tracist@0.0.71: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

tracist@0.0.71: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

bin/tracist.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = tracist@0.0.57 matchedIdentity = npm:dHJhY2lzdA:0.0.57 similarity = 0.733 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/tracist.jsView on unpkg

7const readline = require("node:readline/promises"); L8: const { spawn, spawnSync } = require("node:child_process"); L9: const WebSocket = require("ws");

High

Child Process

Package source references child process execution.

bin/tracist.jsView on unpkg · L7

7Trigger-reachable persistence chain: manifest.bin -> bin/tracist.js L7: const readline = require("node:readline/promises"); L8: const { spawn, spawnSync } = require("node:child_process"); L9: const WebSocket = require("ws"); L10: const { ... L19: const { formatCompactTimestamp: formatSessionActivityDate } = require("../shared/compact-timestamp.js"); L20: const packageRoot = path.resolve(__dirname, ".."); L21: const pkg = require(path.join(packageRoot, "package.json")); L22: const uploader = require(path.join(packageRoot, "scripts", "capture-resume-multiturn.js")); ... L35: const home = os.homedir(); L36: const configBase = process.env.TRACIST_CONFIG_DIR || (process.platform === "win32" ? process.env.APPDATA || path.join(home, "AppData", "Roaming") : process.platform === "darwin" ? ... L37:

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/tracist.jsView on unpkg · L7

2"use strict"; L3: const fs = require("node:fs"); L4: const crypto = require("node:crypto");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/tracist.jsView on unpkg · L2

7const readline = require("node:readline/promises"); L8: const { spawn, spawnSync } = require("node:child_process"); L9: const WebSocket = require("ws"); L10: const { ... L19: const { formatCompactTimestamp: formatSessionActivityDate } = require("../shared/compact-timestamp.js"); L20: const packageRoot = path.resolve(__dirname, ".."); L21: const pkg = require(path.join(packageRoot, "package.json")); L22: const uploader = require(path.join(packageRoot, "scripts", "capture-resume-multiturn.js")); ... L35: const home = os.homedir(); L36: const configBase = process.env.TRACIST_CONFIG_DIR || (process.platform === "win32" ? process.env.APPDATA || path.join(home, "AppData", "Roaming") : process.platform === "darwin" ? ... L37: const dataBase = process.env.TRACIST_DATA_DIR || (process.platform

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/tracist.jsView on unpkg · L7

scripts/capture-resume-multiturn.jsView file

6const readline = require("node:readline"); L7: const net = require("node:net"); L8: const { spawn, spawnSync } = require("node:child_process"); L9: const { inspectGitRepository } = require("../lib/git-repository.js"); ... L84: function transcriptImageDimensions(bytes, type) { L85: const buffer = Buffer.isBuffer(bytes) ? bytes : Buffer.from(bytes || []); L86: if (type === "image/png" && buffer.length >= 24 && buffer.subarray(1, 4).toString() === "PNG") { ... L224: if (rootResult.status !== 0) return null; L225: const repositoryRoot = String(rootResult.stdout || "").trim(); L226: if (!repositoryRoot) return null; ... L260: } L261: function listWorkingDirectory({ root, relativePath = "", home = os.homedir() }) {

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

scripts/capture-resume-multiturn.jsView on unpkg · L6

5325try { L5326: const zipairOrigin = String(process.env.ZIPAIR_ORIGIN || "http://127.0.0.1:1653").replace(/\/+$/, ""); L5327: const response = spawnSync("curl", [ L5328: "-fsS",

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/capture-resume-multiturn.jsView on unpkg · L5325

6const readline = require("node:readline"); L7: const net = require("node:net"); L8: const { spawn, spawnSync } = require("node:child_process"); L9: const { inspectGitRepository } = require("../lib/git-repository.js"); ... L84: function transcriptImageDimensions(bytes, type) { L85: const buffer = Buffer.isBuffer(bytes) ? bytes : Buffer.from(bytes || []); L86: if (type === "image/png" && buffer.length >= 24 && buffer.subarray(1, 4).toString() === "PNG") { ... L224: if (rootResult.status !== 0) return null; L225: const repositoryRoot = String(rootResult.stdout || "").trim(); L226: if (!repositoryRoot) return null; ... L260: } L261: function listWorkingDirectory({ root, relativePath = "", home = os.homedir() }) {

Source & flagged code

8 flagged

bin/tracist.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2"use strict";

3const fs = require("node:fs");

4const crypto = require("node:crypto");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/tracist.jsView on unpkg · L2

5const os = require("node:os");

6const path = require("node:path");

7const readline = require("node:readline/promises");

8const { spawn, spawnSync } = require("node:child_process");

9const WebSocket = require("ws");

High

Child Process

Package source references child process execution.

bin/tracist.jsView on unpkg · L7

10const {

11 connectDaemonControl,

12 startDaemonControlServer

13} = require("../lib/daemon-control.js");

14const {

15 ClientUpgradeRequiredError,

16 assertSupportedClientVersion,

17 compareClientVersions

18} = require("../lib/client-version.js");

19const { formatCompactTimestamp: formatSessionActivityDate } = require("../shared/compact-timestamp.js");

20const packageRoot = path.resolve(__dirname, "..");

21const pkg = require(path.join(packageRoot, "package.json"));

22const uploader = require(path.join(packageRoot, "scripts", "capture-resume-multiturn.js"));

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/tracist.jsView on unpkg · L7

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/tracist.jsView on unpkg · L7

23const defaultOrigin = "https://tracist.dev";

24const daemonNodeArguments = ["--max-old-space-size=256", "--max-semi-space-size=8"];

25const daemonUpgradeRetryMs = 5 * 60 * 1e3;

26const daemonUpgradeMaxRetryMs = 6 * 60 * 60 * 1e3;

27const daemonCredentialRefreshMs = 24 * 60 * 60 * 1e3;

•matchType = previous_version_dangerous_delta matchedPackage = tracist@0.0.57 matchedIdentity = npm:dHJhY2lzdA:0.0.57 similarity = 0.733 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/tracist.jsView on unpkg

scripts/capture-resume-multiturn.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2const fs = require("node:fs");

3const os = require("node:os");

4const path