registry / AI-agent capability abuse / tracist / 0.0.57

tracist@0.0.57

Upload and continuously stream local AI coding transcripts to Tracist

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The source establishes a real remote AI-agent control capability with no per-prompt local confirmation, but it is activated through an explicit user command rather than an npm lifecycle hook. This warrants a warning rather than a publication block under the stated policy.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs `tracist install` (or otherwise runs the streaming daemon) and authenticates.

Impact

A compromised or abusive Tracist service/account could induce local file or command actions through the user's installed AI-agent tooling.

Mechanism

Remote queued-prompt dispatch into unrestricted local AI-agent sessions.

AI rationale

Evidence

package.jsonbin/tracist.jsscripts/capture-resume-multiturn.jstools/secret-redaction.js$HOME/.config/systemd/user/tracist.service$HOME/Library/LaunchAgents/dev.tracist.daemon.plist$HOME/.local/share/tracist/runtime$HOME/.local/state/tracist/transcript-streamer.json$HOME/.local/state/tracist/queue-attachments/<sessionId>/<messageId>

Network endpoints2

tracist.devwss://tracist.dev/api/transcripts/machines/<machineId>/socket

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`scripts/capture-resume-multiturn.js` accepts server queue messages over an authenticated WebSocket.
Queued messages are forwarded as prompts to local agent harnesses without a local approval step.
`WarmCodexHarness` starts/resumes Codex with `sandbox: "danger-full-access"` and `approvalPolicy: "never"`.
`bin/tracist.js install` explicitly creates a persistent user daemon that runs this streamer.
Remote filesystem list/search/read requests are serviced for known local transcript sessions.

Evidence against

No preinstall/install/postinstall hook; `prepare` only invokes esbuild.
The CLI and README disclose transcript uploading and an explicit `tracist install` daemon command.
Uploads use the package-aligned `tracist.dev` origin and bearer authentication.
`tools/secret-redaction.js` redacts common credential patterns before transcript processing.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem

Source & flagged code

7 flagged

bin/tracist.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2"use strict";

3const fs = require("node:fs");

4const crypto = require("node:crypto");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/tracist.jsView on unpkg · L2

5const os = require("node:os");

6const path = require("node:path");

7const readline = require("node:readline/promises");

8const { spawn, spawnSync } = require("node:child_process");

9const WebSocket = require("ws");

High

Child Process

Package source references child process execution.

bin/tracist.jsView on unpkg · L7

10const {

11 connectDaemonControl,

12 startDaemonControlServer

13} = require("../lib/daemon-control.js");

14const {

15 ClientUpgradeRequiredError,

16 assertSupportedClientVersion,

17 compareClientVersions

18} = require("../lib/client-version.js");

19const { formatCompactTimestamp: formatSessionActivityDate } = require("../shared/compact-timestamp.js");

20const packageRoot = path.resolve(__dirname, "..");

21const pkg = require(path.join(packageRoot, "package.json"));

22const uploader = require(path.join(packageRoot, "scripts", "capture-resume-multiturn.js"));

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/tracist.jsView on unpkg · L7

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/tracist.jsView on unpkg · L7

23const defaultOrigin = "https://tracist.dev";

24const daemonNodeArguments = ["--max-old-space-size=256", "--max-semi-space-size=8"];

25const daemonUpgradeRetryMs = 5 * 60 * 1e3;

26const daemonUpgradeMaxRetryMs = 6 * 60 * 60 * 1e3;

27const daemonRuntimeFiles = [

scripts/capture-resume-multiturn.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2const fs = require("node:fs");

3const os = require("node:os");

4const path

Source & flagged code

7 flagged · loading source

bin/tracist.jsView file

7const readline = require("node:readline/promises"); L8: const { spawn, spawnSync } = require("node:child_process"); L9: const WebSocket = require("ws");

High

Child Process

Package source references child process execution.

bin/tracist.jsView on unpkg · L7

7Trigger-reachable persistence chain: manifest.bin -> bin/tracist.js L7: const readline = require("node:readline/promises"); L8: const { spawn, spawnSync } = require("node:child_process"); L9: const WebSocket = require("ws"); L10: const { ... L19: const { formatCompactTimestamp: formatSessionActivityDate } = require("../shared/compact-timestamp.js"); L20: const packageRoot = path.resolve(__dirname, ".."); L21: const pkg = require(path.join(packageRoot, "package.json")); L22: const uploader = require(path.join(packageRoot, "scripts", "capture-resume-multiturn.js")); ... L45: const home = os.homedir(); L46: const configBase = process.env.TRACIST_CONFIG_DIR || (process.platform === "win32" ? process.env.APPDATA || path.join(home, "AppData", "Roaming") : process.platform === "darwin" ? ... L47:

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/tracist.jsView on unpkg · L7

2"use strict"; L3: const fs = require("node:fs"); L4: const crypto = require("node:crypto");

Findings

1 Critical4 High5 Medium6 Low

CriticalCommand Output Exfiltrationscripts/capture-resume-multiturn.js

HighChild Processbin/tracist.js

HighSame File Env Network Executionscripts/capture-resume-multiturn.js

HighSandbox Evasion Gated Capabilityscripts/capture-resume-multiturn.js

HighTrigger Reachable Persistencebin/tracist.js

MediumDynamic Requirebin/tracist.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencebin/tracist.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

Low

Affected versions and remediation

This report applies to tracist@0.0.57.

See all versions of tracist for other recorded verdicts.

Review the evidence and your use of tracist@0.0.57 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-05 11:50:23.345Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.