aicodeman@1.17.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

aicodeman@1.17.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/ai-checker-base.jsView file

24*/ L25: import { execSync, spawn as childSpawn } from 'node:child_process'; L26: import { existsSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/ai-checker-base.jsView on unpkg · L24

dist/remote-hosts.jsView file

6import { promisify } from 'node:util'; L7: const execAsync = promisify(exec); L8: const REMOTE_HOSTS_FILE = 'remote-hosts.json';

High

Shell

Package source references shell execution.

dist/remote-hosts.jsView on unpkg · L6

dist/web/self-update.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/web/self-update.js: import { existsSync, readFileSync, writeFileSync, renameSync, copyFileSync, chmodSync } from 'node:fs'; writeFileSync(tmp, JSON.stringify(status, null, 2)); const res = await fetch(`https://api.github.com/repos/${owner}/${repo}/releases/latest`, { copyFileSync(src, runner);

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/web/self-update.jsView on unpkg

33import { EXEC_TIMEOUT_MS } from '../config/exec-timeout.js'; L34: const require = createRequire(import.meta.url); L35: const { version: APP_VERSION } = require('../../package.json');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/web/self-update.jsView on unpkg · L33

dist/service-installer.jsView file

26Trigger-reachable persistence chain: scripts.start -> dist/index.js -> dist/cli.js -> dist/service-installer.js L26: * The file writers are pure string builders so they can be unit-tested without L27: * touching launchctl/systemctl. L28: * ... L30: */ L31: import { execFileSync } from 'node:child_process'; L32: import { existsSync, mkdirSync, unlinkSync, writeFileSync } from 'node:fs'; ... L168: export function detectServiceKind() { L169: if (process.platform === 'darwin') L170: return 'launchd'; ... L176: return kind === 'launchd' L177: ? join(homedir(), 'Library', 'LaunchAgents', `${LAUNCHD_LABEL}.plist`) L178: : join(homedir(), '.config', 'systemd', 'user', SYSTEMD_UNIT);

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/service-installer.jsView on unpkg · L26

26* The file writers are pure string builders so they can be unit-tested without L27: * touching launchctl/systemctl. L28: * ... L30: */ L31: import { execFileSync } from 'node:child_process'; L32: import { existsSync, mkdirSync, unlinkSync, writeFileSync } from 'node:fs'; ... L168: export function detectServiceKind() { L169: if (process.platform === 'darwin') L170: return 'launchd'; ... L176: return kind === 'launchd' L177: ? join(homedir(), 'Library', 'LaunchAgents', `${LAUNCHD_LABEL}.plist`) L178: : join(homedir(), '.config', 'systemd', 'user', SYSTEMD_UNIT);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/service-installer.jsView on unpkg · L26

scripts/postinstall.jsView file

23join(home, '.local/bin/claude'), L24: join(home, '.claude/local/claude'), L25: '/usr/local/bin/claude', ... L256: L257: const { mkdirSync, copyFileSync } = await import('fs'); L258: mkdirSync(vendorDir, { recursive: true }); L259: copyFileSync(join(xtermDir, 'css', 'xterm.css'), join(vendorDir, 'xterm.css')); L260: ... L269: // Fallback: copy unminified L270: copyFileSync(join(xtermDir, 'lib', 'xterm.js'), join(vendorDir, 'xterm.min.js')); L271: copyFileSync(join(fitDir, 'lib', 'addon-fit.js'), join(vendorDir, 'xterm-addon-fit.min.js')); L272: copyFileSync(join(serializeDir, 'lib', 'addon-serialize.js'), join(vendorDir, 'xterm-addon-serialize.min.js'));

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L23

7Cross-file remote execution chain: scripts/postinstall.js spawns dist/web/public/vendor/xterm-addon-webgl.min.js; helper contains network access plus dynamic code execution. L7: L8: import { execSync, spawn } from 'child_process'; L9: import { existsSync } from 'fs'; ... L20: // Claude CLI search paths (must match src/session.ts) L21: const home = homedir(); L22: const CLAUDE_SEARCH_PATHS = [ ... L33: L34: const useColor = process.stdout.isTTY && !process.env.NO_COLOR; L35: ... L83: const ok = await new Promise((resolve) => { L84: const conn = net.createConnection({ port, host: '127.0.0.1' }); L85: conn.once('connect', () => { conn.destroy(); resolve(true); });

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/postinstall.jsView on unpkg · L7

dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasmView file

•path = dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasm kind = wasm_module sizeBytes = 9448638 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasmView on unpkg

dist/web/public/subagent-windows.2a192c3e.js.gzView file

•path = dist/web/public/subagent-windows.2a192c3e.js.gz kind = high_entropy_blob sizeBytes = 12490 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/public/subagent-windows.2a192c3e.js.gzView on unpkg

