tracist@0.0.92: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

tracist@0.0.92: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

bin/agent-anchor.jsView file

45L46: // package.json L47: var require_package = __commonJS({ ... L53: license: "UNLICENSED", L54: homepage: "https://tracist.dev", L55: repository: { ... L110: }); L111: var import_node_child_process, import_node_readline, AcpClient; L112: var init_acp_client = __esm({ ... L123: onEvent; L124: onStderr; L125: proc = null;

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

bin/agent-anchor.jsView on unpkg · L45

110}); L111: var import_node_child_process, import_node_readline, AcpClient; L112: var init_acp_client = __esm({

High

Child Process

Package source references child process execution.

bin/agent-anchor.jsView on unpkg · L110

45L46: // package.json L47: var require_package = __commonJS({ ... L53: license: "UNLICENSED", L54: homepage: "https://tracist.dev", L55: repository: { ... L110: }); L111: var import_node_child_process, import_node_readline, AcpClient; L112: var init_acp_client = __esm({ ... L123: onEvent; L124: onStderr; L125: proc = null;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/agent-anchor.jsView on unpkg · L45

16}; L17: var __commonJS = (cb, mod) => function __require() { L18: try {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/agent-anchor.jsView on unpkg · L16

bin/tracist.jsView file

50Trigger-reachable persistence chain: manifest.bin -> bin/tracist.js L50: var fs3 = require("node:fs"); L51: var net = require("node:net"); L52: var path3 = require("node:path"); ... L70: if (!socket.writable) return; L71: socket.write(`${JSON.stringify(message)} L72: `); ... L83: try { L84: onMessage(JSON.parse(line)); L85: } catch { ... L107: if (!socketPath) throw new Error("A daemon control socket path is required."); L108: const unixSocket = process.platform !== "win32" && !socketPath.startsWith("\\\\.\\pipe\\"); L109: if (await probeDaemon(socketPath)) {

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/tracist.jsView on unpkg · L50

50var fs3 = require("node:fs"); L51: var net = require("node:net"); L52: var path3 = require("node:path"); ... L70: if (!socket.writable) return; L71: socket.write(`${JSON.stringify(message)} L72: `); ... L83: try { L84: onMessage(JSON.parse(line)); L85: } catch { ... L107: if (!socketPath) throw new Error("A daemon control socket path is required."); L108: const unixSocket = process.platform !== "win32" && !socketPath.startsWith("\\\\.\\pipe\\"); L109: if (await probeDaemon(socketPath)) {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/tracist.jsView on unpkg · L50

Source & flagged code

6 flagged

bin/agent-anchor.jsView file

Lines 1-65javascript

1#!/usr/bin/env node

2"use strict";

3var __create = Object.create;

4var __defProp = Object.defineProperty;

5var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

6var __getOwnPropNames = Object.getOwnPropertyNames;

7var __getProtoOf = Object.getPrototypeOf;

8var __hasOwnProp = Object.prototype.hasOwnProperty;

9var __esm = (fn, res, err) => function __init() {

10 if (err) throw err[0];

11 try {

12 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

13 } catch (e) {

14 throw err = [e], e;

15 }

16};

17var __commonJS = (cb, mod) => function __require() {

18 try {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/agent-anchor.jsView on unpkg · L16

19 return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

20 } catch (e) {

21 throw mod = 0, e;

22 }

23};

24var __export = (target, all) => {

25 for (var name in all)

26 __defProp(target, name, { get: all[name], enumerable: true });

27};

28var __copyProps = (to, from, except, desc) => {

29 if (from && typeof from === "object" || typeof from === "function") {

30 for (let key of __getOwnPropNames(from))

31 if (!__hasOwnProp.call(to, key) && key !== except)

32 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

33 }

34 return to;

35};

36var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

37 // If the importer is in node compatibility mode or this is not an ESM

38 // file that has been converted to a CommonJS file using a Babel-

39 // compatible transform (i.e. "__esModule" has not been set), then set

40 // "default" to the CommonJS "module.exports" for node compatibility.

41 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

42 mod

43));

44var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

45

46// package.json

47var require_package = __commonJS({

48 "package.json"(exports2, module2) {

49 module2.exports = {

50 name: "tracist",

51 version: "0.0.92",

52 description: "Upload and continuously stream local AI coding transcripts to Tracist",

53 license: "UNLICENSED",

54 homepage: "https://tracist.dev",

55 repository: {

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

bin/agent-anchor.jsView on unpkg · L45

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/agent-anchor.jsView on unpkg · L45

56 type: "git",

57 url: "git+https://github.com/antimatter15/tracist.git"

58 },

59 bugs: "https://github.com/antimatter15/tracist/issues",

60 type: "commonjs",

61 bin: {

62 tracist: "bin/tracist.js"

63 },

64 files: [

65 "bin/tracist.js",

Lines 90-130javascript

90 "trace:corpus": "esbuild tools/r2-trace-corpus.mts --bundle --platform=node --format=esm --target=node18 --outfile=.tracist-r2/r2-trace-corpus.mjs && node --expose-gc --max-old-space-size=8192 .tracist-r2/r2-trace-corpus.mjs"

91 },

92 devDependencies: {

93 "@eslint/js": "^10.0.1",

94 "@types/node": "^24.13.3",

95 "@types/ws": "^8.18.1",

bin/tracist.jsView file

Lines 30-70javascript

30 for (let key of __getOwnPropNames(from))

31 if (!__hasOwnProp.call(to, key) && key !== except)

32 __defProp(to, key, { get: () =>