registry / Install hook abuse / aicodeman / 1.26.1

aicodeman@1.26.1

Mission control for AI coding agents - run 20 autonomous agents with real-time monitoring and session persistence

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The source establishes unconsented install-time project mutation and autostart, but it does not establish the full lifecycle self-dependency chain, a foreign AI-agent control-surface write, or covert exfiltration. The credential use is confined to an authenticated, feature-gated relay to Anthropic.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation; voice use additionally requires the enabled voice route.

Impact

The installer changes developer workflow and starts a background process without an explicit command; the enabled voice feature uses a bearer credential for an external service.

Mechanism

Postinstall project mutation and local service launch, plus a credential-backed voice relay.

AI rationale

Evidence

package.jsonscripts/postinstall.jsdist/web/voice-stream.js.git/hooks/pre-commitdist/index.js~/.claude/.credentials.json

Network endpoints2

127.0.0.1api.anthropic.com

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package runs a postinstall script automatically.
Postinstall overwrites the consumer checkout’s .git/hooks/pre-commit file.
Postinstall starts a detached local web-server process unless opted out.
Runtime code can read Claude OAuth credentials and send them as a bearer token to Anthropic’s voice endpoint.

Evidence against

The credential relay is reachable only through a guarded voice WebSocket route and is feature-gated.
The configured upstream is api.anthropic.com, consistent with the stated speech relay.
No self-dependency, hidden remote payload, or foreign AI-agent configuration write was found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Source & flagged code

29 flagged

package.jsonView file

Lines 1-33json

2 "name": "aicodeman",

3 "version": "1.26.1",

4 "description": "Mission control for AI coding agents - run 20 autonomous agents with real-time monitoring and session persistence",

5 "type": "module",

6 "main": "dist/index.js",

7 "types": "dist/index.d.ts",

8 "bin": {

9 "aicodeman": "./dist/index.js",

10 "codeman": "./dist/index.js"

11 },

12 "scripts": {

13 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L13

14 "build": "node scripts/build.mjs",

15 "build:gesture": "node scripts/build-gesture-bundle.mjs",

16 "start": "NODE_COMPILE_CACHE=${HOME}/.codeman/compile-cache node dist/index.js",

17 "dev": "tsx src/index.ts web",

18 "web": "node dist/index.js web",

19 "clean": "rm -rf dist",

20 "test": "vitest run --config config/vitest.ci.config.ts",

21 "test:watch": "vitest --config config/vitest.ci.config.ts",

22 "test:coverage": "vitest run --config config/vitest.ci.config.ts --coverage",

23 "test:ci": "vitest run --config config/vitest.ci.config.ts",

24 "test:browser": "vitest run --config config/vitest.browser.config.ts",

25 "test:perf": "vitest run --config config/vitest.perf.config.ts",

26 "test:all": "vitest run --config config/vitest.config.ts",

27 "pretest:mobile": "node scripts/prepare-test-vendor.mjs",

28 "test:mobile": "vitest run --config test/mobile/vitest.config.ts",

29 "check:frontend-syntax": "node scripts/check-frontend-syntax.mjs",

30 "fix:node-pty": "node scripts/fix-node-pty.mjs",

31 "typecheck": "tsc --noEmit && tsc -p config/tsconfig.pr-bot.json",

32 "lint": "eslint --config config/eslint.config.js 'src/**/*.ts' 'scripts/pr-bot/**/*.ts'",

33 "lint:fix": "eslint --config config/eslint.config.js 'src/**/*.ts' 'scripts/pr-bot/**/*.ts' --fix",

dist/ai-checker-base.jsView file

24*/ L25: import { execSync, spawn as childSpawn } from 'node:child_process'; L26: import { existsSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/ai-checker-base.jsView on unpkg · L24

dist/remote-hosts.jsView file

7import { getCli } from './config/cli-registry/registry.js'; L8: const execAsync = promisify(exec); L9: const REMOTE_HOSTS_FILE = 'remote-hosts.json';

High

Shell

Package source references shell execution.

dist/remote-hosts.jsView on unpkg · L7

dist/web/repo-status.jsView file

•matchType = normalized_sha256 matchedPackage = aicodeman@1.24.6 matchedPath = dist/web/repo-status.js matchedIdentity = npm:YWljb2RlbWFu:1.24.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/web/repo-status.jsView on unpkg

