aicodeman@1.14.2

Mission control for AI coding agents - run 20 autonomous agents with real-time monitoring and session persistence

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

Source confirms risky lifecycle behavior and first-party AI-agent integration, but not concrete malicious behavior. The scanner's AI-control-hijack conclusion is overstated because the control-surface writes are user-invoked and ownership-guarded.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm postinstall; separately, explicit `codeman skill install` or `codeman service install`

Impact

Local persistence/control features are available, but no concrete malicious chain was found.

Mechanism

install-time local server startup and user-invoked managed agent hooks

AI rationale

Evidence

package.jsonscripts/postinstall.jsdist/cli.jsdist/hooks-config.jsdist/service-installer.jsdist/web/self-update.jsscripts/fix-node-pty.mjs

Network endpoints1

api.github.com/repos/${owner}/${repo}/releases/latest

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

package.json runs postinstall.
scripts/postinstall.js repairs node-pty, installs a repo pre-commit hook for source installs, and auto-starts a loopback web server.
dist/cli.js exposes explicit skill install into ~/.claude/skills/codeman.
dist/hooks-config.js generates managed Claude hook configuration for Codeman sessions.

Evidence against

Postinstall does not write Claude/Codex agent configuration or install a service unit.
Service persistence is only via explicit `codeman service install` in dist/cli.js.
Skill installation is an explicit CLI command and refuses non-Codeman-managed targets.
Self-update is limited to git installs, validates release tags, and checks GitHub only when invoked.
No credential harvesting or outbound exfiltration path was found in inspected lifecycle code.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetwork

Source & flagged code

14 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/ai-checker-base.jsView file

24*/ L25: import { execSync, spawn as childSpawn } from 'node:child_process'; L26: import { existsSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/ai-checker-base.jsView on unpkg · L24

dist/remote-hosts.jsView file

6import { promisify } from 'node:util'; L7: const execAsync = promisify(exec); L8: const REMOTE_HOSTS_FILE = 'remote-hosts.json';

High

Shell

Package source references shell execution.

dist/remote-hosts.jsView on unpkg · L6

dist/web/self-update.jsView file

33import { EXEC_TIMEOUT_MS } from '../config/exec-timeout.js'; L34: const require = createRequire(import.meta.url); L35: const { version: APP_VERSION } = require('../../package.json');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/web/self-update.jsView on unpkg · L33

23*/ L24: import { spawn, execFileSync } from 'node:child_process'; L25: import { existsSync, readFileSync, writeFileSync, renameSync, copyFileSync, chmodSync } from 'node:fs'; ... L34: const require = createRequire(import.meta.url); L35: const { version: APP_VERSION } = require('../../package.json'); L36: // Unit name / job label live in config/service-names.ts so install.sh, this ... L200: return null; L201: return JSON.parse(readFileSync(STATUS_FILE, 'utf-8')); L202: } ... L222: // ───────────────────────────────────────────────────────────────────────────── L223: /** Run a command, returning trimmed stdout, or null on any error. */ L224: function tryExec(cmd, args, cwd, timeout = EXEC_TIMEOUT_MS) {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/web/self-update.jsView on unpkg · L23

scripts/postinstall.jsView file

23join(home, '.local/bin/claude'), L24: join(home, '.claude/local/claude'), L25: '/usr/local/bin/claude', ... L256: L257: const { mkdirSync, copyFileSync } = await import('fs'); L258: mkdirSync(vendorDir, { recursive: true }); L259: copyFileSync(join(xtermDir, 'css', 'xterm.css'), join(vendorDir, 'xterm.css')); L260: ... L269: // Fallback: copy unminified L270: copyFileSync(join(xtermDir, 'lib', 'xterm.js'), join(vendorDir, 'xterm.min.js')); L271: copyFileSync(join(fitDir, 'lib', 'addon-fit.js'), join(vendorDir, 'xterm-addon-fit.min.js')); L272: copyFileSync(join(serializeDir, 'lib', 'addon-serialize.js'), join(vendorDir, 'xterm-addon-serialize.min.js'));

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L23

7Cross-file remote execution chain: scripts/postinstall.js spawns dist/web/public/vendor/xterm-addon-webgl.min.js; helper contains network access plus dynamic code execution. L7: L8: import { execSync, spawn } from 'child_process'; L9: import { existsSync } from 'fs'; ... L20: // Claude CLI search paths (must match src/session.ts) L21: const home = homedir(); L22: const CLAUDE_SEARCH_PATHS = [ ... L33: L34: const useColor = process.stdout.isTTY && !process.env.NO_COLOR; L35: ... L83: const ok = await new Promise((resolve) => { L84: const conn = net.createConnection({ port, host: '127.0.0.1' }); L85: conn.once('connect', () => { conn.destroy(); resolve(true); });

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/postinstall.jsView on unpkg · L7

dist/service-installer.jsView file

26Trigger-reachable persistence chain: scripts.start -> dist/index.js -> dist/cli.js -> dist/service-installer.js L26: * The file writers are pure string builders so they can be unit-tested without L27: * touching launchctl/systemctl. L28: * ... L30: */ L31: import { execFileSync } from 'node:child_process'; L32: import { existsSync, mkdirSync, unlinkSync, writeFileSync } from 'node:fs'; ... L168: export function detectServiceKind() { L169: if (process.platform === 'darwin') L170: return 'launchd'; ... L176: return kind === 'launchd' L177: ? join(homedir(), 'Library', 'LaunchAgents', `${LAUNCHD_LABEL}.plist`) L178: : join(homedir(), '.config', 'systemd', 'user', SYSTEMD_UNIT);

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/service-installer.jsView on unpkg · L26

dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasmView file

•path = dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasm kind = wasm_module sizeBytes = 9448638 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasmView on unpkg

dist/web/public/terminal-ui.bc6819a9.js.gzView file

•path = dist/web/public/terminal-ui.bc6819a9.js.gz kind = high_entropy_blob sizeBytes = 18361 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/public/terminal-ui.bc6819a9.js.gzView on unpkg

•path = dist/web/public/terminal-ui.bc6819a9.js.gz kind = compressed_blob sizeBytes = 18361 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/web/public/terminal-ui.bc6819a9.js.gzView on unpkg

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = aicodeman@1.14.1 matchedIdentity = npm:YWljb2RlbWFu:1.14.1 similarity = 0.967 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/ai-checker-base.jsView file

24*/ L25: import { execSync, spawn as childSpawn } from 'node:child_process'; L26: import { existsSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/ai-checker-base.jsView on unpkg · L24

Findings

2 Critical7 High8 Medium6 Low

CriticalAi Agent Control Hijackscripts/postinstall.js

CriticalPrevious Version Dangerous Deltadist/cli.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/ai-checker-base.js

HighShelldist/remote-hosts.js

HighCross File Remote Execution Contextscripts/postinstall.js

HighTrigger Reachable Persistencedist/service-installer.js

HighRuntime Package Installscripts/postinstall.js

HighShips High Entropy Blobdist/web/public/terminal-ui.bc6819a9.js.gz

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/web/self-update.js

Affected versions and remediation

This report applies to aicodeman@1.14.2.

See all versions of aicodeman for other recorded verdicts.

Review the evidence and your use of aicodeman@1.14.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-09 02:22:05.300Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code