•path = dist/web/public/subagent-windows.2a192c3e.js.gz kind = compressed_blob sizeBytes = 12490 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/web/public/subagent-windows.2a192c3e.js.gzView on unpkg

dist/web/routes/session-routes.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = aicodeman@1.16.6 matchedIdentity = npm:YWljb2RlbWFu:1.16.6 similarity = 0.942 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/web/routes/session-routes.jsView on unpkg

Source & flagged code

15 flagged

package.jsonView file

Lines 1-33json

1{

2 "name": "aicodeman",

3 "version": "1.17.0",

4 "description": "Mission control for AI coding agents - run 20 autonomous agents with real-time monitoring and session persistence",

5 "type": "module",

6 "main": "dist/index.js",

7 "types": "dist/index.d.ts",

8 "bin": {

9 "aicodeman": "./dist/index.js",

10 "codeman": "./dist/index.js"

11 },

12 "scripts": {

13 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L13

14 "build": "node scripts/build.mjs",

15 "build:gesture": "node scripts/build-gesture-bundle.mjs",

16 "start": "NODE_COMPILE_CACHE=${HOME}/.codeman/compile-cache node dist/index.js",

17 "dev": "tsx src/index.ts web",

18 "web": "node dist/index.js web",

19 "clean": "rm -rf dist",

20 "test": "vitest run --config config/vitest.config.ts",

21 "test:watch": "vitest --config config/vitest.config.ts",

22 "test:coverage": "vitest run --config config/vitest.config.ts --coverage",

23 "test:ci": "vitest run --config config/vitest.ci.config.ts",

24 "pretest:mobile": "node scripts/prepare-test-vendor.mjs",

25 "test:mobile": "vitest run --config test/mobile/vitest.config.ts",

26 "check:frontend-syntax": "node scripts/check-frontend-syntax.mjs",

27 "fix:node-pty": "node scripts/fix-node-pty.mjs",

28 "typecheck": "tsc --noEmit",

29 "lint": "eslint --config config/eslint.config.js 'src/**/*.ts'",

30 "lint:fix": "eslint --config config/eslint.config.js 'src/**/*.ts' --fix",

31 "format": "prettier --write 'src/**/*.ts' 'src/web/public/**/*.{js,css,html,json}'",

32 "format:check": "prettier --check 'src/**/*.ts' 'src/web/public/**/*.{js,css,html,json}'",

33 "check:public-assets": "node scripts/check-public-assets.mjs",

dist/ai-checker-base.jsView file

Lines 4-44javascript

4 * Provides shared functionality for AI-powered checkers that spawn fresh Claude CLI

5 * sessions to analyze terminal output. This base class handles:

6 * - Mux session spawning and cleanup

7

dist/remote-hosts.jsView file

Lines 1-26javascript

1import { existsSync, mkdirSync } from 'node:fs';

2import fs from 'node:fs/promises';

3import { join } from 'node:path';

4import { homedir } from 'node:os';

dist/web/self-update.jsView file

Lines 13-53javascript

13 * are auto-stashed (stash left for the user). Detection is manual (a button).

14 *

15 * Split into PURE helpers (semver/tag parsing, reconcile decision) that are unit

16 * tested, and IO

dist/service-installer.jsView file

Lines 6-46javascript

6 * now" half in daemon-control.ts. `install.sh` already does this for people who

7 * install with the one-liner; this exists for `npm i -g aicodeman` users, who

8 * otherwise have to hand-write a plist.

9 *

scripts/postinstall.jsView file

Lines 1-43javascript

1#!/usr/bin/env node

2

3/**

4 * Codeman postinstall verification script

5 * Runs after `npm install` to check environment readiness

6 */

7

8import { execSync, spawn } from 'child_process';

9import { existsSync } from 'fs'

dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasmView file

•path = dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasm kind = wasm_module sizeBytes = 9448638 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasmView on unpkg

dist/web/public/subagent-windows.2a192c3e.js.gzView file

•path = dist/web/public/subagent-windows.2a192c3e.js.gz kind = high_entropy_blob sizeBytes = 12490 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/public/subagent-windows.2a192c3e.js.gzView on unpkg

•path = dist/web/public/subagent-windows.2a192c3e.js.gz kind = compressed_blob sizeBytes = 12490 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/web/public/subagent-windows.2a192c3e.js.gzView on unpkg

dist/web/routes/session-routes.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = aicodeman@1.16.6 matchedIdentity = npm:YWljb2RlbWFu:1.16.6 similarity = 0.942 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/web/routes/session-routes.jsView on unpkg