43import { getInstallInfo } from './self-update.js'; L44: const require = createRequire(import.meta.url); L45: const { version: APP_VERSION } = require('../../package.json');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/web/repo-status.jsView on unpkg · L43

dist/service-installer.jsView file

26Trigger-reachable persistence chain: scripts.start -> dist/index.js -> dist/cli.js -> dist/service-installer.js L26: * The file writers are pure string builders so they can be unit-tested without L27: * touching launchctl/systemctl. L28: * ... L30: */ L31: import { execFileSync } from 'node:child_process'; L32: import { existsSync, mkdirSync, unlinkSync, writeFileSync } from 'node:fs'; ... L168: export function detectServiceKind() { L169: if (process.platform === 'darwin') L170: return 'launchd'; ... L176: return kind === 'launchd' L177: ? join(homedir(), 'Library', 'LaunchAgents', `${LAUNCHD_LABEL}.plist`) L178: : join(homedir(), '.config', 'systemd', 'user', SYSTEMD_UNIT);

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/service-installer.jsView on unpkg · L26

•matchType = normalized_sha256 matchedPackage = aicodeman@1.24.6 matchedPath = dist/service-installer.js matchedIdentity = npm:YWljb2RlbWFu:1.24.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/service-installer.jsView on unpkg

26* The file writers are pure string builders so they can be unit-tested without L27: * touching launchctl/systemctl. L28: * ... L30: */ L31: import { execFileSync } from 'node:child_process'; L32: import { existsSync, mkdirSync, unlinkSync, writeFileSync } from 'node:fs'; ... L168: export function detectServiceKind() { L169: if (process.platform === 'darwin') L170: return 'launchd'; ... L176: return kind === 'launchd' L177: ? join(homedir(), 'Library', 'LaunchAgents', `${LAUNCHD_LABEL}.plist`) L178: : join(homedir(), '.config', 'systemd', 'user', SYSTEMD_UNIT);

dist/deepseek-web-server.jsView file

167if (current.authority === authority && (await answersHttp(current.port))) { L168: return { ok: true, port: current.port, url: `http://127.0.0.1:${current.port}`, reused: true }; L169: } ... L177: try { L178: child = spawn(join(dshDir, 'dsh'), ['web', '--no-open', '--host', '127.0.0.1', '--port', String(port), '--trusted-host', authority], { L179: stdio: ['ignore', 'pipe', 'pipe'], ... L181: detached: true, L182: env: process.env, L183: });

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/deepseek-web-server.jsView on unpkg · L167

•matchType = normalized_sha256 matchedPackage = aicodeman@1.24.6 matchedPath = dist/deepseek-web-server.js matchedIdentity = npm:YWljb2RlbWFu:1.24.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/deepseek-web-server.jsView on unpkg

dist/web/webview-egress-policy.jsView file

6* at different stages: the Zod schema (a URL being saved), the sync check on a L7: * hostname that is already an IP literal (Node's `net.connect` skips DNS for L8: * those, so a lookup hook never sees them), and the DNS lookup hook that judges ... L123: * connect to. Non-IP input is never blocked here: names are judged by L124: * `isBlockedWebviewHostname()` at save time and by their resolved addresses at L125: * connect time.

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/web/webview-egress-policy.jsView on unpkg · L6

scripts/postinstall.jsView file

23join(home, '.local/bin/claude'), L24: join(home, '.claude/local/claude'), L25: '/usr/local/bin/claude', ... L256: L257: const { mkdirSync, copyFileSync } = await import('fs'); L258: mkdirSync(vendorDir, { recursive: true }); L259: copyFileSync(join(xtermDir, 'css', 'xterm.css'), join(vendorDir, 'xterm.css')); L260: ... L269: // Fallback: copy unminified L270: copyFileSync(join(xtermDir, 'lib', 'xterm.js'), join(vendorDir, 'xterm.min.js')); L271: copyFileSync(join(fitDir, 'lib', 'addon-fit.js'), join(vendorDir, 'xterm-addon-fit.min.js')); L272: copyFileSync(join(serializeDir, 'lib', 'addon-serialize.js'), join(vendorDir, 'xterm-addon-serialize.min.js'));

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L23

7Cross-file remote execution chain: scripts/postinstall.js spawns dist/web/public/vendor/xterm-addon-webgl.min.js; helper contains network access plus dynamic code execution. L7: L8: import { execSync, spawn } from 'child_process'; L9: import { existsSync } from 'fs'; ... L20: // Claude CLI search paths (must match src/session.ts) L21: const home = homedir(); L22: const CLAUDE_SEARCH_PATHS = [ ... L33: L34: const useColor = process.stdout.isTTY && !process.env.NO_COLOR; L35: ... L83: const ok = await new Promise((resolve) => { L84: const conn = net.createConnection({ port, host: '127.0.0.1' }); L85: conn.once('connect', () => { conn.destroy(); resolve(true); });

