aicodeman@1.14.1

Mission control for AI coding agents - run 20 autonomous agents with real-time monitoring and session persistence

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

This is not confirmed malicious under the install-control policy, but unconsented install-time daemon startup and repository hook mutation create a real lifecycle risk. Downgrade to warn rather than block.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm install (server auto-start); explicit codeman service install (persistence)

Impact

Unexpected localhost AI-agent control service after installation; no confirmed foreign agent-config mutation or exfiltration.

Mechanism

postinstall local server launch and optional source-repository hook write

AI rationale

Evidence

package.jsonscripts/postinstall.jsdist/ai-checker-base.jsdist/service-installer.jsdist/cli.jsdist/web/server.jsdist/web/self-update.jsdist/index.js.git/hooks/pre-commit

Network endpoints1

api.github.com

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

package.json invokes postinstall.
scripts/postinstall.js starts detached dist/index.js web unless CI/opt-out.
postinstall writes .git/hooks/pre-commit for source installs.
dist/ai-checker-base.js launches Claude via detached tmux sessions.

Evidence against

Postinstall server defaults to 127.0.0.1:3000.
Service-unit persistence requires explicit codeman service install.
Service units omit CODEMAN_PASSWORD and use mode 0600.
No source evidence of credential harvesting or outbound exfiltration.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

Manifest

Source & flagged code

14 flagged

package.jsonView file

Lines 1-33json

2 "name": "aicodeman",

3 "version": "1.14.1",

4 "description": "Mission control for AI coding agents - run 20 autonomous agents with real-time monitoring and session persistence",

5 "type": "module",

6 "main": "dist/index.js",

7 "types": "dist/index.d.ts",

8 "bin": {

9 "aicodeman": "./dist/index.js",

10 "codeman": "./dist/index.js"

11 },

12 "scripts": {

13 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L13

14 "build": "node scripts/build.mjs",

15 "build:gesture": "node scripts/build-gesture-bundle.mjs",

16 "start": "NODE_COMPILE_CACHE=${HOME}/.codeman/compile-cache node dist/index.js",

17 "dev": "tsx src/index.ts web",

18 "web": "node dist/index.js web",

19 "clean": "rm -rf dist",

20 "test": "vitest run --config config/vitest.config.ts",

21 "test:watch": "vitest --config config/vitest.config.ts",

22 "test:coverage": "vitest run --config config/vitest.config.ts --coverage",

23 "test:ci": "vitest run --config config/vitest.ci.config.ts",

24 "check:frontend-syntax": "node scripts/check-frontend-syntax.mjs",

25 "fix:node-pty": "node scripts/fix-node-pty.mjs",

26 "typecheck": "tsc --noEmit",

27 "lint": "eslint --config config/eslint.config.js 'src/**/*.ts'",

28 "lint:fix": "eslint --config config/eslint.config.js 'src/**/*.ts' --fix",

29 "format": "prettier --write 'src/**/*.ts' 'src/web/public/**/*.{js,css,html,json}'",

30 "format:check": "prettier --check 'src/**/*.ts' 'src/web/public/**/*.{js,css,html,json}'",

31 "check:public-assets": "node scripts/check-public-assets.mjs",

32 "capture:subagents": "node scripts/capture-subagent-screenshots.mjs",

33 "changeset": "changeset",

dist/ai-checker-base.jsView file

Lines 4-44javascript

4 * Provides shared functionality for AI-powered checkers that spawn fresh Claude CLI

5 * sessions to analyze terminal output. This base class handles:

6 * - Mux session spawning and cleanup

dist/remote-hosts.jsView file

Lines 1-26javascript

1import { existsSync, mkdirSync } from 'node:fs';

2import fs from 'node:fs/promises';

3import { join } from 'node:path';

4import { homedir } from 'node:os';

dist/web/self-update.jsView file

Lines 3-53javascript

3 *

4 * Powers App Settings → Updates. Codeman is installed as a git clone and run

5 * under systemd (Linux) or launchd (macOS); updating means `git checkout <release

scripts/postinstall.jsView file

Lines 1-43javascript

1#!/usr/bin/env node

3/**

4 * Codeman postinstall verification script

5 * Runs after `npm install` to check environment readiness

6 */

8import { execSync, spawn } from 'child_process';

9import { existsSync } from 'fs'

dist/service-installer.jsView file

26Trigger-reachable persistence chain: scripts.start -> dist/index.js -> dist/cli.js -> dist/service-installer.js L26: * The file writers are pure string builders so they can be unit-tested without L27: * touching launchctl/systemctl. L28: * ... L30: */ L31: import { execFileSync } from 'node:child_process'; L32: import { existsSync, mkdirSync, unlinkSync, writeFileSync } from 'node:fs'; ... L168: export function detectServiceKind() { L169: if (process.platform === 'darwin') L170: return 'launchd'; ... L176: return kind === 'launchd' L177: ? join(homedir(), 'Library', 'LaunchAgents', `${LAUNCHD_LABEL}.plist`) L178: : join(homedir(), '.config', 'systemd', 'user', SYSTEMD_UNIT);

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/service-installer.jsView on unpkg · L26

dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasmView file

•path = dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasm kind = wasm_module sizeBytes = 9448638 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasmView on unpkg

dist/web/public/terminal-ui.bc6819a9.js.gzView file

•path = dist/web/public/terminal-ui.bc6819a9.js.gz kind = high_entropy_blob sizeBytes = 18361 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/public/terminal-ui.bc6819a9.js.gzView on unpkg

•path = dist/web/public/terminal-ui.bc6819a9.js.gz kind = compressed_blob sizeBytes = 18361 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/web/public/terminal-ui.bc6819a9.js.gzView on unpkg

dist/web/server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = aicodeman@1.14.0 matchedIdentity = npm:YWljb2RlbWFu:1.14.0 similarity = 0.958 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/web/server.jsView on unpkg

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/ai-checker-base.jsView file

24*/ L25: import { execSync, spawn as childSpawn } from 'node:child_process'; L26: import { existsSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/ai-checker-base.jsView on unpkg · L24

Findings

2 Critical7 High8 Medium6 Low

CriticalAi Agent Control Hijackscripts/postinstall.js

CriticalPrevious Version Dangerous Deltadist/web/server.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/ai-checker-base.js

HighShelldist/remote-hosts.js

HighCross File Remote Execution Contextscripts/postinstall.js

HighTrigger Reachable Persistencedist/service-installer.js

HighRuntime Package Installscripts/postinstall.js

HighShips High Entropy Blobdist/web/public/terminal-ui.bc6819a9.js.gz

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/web/self-update.js

Affected versions and remediation

This report applies to aicodeman@1.14.1.

See all versions of aicodeman for other recorded verdicts.

Review the evidence and your use of aicodeman@1.14.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-09 01:45:40.512Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code