registry  /  @fefeding/aicmd  /  1.0.7

@fefeding/aicmd@1.0.7

AI-powered web SSH terminal with autonomous agent, skills, and file transfer

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsUrlStrings
Manifest
NoLicenseWildcardDependency
scanned 35 file(s), 1.78 MB of source, external domains: aigcwhere.com, api.anthropic.com, api.hunyuan.cloud.tencent.com, api.openai.com, github.com, popper.js.org, vuejs.org, www.google.com, www.w3.org

Source & flagged code

9 flagged · loading source
dist/public/index.jsView file
3973patternName = generic_password severity = medium line = 3973 matchedText = password...rd",
Medium
Secret Pattern

Package contains a possible secret pattern.

dist/public/index.jsView on unpkg · L3973
bin/aicmd.jsView file
3const crypto = require('crypto'); L4: const { exec, spawn } = require('child_process'); L5: const path = require('path');
High
Child Process

Package source references child process execution.

bin/aicmd.jsView on unpkg · L3
3Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, execution+network L3: const crypto = require('crypto'); L4: const { exec, spawn } = require('child_process'); L5: const path = require('path'); L6: const fs = require('fs'); L7: const net = require('net'); L8: const os = require('os'); L9: L10: const projectRoot = path.resolve(__dirname, '..'); L11: ... L18: function getDataDir() { L19: return process.env.AICMD_DATA_DIR || path.join(os.homedir(), '.aicmd'); L20: }
High
Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/aicmd.jsView on unpkg · L3
3const crypto = require('crypto'); L4: const { exec, spawn } = require('child_process'); L5: const path = require('path'); L6: const fs = require('fs'); L7: const net = require('net'); L8: const os = require('os'); ... L18: function getDataDir() { L19: return process.env.AICMD_DATA_DIR || path.join(os.homedir(), '.aicmd'); L20: }
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/aicmd.jsView on unpkg · L3
2L3: const crypto = require('crypto'); L4: const { exec, spawn } = require('child_process');
Medium
Dynamic Require

Package source references dynamic require/import behavior.

bin/aicmd.jsView on unpkg · L2
dist/server/service/connection.service.tsView file
288console.log(`[SSH] Windows: using OpenSSH agent pipe: ${pipe}`); L289: console.log(`[SSH] If agent is not running, execute in PowerShell (Admin):`); L290: console.log(`[SSH] Start-Service ssh-agent; Set-Service ssh-agent -StartupType Automatic`);
High
Shell

Package source references shell execution.

dist/server/service/connection.service.tsView on unpkg · L288
dist/server/service/ai.service.tsView file
83interface ISSHService { L84: writeData(sessionId: string, data: string | Buffer): boolean; L85: captureOutput(sessionId: string, timeoutMs?: number): Promise<string>; ... L119: Script execution flow: L120: 1. First detect available languages with \`which python3 node bash\` (Windows: \`where python node powershell\`) L121: 2. Prefer languages already known from system environment info ... L126: cat > /tmp/_ai_task.sh << 'SCRIPT_EOF' L127: #!/bin/bash L128: set -e ... L153: - Linux: OS=Linux, use bash commands L154: - macOS: OS=Darwin, no \`free\`/\`ss\`/\`systemctl\`, use \`vm_stat\`/\`lsof\`/\`launchctl\` instead L155: - Windows: Shell=PowerShell, use PowerShell cmdlets, temp files in \`$env:TEMP\`
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/server/service/ai.service.tsView on unpkg · L83
bin/dev.shView file
•path = bin/dev.sh kind = build_helper sizeBytes = 132 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/dev.shView on unpkg
dist/public/bootstrap-icons.woff2View file
•path = dist/public/bootstrap-icons.woff2 kind = high_entropy_blob sizeBytes = 134044 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/public/bootstrap-icons.woff2View on unpkg

Findings

5 High8 Medium5 Low
HighChild Processbin/aicmd.js
HighShelldist/server/service/connection.service.ts
HighEntrypoint Build Divergencebin/aicmd.js
HighSame File Env Network Executionbin/aicmd.js
HighShips High Entropy Blobdist/public/bootstrap-icons.woff2
MediumSecret Patterndist/public/index.js
MediumDynamic Requirebin/aicmd.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/server/service/ai.service.ts
MediumShips Build Helperbin/dev.sh
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License