@tokor/desktop-commander@0.2.53: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@tokor/desktop-commander@0.2.53: Suspicious npm security report | LPM Firewall

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/npm-scripts/verify-ripgrep.js || node -e "process.exit(0)"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node dist/npm-scripts/verify-ripgrep.js || node -e "process.exit(0)"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/ui/config-editor/config-editor-runtime.jsView file

25path: iss.path ? [${Ge($)}, ...iss.path] : [${Ge($)}] L26: })));`),p.write(`newResult[${Ge($)}] = ${x}.value`)}p.write("payload.value = newResult;"),p.write("return payload;");let I=p.compile();return($,x)=>I(m,$,x)},r,o=at,a=!Tr.jitless,u... L27: `)}var ir=e=>(t,n,i,r)=>{let o=i?Object.assign(i,{async:!1}):{async:!1},a=t._zod.run({value:n,issues:[]},o);if(a instanceof Promise)throw new Re;if(a.issues.length){let s=new(r?.Er...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/ui/config-editor/config-editor-runtime.jsView on unpkg · L25

dist/tools/fuzzySearch.jsView file

14const WORKER_CODE = ` L15: const { workerData, parentPort } = require('worker_threads'); L16: import(workerData.moduleUrl)

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tools/fuzzySearch.jsView on unpkg · L14

dist/track-installation.jsView file

14import { randomUUID } from 'crypto'; L15: import * as https from 'https'; L16: import { platform } from 'os'; ... L21: const __filename = fileURLToPath(import.meta.url); L22: const __dirname = path.dirname(__filename); L23: L24: // Debug logging utility - configurable via environment variables L25: const DEBUG_ENABLED = process.env.DEBUG === 'desktop-commander' || L26: process.env.DEBUG === '*' || ... L58: const configData = fs.readFileSync(CONFIG_FILE, 'utf8'); L59: const config = JSON.parse(configData); L60: if (config.clientId) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/track-installation.jsView on unpkg · L14

Source & flagged code

5 flagged

package.jsonView file

Lines 9-49json

9 "repository": {

10 "type": "git",

11 "url": "git+https://github.com/wonderwhy-er/DesktopCommanderMCP.git"

12 },

13 "bugs": "https://github.com/wonderwhy-er/DesktopCommanderMCP/issues",

14 "type": "module",

15 "engines": {

16 "node": ">=18.0.0"

17 },

18 "bin": {

19 "desktop-commander": "dist/index.js",

20 "setup": "dist/setup-claude-server.js",

21 "remove": "dist/uninstall-claude-server.js"

22 },

23 "files": [

24 "dist",

25 "logo.png",

26 "testemonials"

27 ],

28 "scripts": {

29 "postinstall": "node dist/npm-scripts/verify-ripgrep.js || node -e \"process.exit(0)\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L29

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

30 "open-chat": "open -n /Applications/Claude.app",

31 "device:install": "cd src/remote-device && npm install",

32 "device:start": "tsx src/remote-device/device.ts",

33 "device:start:dev": "nodemon --watch src/remote-device --exec tsx src/remote-device/device.ts",

34 "sync-version": "node scripts/sync-version.js",

35 "bump": "node scripts/sync-version.js --bump",

36 "bump:minor": "node scripts/sync-version.js --bump --minor",

37 "bump:major": "node scripts/sync-version.js --bump --major",

38 "build": "tsc && shx cp setup-claude-server.js uninstall-claude-server.js track-installation.js dist/ && shx chmod +x dist/*.js && shx mkdir -p dist/data && shx cp src/data/onboarding-prompts.json dist/data/ && shx mkdir -p dist/remote-device/scripts && shx cp src/remote-device/scripts/blocking-offline-update.js dist/remote-device/scripts/ && node scripts/build-ui-runtime.cjs",

39 "watch": "tsc --watch",

40 "start": "node dist/index.js",

41 "start:debug": "node --inspect-brk=9229 dist/index.js",

42 "setup": "npm install --include=dev && npm run build && node setup-claude-server.js",

43 "setup:debug": "npm install && npm run build && node setup-claude-server.js --debug",

44 "remove": "npm install && npm run build && node uninstall-claude-server.js",

45 "prepare": "npm run build",

46 "clean": "shx rm -rf dist",

47 "test": "npm run build && node test/run-all-tests.js",

48 "test:integration": "npm run build && node test/integration/run-all-integration-tests.js",

49 "test:debug": "node --inspect test/run-all-tests.js",

dist/ui/config-editor/config-editor-runtime.jsView file

Lines 5-45javascript

5 if (input[${b}] === undefined) {

6 if (${b} in input) {

7 newResult[${b}] = undefined;

8 }

9 } else {

dist/tools/fuzzySearch.jsView file

Lines 1-34javascript

1import { capture } from '../utils/capture.js';

2import { Worker } from 'worker_threads';

3// Re-export so existing callers keep importing from this module.

4export { recursiveFuzzyIndexOf, getSimilarityRatio } from './fuzzySearchCore.js';

5/** Abort fuzzy search in the worker after this many ms to avoid unbounded CPU burn. */

dist/track-installation.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2

3/**

4 * Installation Source Tracking Script

5 * Runs during npm install to detect how Desktop Commander was installed

6 *

7 * Debug logging can be enabled with:

8 * - DEBUG=desktop-commander npm install

9 * - DEBUG=* npm install

10 * - NODE_ENV=development npm install

11 * - DC_DEBUG=true npm install