Loading npm security reports…

tracist@0.0.65: Malicious npm security report (Block) | LPM Firewall

registry / tracist / 0.0.65

tracist@0.0.65

Upload and continuously stream local AI coding transcripts to Tracist

AI Security Review

scanned 6d ago · by lpm-firewall-ai

After explicit installation, a persistent daemon connects to tracist.dev and accepts server-directed filesystem reads, file writes, and queued AI-agent prompts. The filesystem root is attacker/server controlled rather than constrained to the transcript project.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

User runs `tracist install`; the installed daemon connects and receives WebSocket messages.

Impact

Remote service compromise can exfiltrate local files, alter files, and induce local agent actions.

Mechanism

Persistent remote filesystem and AI-agent control channel

Attack narrative

`tracist install` creates a persistent per-user daemon. Its normal streamer defaults to queue mode, opens a WebSocket to the service, and dispatches server messages. A `filesystem_request` supplies an arbitrary absolute root and receives directory/file data; the session check does not bind that root to a project. `file_save_ready` can replace a chosen existing file once its hash is known. Queue messages are supplied to local AI-agent harnesses, enabling remote prompt-driven local actions. These capabilities are not disclosed by the README's transcript-upload description.

Rationale

This is a concrete remote-control channel with arbitrary-root file read/write and local agent prompt execution, activated by a persistent daemon. The lack of install hooks reduces exposure but does not remove the confirmed attack surface.

Evidence

package.jsonbin/tracist.jsscripts/capture-resume-multiturn.jsscripts/transcript-agent-anchor.jsREADME.md~/.config/systemd/user/tracist.service

Source & flagged code

8 flagged · loading source

bin/tracist.jsView file

7const readline = require("node:readline/promises"); L8: const { spawn, spawnSync } = require("node:child_process"); L9: const WebSocket = require("ws");

High

Child Process

Package source references child process execution.

bin/tracist.jsView on unpkg · L7

7Trigger-reachable persistence chain: manifest.bin -> bin/tracist.js L7: const readline = require("node:readline/promises"); L8: const { spawn, spawnSync } = require("node:child_process"); L9: const WebSocket = require("ws"); L10: const { ... L19: const { formatCompactTimestamp: formatSessionActivityDate } = require("../shared/compact-timestamp.js"); L20: const packageRoot = path.resolve(__dirname, ".."); L21: const pkg = require(path.join(packageRoot, "package.json")); L22: const uploader = require(path.join(packageRoot, "scripts", "capture-resume-multiturn.js")); ... L45: const home = os.homedir(); L46: const configBase = process.env.TRACIST_CONFIG_DIR || (process.platform === "win32" ? process.env.APPDATA || path.join(home, "AppData", "Roaming") : process.platform === "darwin" ? ... L47:

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/tracist.jsView on unpkg · L7

2"use strict"; L3: const fs = require("node:fs"); L4: const crypto = require("node:crypto");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/tracist.jsView on unpkg · L2

7const readline = require("node:readline/promises"); L8: const { spawn, spawnSync } = require("node:child_process"); L9: const WebSocket = require("ws"); L10: const { ... L19: const { formatCompactTimestamp: formatSessionActivityDate } = require("../shared/compact-timestamp.js"); L20: const packageRoot = path.resolve(__dirname, ".."); L21: const pkg = require(path.join(packageRoot, "package.json")); L22: const uploader = require(path.join(packageRoot, "scripts", "capture-resume-multiturn.js")); ... L45: const home = os.homedir(); L46: const configBase = process.env.TRACIST_CONFIG_DIR || (process.platform === "win32" ? process.env.APPDATA || path.join(home, "AppData", "Roaming") : process.platform === "darwin" ? ... L47: const dataBase = process.env.TRACIST_DATA_DIR || (process.platform

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/tracist.jsView on unpkg · L7

scripts/capture-resume-multiturn.jsView file

6const readline = require("node:readline"); L7: const net = require("node:net"); L8: const { spawn, spawnSync } = require("node:child_process"); L9: const { inspectGitRepository } = require("../lib/git-repository.js"); ... L72: function transcriptImageDimensions(bytes, type) { L73: const buffer = Buffer.isBuffer(bytes) ? bytes : Buffer.from(bytes || []); L74: if (type === "image/png" && buffer.length >= 24 && buffer.subarray(1, 4).toString() === "PNG") { ... L212: if (rootResult.status !== 0) return null; L213: const repositoryRoot = String(rootResult.stdout || "").trim(); L214: if (!repositoryRoot) return null; ... L248: } L249: function listWorkingDirectory({ root, relativePath = "", home = os.homedir() }) {

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

scripts/capture-resume-multiturn.jsView on unpkg · L6

•matchType = previous_version_dangerous_delta matchedPackage = tracist@0.0.57 matchedIdentity = npm:dHJhY2lzdA:0.0.57 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/capture-resume-multiturn.jsView on unpkg

5058try { L5059: const zipairOrigin = String(process.env.ZIPAIR_ORIGIN || "http://127.0.0.1:1653").replace(/\/+$/, ""); L5060: const response = spawnSync("curl", [ L5061: "-fsS",