tracist@0.0.61: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

tracist@0.0.61: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

bin/tracist.jsView file

7const readline = require("node:readline/promises"); L8: const { spawn, spawnSync } = require("node:child_process"); L9: const WebSocket = require("ws");

High

Child Process

Package source references child process execution.

bin/tracist.jsView on unpkg · L7

7Trigger-reachable persistence chain: manifest.bin -> bin/tracist.js L7: const readline = require("node:readline/promises"); L8: const { spawn, spawnSync } = require("node:child_process"); L9: const WebSocket = require("ws"); L10: const { ... L19: const { formatCompactTimestamp: formatSessionActivityDate } = require("../shared/compact-timestamp.js"); L20: const packageRoot = path.resolve(__dirname, ".."); L21: const pkg = require(path.join(packageRoot, "package.json")); L22: const uploader = require(path.join(packageRoot, "scripts", "capture-resume-multiturn.js")); ... L45: const home = os.homedir(); L46: const configBase = process.env.TRACIST_CONFIG_DIR || (process.platform === "win32" ? process.env.APPDATA || path.join(home, "AppData", "Roaming") : process.platform === "darwin" ? ... L47:

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/tracist.jsView on unpkg · L7

2"use strict"; L3: const fs = require("node:fs"); L4: const crypto = require("node:crypto");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/tracist.jsView on unpkg · L2

7const readline = require("node:readline/promises"); L8: const { spawn, spawnSync } = require("node:child_process"); L9: const WebSocket = require("ws"); L10: const { ... L19: const { formatCompactTimestamp: formatSessionActivityDate } = require("../shared/compact-timestamp.js"); L20: const packageRoot = path.resolve(__dirname, ".."); L21: const pkg = require(path.join(packageRoot, "package.json")); L22: const uploader = require(path.join(packageRoot, "scripts", "capture-resume-multiturn.js")); ... L45: const home = os.homedir(); L46: const configBase = process.env.TRACIST_CONFIG_DIR || (process.platform === "win32" ? process.env.APPDATA || path.join(home, "AppData", "Roaming") : process.platform === "darwin" ? ... L47: const dataBase = process.env.TRACIST_DATA_DIR || (process.platform

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/tracist.jsView on unpkg · L7

scripts/capture-resume-multiturn.jsView file

6const readline = require("node:readline"); L7: const net = require("node:net"); L8: const { spawn, spawnSync } = require("node:child_process"); L9: const { inspectGitRepository } = require("../lib/git-repository.js"); ... L60: function transcriptImageDimensions(bytes, type) { L61: const buffer = Buffer.isBuffer(bytes) ? bytes : Buffer.from(bytes || []); L62: if (type === "image/png" && buffer.length >= 24 && buffer.subarray(1, 4).toString() === "PNG") { ... L200: if (rootResult.status !== 0) return null; L201: const repositoryRoot = String(rootResult.stdout || "").trim(); L202: if (!repositoryRoot) return null; ... L236: } L237: function listWorkingDirectory({ root, relativePath = "", home = os.homedir() }) {

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

scripts/capture-resume-multiturn.jsView on unpkg · L6

•matchType = previous_version_dangerous_delta matchedPackage = tracist@0.0.57 matchedIdentity = npm:dHJhY2lzdA:0.0.57 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/capture-resume-multiturn.jsView on unpkg

5022try { L5023: const zipairOrigin = String(process.env.ZIPAIR_ORIGIN || "http://127.0.0.1:1653").replace(/\/+$/, ""); L5024: const response = spawnSync("curl", [ L5025: "-fsS",