tracist@0.0.60
Upload and continuously stream local AI coding transcripts to Tracist
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is an overt, authenticated product feature rather than stealth install-time malware, but it grants a remote service unusually broad control over local AI agents. Warn rather than block because persistence is explicit-user-command and no unconsented lifecycle mutation or covert exfiltration was found.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User runs "tracist install" and authenticates; the persistent daemon then receives server queue messages.
Impact
A compromised or abusive Tracist service/token could cause local agent actions with broad filesystem and command capability.
Mechanism
Authenticated remote queue controls local AI-agent execution.
AI rationale
This is an overt, authenticated product feature rather than stealth install-time malware, but it grants a remote service unusually broad control over local AI agents. Warn rather than block because persistence is explicit-user-command and no unconsented lifecycle mutation or covert exfiltration was found.
Evidence
package.jsonREADME.mdbin/tracist.jsscripts/capture-resume-multiturn.jslib/acp-client.jstools/secret-redaction.js
Network endpoints3
tracist.devwss://tracist.dev/api/transcripts/machines/<machineId>/sockettracist.dev/api/transcripts/queue/attachments/<attachmentKey>
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- scripts/capture-resume-multiturn.js accepts authenticated queue messages and dispatches prompts to local agent sessions.
- It starts/resumes Codex with sandbox "danger-full-access" and approvalPolicy "never".
- The explicit install command creates a persistent user daemon that maintains the remote WebSocket control channel.
- Queued attachments are downloaded from the service and written locally before being included in agent prompts.
Evidence against
- package.json has only a prepare build hook; no preinstall/install/postinstall runtime hook.
- bin/tracist.js requires an explicit "tracist install" command before creating the daemon.
- Transcript uploads are declared functionality and outbound transcript rows pass through tools/secret-redaction.js.
- No hidden endpoint, credential harvesting, or foreign AI-agent configuration mutation was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
8 flagged · loading sourcebin/tracist.jsView file
7const readline = require("node:readline/promises");
L8: const { spawn, spawnSync } = require("node:child_process");
L9: const WebSocket = require("ws");
High
7Trigger-reachable persistence chain: manifest.bin -> bin/tracist.js
L7: const readline = require("node:readline/promises");
L8: const { spawn, spawnSync } = require("node:child_process");
L9: const WebSocket = require("ws");
L10: const {
...
L19: const { formatCompactTimestamp: formatSessionActivityDate } = require("../shared/compact-timestamp.js");
L20: const packageRoot = path.resolve(__dirname, "..");
L21: const pkg = require(path.join(packageRoot, "package.json"));
L22: const uploader = require(path.join(packageRoot, "scripts", "capture-resume-multiturn.js"));
...
L45: const home = os.homedir();
L46: const configBase = process.env.TRACIST_CONFIG_DIR || (process.platform === "win32" ? process.env.APPDATA || path.join(home, "AppData", "Roaming") : process.platform === "darwin" ? ...
L47:
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
bin/tracist.jsView on unpkg · L72"use strict";
L3: const fs = require("node:fs");
L4: const crypto = require("node:crypto");
Findings
2 Critical4 High5 Medium6 Low
CriticalCommand Output Exfiltrationscripts/capture-resume-multiturn.js
CriticalPrevious Version Dangerous Deltascripts/capture-resume-multiturn.js
HighChild Processbin/tracist.js
HighSame File Env Network Executionscripts/capture-resume-multiturn.js
HighSandbox Evasion Gated Capabilityscripts/capture-resume-multiturn.js
HighTrigger Reachable Persistencebin/tracist.js
MediumDynamic Requirebin/tracist.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencebin/tracist.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Low
Affected versions and remediation
This report applies to tracist@0.0.60.
See all versions of tracist for other recorded verdicts.
- Review the evidence and your use of tracist@0.0.60 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.