6 * 60 * 60 * 1e3;

27const daemonRuntimeFiles = [

scripts/capture-resume-multiturn.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2const fs = require("node:fs");

3const os = require("node:os");

4const path

Source & flagged code

7 flagged · loading source

bin/tracist.jsView file

7const readline = require("node:readline/promises"); L8: const { spawn, spawnSync } = require("node:child_process"); L9: const WebSocket = require("ws");

High

Child Process

Package source references child process execution.

bin/tracist.jsView on unpkg · L7

7Trigger-reachable persistence chain: manifest.bin -> bin/tracist.js L7: const readline = require("node:readline/promises"); L8: const { spawn, spawnSync } = require("node:child_process"); L9: const WebSocket = require("ws"); L10: const { ... L19: const { formatCompactTimestamp: formatSessionActivityDate } = require("../shared/compact-timestamp.js"); L20: const packageRoot = path.resolve(__dirname, ".."); L21: const pkg = require(path.join(packageRoot, "package.json")); L22: const uploader = require(path.join(packageRoot, "scripts", "capture-resume-multiturn.js")); ... L45: const home = os.homedir(); L46: const configBase = process.env.TRACIST_CONFIG_DIR || (process.platform === "win32" ? process.env.APPDATA || path.join(home, "AppData", "Roaming") : process.platform === "darwin" ? ... L47:

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/tracist.jsView on unpkg · L7

2"use strict"; L3: const fs = require("node:fs"); L4: const crypto = require("node:crypto");

Findings

2 Critical3 High5 Medium6 Low

CriticalCommand Output Exfiltrationscripts/capture-resume-multiturn.js

CriticalPrevious Version Dangerous Deltascripts/capture-resume-multiturn.js

HighChild Processbin/tracist.js

HighSandbox Evasion Gated Capabilityscripts/capture-resume-multiturn.js

HighTrigger Reachable Persistencebin/tracist.js

MediumDynamic Requirebin/tracist.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencebin/tracist.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

Low

Affected versions and remediation

This report applies to tracist@0.0.55.

See all versions of tracist for other recorded verdicts.

Review the evidence and your use of tracist@0.0.55 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-05 11:05:53.709Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.