registry / Install hook abuse / aicodeman / 1.11.0

aicodeman@1.11.0

Mission control for AI coding agents - run 20 autonomous agents with real-time monitoring and session persistence

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The package has a real install-hook persistence surface and should be warned. Its AI-agent integration is package-aligned and runtime/user-scoped rather than an unconsented install-time takeover.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm postinstall; later user-managed case/session actions

Impact

Unexpected local service persistence and repository hook modification; no confirmed external exfiltration.

Mechanism

postinstall autostart and local development-hook installation

AI rationale

The package has a real install-hook persistence surface and should be warned. Its AI-agent integration is package-aligned and runtime/user-scoped rather than an unconsented install-time takeover.

Evidence

package.jsonscripts/postinstall.jsdist/hooks-config.jsdist/web/self-update.jsdist/index.js.git/hooks/pre-commit.claude/settings.local.json~/.codeman/update-status.json

Network endpoints2

127.0.0.1:3000api.github.com/repos/{owner}/{repo}/releases/latest

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

postinstall detaches and starts the web server unless opted out.
postinstall writes .git/hooks/pre-commit in a local clone.
Runtime can write project .claude/settings.local.json hooks for managed cases.
Managed Claude hooks POST terminal event data to the local Codeman API.

Evidence against

No install-time write to .claude, .codex, or other agent config was found.
The server is documented and configured to bind loopback by default.
No credential exfiltration or untrusted remote payload execution was found.
GitHub update checks are runtime/manual and validate release-tag format.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetry

Source & flagged code

14 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/ai-checker-base.jsView file

24*/ L25: import { execSync, spawn as childSpawn } from 'node:child_process'; L26: import { existsSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/ai-checker-base.jsView on unpkg · L24

dist/remote-hosts.jsView file

6import { promisify } from 'node:util'; L7: const execAsync = promisify(exec); L8: const REMOTE_HOSTS_FILE = 'remote-hosts.json';

High

Shell

Package source references shell execution.

dist/remote-hosts.jsView on unpkg · L6

dist/web/self-update.jsView file

23Trigger-reachable persistence chain: scripts.start -> dist/index.js -> dist/cli.js -> dist/web/server.js -> dist/web/self-update.js L23: */ L24: import { spawn, execFileSync } from 'node:child_process'; L25: import { existsSync, readFileSync, writeFileSync, renameSync, copyFileSync, chmodSync } from 'node:fs'; ... L33: const require = createRequire(import.meta.url); L34: const { version: APP_VERSION } = require('../../package.json'); L35: /** systemd unit name (matches install.sh + scripts/codeman-web.service). */ ... L200: return null; L201: return JSON.parse(readFileSync(STATUS_FILE, 'utf-8')); L202: } ... L222: // ───────────────────────────────────────────────────────────────────────────── L223: /** Run a command, returning trimmed stdout, or null on any error. */ L224: function tryExe

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/web/self-update.jsView on unpkg · L23

32import { EXEC_TIMEOUT_MS } from '../config/exec-timeout.js'; L33: const require = createRequire(import.meta.url); L34: const { version: APP_VERSION } = require('../../package.json');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/web/self-update.jsView on unpkg · L32

23*/ L24: import { spawn, execFileSync } from 'node:child_process'; L25: import { existsSync, readFileSync, writeFileSync, renameSync, copyFileSync, chmodSync } from 'node:fs'; ... L33: const require = createRequire(import.meta.url); L34: const { version: APP_VERSION } = require('../../package.json'); L35: /** systemd unit name (matches install.sh + scripts/codeman-web.service). */ ... L200: return null; L201: return JSON.parse(readFileSync(STATUS_FILE, 'utf-8')); L202: } ... L222: // ───────────────────────────────────────────────────────────────────────────── L223: /** Run a command, returning trimmed stdout, or null on any error. */ L224: function tryExec(cmd, args, cwd, timeout = EXEC_TIMEOUT_MS) {

scripts/postinstall.jsView file

23join(home, '.local/bin/claude'), L24: join(home, '.claude/local/claude'), L25: '/usr/local/bin/claude', ... L256: L257: const { mkdirSync, copyFileSync } = await import('fs'); L258: mkdirSync(vendorDir, { recursive: true }); L259: copyFileSync(join(xtermDir, 'css', 'xterm.css'), join(vendorDir, 'xterm.css')); L260: ... L269: // Fallback: copy unminified L270: copyFileSync(join(xtermDir, 'lib', 'xterm.js'), join(vendorDir, 'xterm.min.js')); L271: copyFileSync(join(fitDir, 'lib', 'addon-fit.js'), join(vendorDir, 'xterm-addon-fit.min.js')); L272: copyFileSync(join(serializeDir, 'lib', 'addon-serialize.js'), join(vendorDir, 'xterm-addon-serialize.min.js'));

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L23

7Cross-file remote execution chain: scripts/postinstall.js spawns dist/web/public/vendor/xterm-addon-webgl.min.js; helper contains network access plus dynamic code execution. L7: L8: import { execSync, spawn } from 'child_process'; L9: import { existsSync } from 'fs'; ... L20: // Claude CLI search paths (must match src/session.ts) L21: const home = homedir(); L22: const CLAUDE_SEARCH_PATHS = [ ... L33: L34: const useColor = process.stdout.isTTY && !process.env.NO_COLOR; L35: ... L83: const ok = await new Promise((resolve) => { L84: const conn = net.createConnection({ port, host: '127.0.0.1' }); L85: conn.once('connect', () => { conn.destroy(); resolve(true); });

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/postinstall.jsView on unpkg · L7

dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasmView file

•path = dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasm kind = wasm_module sizeBytes = 9448638 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasmView on unpkg

dist/web/public/styles.2e8dc8b7.css.gzView file

•path = dist/web/public/styles.2e8dc8b7.css.gz kind = high_entropy_blob sizeBytes = 38366 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/public/styles.2e8dc8b7.css.gzView on unpkg

•path = dist/web/public/styles.2e8dc8b7.css.gz kind = compressed_blob sizeBytes = 38366 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/web/public/styles.2e8dc8b7.css.gzView on unpkg

dist/tmux-manager.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = aicodeman@1.13.0 matchedIdentity = npm:YWljb2RlbWFu:1.13.0 similarity = 0.875 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/tmux-manager.jsView on unpkg

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/ai-checker-base.jsView file

24*/ L25: import { execSync, spawn as childSpawn } from 'node:child_process'; L26: import { existsSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/ai-checker-base.jsView on unpkg · L24

Findings

2 Critical7 High8 Medium6 Low

CriticalAi Agent Control Hijackscripts/postinstall.js

CriticalPrevious Version Dangerous Deltadist/tmux-manager.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/ai-checker-base.js

HighShelldist/remote-hosts.js

HighCross File Remote Execution Contextscripts/postinstall.js

HighTrigger Reachable Persistencedist/web/self-update.js

HighRuntime Package Installscripts/postinstall.js

HighShips High Entropy Blobdist/web/public/styles.2e8dc8b7.css.gz

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/web/self-update.js

Affected versions and remediation

This report applies to aicodeman@1.11.0.

See all versions of aicodeman for other recorded verdicts.

Review the evidence and your use of aicodeman@1.11.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-09 00:07:14.613Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code