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/postinstall.jsView on unpkg · L7

dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasmView file

•path = dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasm kind = wasm_module sizeBytes = 9448638 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasmView on unpkg

skills/codeman/preamble.shView file

•path = skills/codeman/preamble.sh kind = build_helper sizeBytes = 16972 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/codeman/preamble.shView on unpkg

dist/web/public/terminal-ui.a39b5aa7.js.gzView file

•path = dist/web/public/terminal-ui.a39b5aa7.js.gz kind = high_entropy_blob sizeBytes = 23628 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/public/terminal-ui.a39b5aa7.js.gzView on unpkg

•path = dist/web/public/terminal-ui.a39b5aa7.js.gz kind = compressed_blob sizeBytes = 23628 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/web/public/terminal-ui.a39b5aa7.js.gzView on unpkg

dist/agent-case-marker.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 10

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agent-case-marker.js#virtual:normalized:round1View on unpkg

dist/web/self-update.jsView file

•matchType = normalized_sha256 matchedPackage = aicodeman@1.24.7 matchedPath = dist/web/self-update.js matchedIdentity = npm:YWljb2RlbWFu:1.24.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/web/self-update.jsView on unpkg

dist/web/routes/system-routes.jsView file

•matchType = normalized_sha256 matchedPackage = aicodeman@1.24.7 matchedPath = dist/web/routes/system-routes.js matchedIdentity = npm:YWljb2RlbWFu:1.24.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/web/routes/system-routes.jsView on unpkg

scripts/fix-node-pty.mjsView file

•matchType = normalized_sha256 matchedPackage = aicodeman@1.24.6 matchedPath = scripts/fix-node-pty.mjs matchedIdentity = npm:YWljb2RlbWFu:1.24.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/fix-node-pty.mjsView on unpkg

dist/claude-credentials.jsView file

•matchType = normalized_sha256 matchedPackage = aicodeman@1.24.6 matchedPath = dist/claude-credentials.js matchedIdentity = npm:YWljb2RlbWFu:1.24.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/claude-credentials.jsView on unpkg

dist/daemon-control.jsView file

•matchType = token_shingles matchedPackage = aicodeman@1.24.6 matchedPath = dist/daemon-control.js matchedIdentity = npm:YWljb2RlbWFu:1.24.6 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/daemon-control.jsView on unpkg

dist/git-clone.jsView file

•matchType = normalized_sha256 matchedPackage = aicodeman@1.24.6 matchedPath = dist/git-clone.js matchedIdentity = npm:YWljb2RlbWFu:1.24.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/git-clone.jsView on unpkg

dist/tui/tui-client.jsView file

•matchType = normalized_sha256 matchedPackage = aicodeman@1.24.6 matchedPath = dist/tui/tui-client.js matchedIdentity = npm:YWljb2RlbWFu:1.24.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tui/tui-client.jsView on unpkg

dist/document-preview-cache.jsView file

•matchType = normalized_sha256 matchedPackage = aicodeman@1.24.6 matchedPath = dist/document-preview-cache.js matchedIdentity = npm:YWljb2RlbWFu:1.24.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/document-preview-cache.jsView on unpkg

Source & flagged code

29 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/ai-checker-base.jsView file

24*/ L25: import { execSync, spawn as childSpawn } from 'node:child_process'; L26: import { existsSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/ai-checker-base.jsView on unpkg · L24

Findings

1 Critical22 High9 Medium5 Low

CriticalAi Agent Control Hijackscripts/postinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/ai-checker-base.js

HighShelldist/remote-hosts.js

HighSame File Env Network Executiondist/deepseek-web-server.js

HighCloud Metadata Accessdist/web/webview-egress-policy.js

HighCross File Remote Execution Contextscripts/postinstall.js

HighTrigger Reachable Persistencedist/service-installer.js

HighRuntime Package Installscripts/postinstall.js

HighShips High Entropy Blobdist/web/public/terminal-ui.a39b5aa7.js.gz

HighSemantic Analysis Limiteddist/agent-case-marker.js#virtual:normalized:round1

Affected versions and remediation

This report applies to aicodeman@1.26.1.

See all versions of aicodeman for other recorded verdicts.

Review the evidence and your use of aicodeman@1.26.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-07 21:00:58.120Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code