tracist@0.0.74: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

tracist@0.0.74: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

bin/tracist.jsView file

7const readline = require("node:readline/promises"); L8: const { spawn, spawnSync } = require("node:child_process"); L9: const WebSocket = require("ws");

High

Child Process

Package source references child process execution.

bin/tracist.jsView on unpkg · L7

7Trigger-reachable persistence chain: manifest.bin -> bin/tracist.js L7: const readline = require("node:readline/promises"); L8: const { spawn, spawnSync } = require("node:child_process"); L9: const WebSocket = require("ws"); L10: const { ... L19: const { formatCompactTimestamp: formatSessionActivityDate } = require("../shared/compact-timestamp.js"); L20: const packageRoot = path.resolve(__dirname, ".."); L21: const pkg = require(path.join(packageRoot, "package.json")); L22: const uploader = require(path.join(packageRoot, "scripts", "capture-resume-multiturn.js")); ... L35: const home = os.homedir(); L36: const configBase = process.env.TRACIST_CONFIG_DIR || (process.platform === "win32" ? process.env.APPDATA || path.join(home, "AppData", "Roaming") : process.platform === "darwin" ? ... L37:

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/tracist.jsView on unpkg · L7

2"use strict"; L3: const fs = require("node:fs"); L4: const crypto = require("node:crypto");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/tracist.jsView on unpkg · L2

7const readline = require("node:readline/promises"); L8: const { spawn, spawnSync } = require("node:child_process"); L9: const WebSocket = require("ws"); L10: const { ... L19: const { formatCompactTimestamp: formatSessionActivityDate } = require("../shared/compact-timestamp.js"); L20: const packageRoot = path.resolve(__dirname, ".."); L21: const pkg = require(path.join(packageRoot, "package.json")); L22: const uploader = require(path.join(packageRoot, "scripts", "capture-resume-multiturn.js")); ... L35: const home = os.homedir(); L36: const configBase = process.env.TRACIST_CONFIG_DIR || (process.platform === "win32" ? process.env.APPDATA || path.join(home, "AppData", "Roaming") : process.platform === "darwin" ? ... L37: const dataBase = process.env.TRACIST_DATA_DIR || (process.platform

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/tracist.jsView on unpkg · L7

scripts/capture-resume-multiturn.jsView file

7const readline = require("node:readline"); L8: const net = require("node:net"); L9: const { spawn, spawnSync } = require("node:child_process"); L10: const { ... L106: function transcriptImageDimensions(bytes, type) { L107: const buffer = Buffer.isBuffer(bytes) ? bytes : Buffer.from(bytes || []); L108: if (type === "image/png" && buffer.length >= 24 && buffer.subarray(1, 4).toString() === "PNG") { ... L248: if (rootResult.status !== 0) return null; L249: const repositoryRoot = String(rootResult.stdout || "").trim(); L250: if (!repositoryRoot) return null; ... L284: } L285: function listWorkingDirectory({ root, relativePath = "", home = os.homedir() }) {

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

scripts/capture-resume-multiturn.jsView on unpkg · L7

5100try { L5101: const zipairOrigin = String(process.env.ZIPAIR_ORIGIN || "http://127.0.0.1:1653").replace(/\/+$/, ""); L5102: const response = spawnSync("curl", [ L5103: "-fsS",

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/capture-resume-multiturn.jsView on unpkg · L5100