registry / Install hook abuse / aicodeman / 1.29.0

aicodeman@1.29.0

Mission control for AI coding agents - run 20 autonomous agents with real-time monitoring and session persistence

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The package contains concrete unconsented install-time mutations and background execution, so it should warn. The inspected credential use is tied to a guarded Anthropic voice relay rather than demonstrated theft.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation; later use of the enabled same-origin voice WebSocket

Impact

Unexpected background execution and project-hook replacement; the voice feature uses the operator's Claude account.

Mechanism

install-time process and repository mutation plus credential-backed voice relay

AI rationale

Evidence

package.jsonscripts/postinstall.jsscripts/fix-node-pty.mjsdist/claude-credentials.jsdist/web/voice-stream.js.git/hooks/pre-commitnode_modules/node-pty/prebuilds/**/spawn-helperdist/index.js

Network endpoints2

127.0.0.1api.anthropic.com

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The install hook starts a detached web server automatically.
The install hook overwrites the consumer repository's pre-commit hook.
The install path can rebuild and modify node-pty.
At runtime, the voice feature reads a Claude OAuth token and relays it to Anthropic.

Evidence against

No self-dependency or downloaded payload was found in package.json.
The credential relay is guarded by same-origin checks and voice availability.
The reviewed network endpoint is Anthropic's voice service, not an unrelated collector.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

29 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/ai-checker-base.jsView file

Lines 4-44javascript

4 * Provides shared functionality for AI-powered checkers that spawn fresh Claude CLI

5 * sessions to analyze terminal output. This base class handles:

6 * - Mux session spawning and cleanup

7 * - Temp file management for output capture

8 * - Polling for completion markers

9 * - Cooldown management

10 * - Error handling and consecutive error tracking

11 * - Event emission for state changes

12 *

13 * Subclasses implement:

14 * - `muxNamePrefix`: Prefix for mux session names (e.g., 'codeman-aicheck-')

15 * - `doneMarker`: Completion marker in output file (e.g., '__AICHECK_DONE__')

16 * - `tempFilePrefix`: Prefix for temp files (e.g., 'codeman-aicheck')

17 * - `logPrefix`: Prefix for log messages (e.g., '[AiIdleChecker]')

18 * - `buildPrompt()`: Build the prompt from terminal buffer

19 * - `parseVerdict()`: Parse the verdict from AI output

20 * - `getPositiveVerdict()`: Return the "positive" verdict that doesn't trigger cooldown

21 * - `defaultConfig`: Default configuration values

22 *

23 * @module ai-checker-base

24 */

25import { execSync, spawn as childSpawn } from 'node:child_process';

26import { existsSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/ai-checker-base.jsView on unpkg · L24

27import { tmpdir } from 'node:os';

28import { join } from 'node:path';

29import { EventEmitter } from 'node:events';

30import { getAugmentedPath, ANSI_ESCAPE_PATTERN_SIMPLE } from './utils/index.js';

31import { AI_CHECK_MAX_BACKOFF_MS } from './config/ai-defaults.js';

32import { getErrorMessage } from './types.js';

33// ========== Security Validation ==========

34/**

35 * Validates that a model name is safe for shell use.

36 * Model names should only contain alphanumeric characters, hyphens, underscores, and dots.

37 * Exported for the Read My Mind predictor, which reuses these spawn mechanics standalone.

38 */

39export function isValidModelName(model) {

40 if (!model || typeof model !== 'string')

41 return false;

42 // Allow: alphanumeric, hyphens, underscores, dots, slashes (for model paths like claude/opus-4.5)

43 // Max length 100 to prevent abuse

44 return /^[a-zA-Z0-9._/-]+$/.test(model) && model.length <= 100;

dist/remote-hosts.jsView file

7import { getCli } from './config/cli-registry/registry.js'; L8: const execAsync = promisify(exec); L9: const REMOTE_HOSTS_FILE = 'remote-hosts.json';

High

Shell

Package source references shell execution.

dist/remote-hosts.jsView on unpkg · L7

dist/web/repo-status.jsView file

Lines 23-63javascript

23 *

24 * PERFORMANCE: every git invocation is ASYNC (`execFile`), never `execFileSync`

25 * — the fetch path can spend `2 × FETCH_TIMEOUT_MS` per remote on the network,

26 * and a synchronous version froze the whole event loop (SSE

dist/service-installer.jsView file

26Trigger-reachable persistence chain: scripts.start -> dist/index.js -> dist/cli.js -> dist/service-installer.js L26: * The file writers are pure string builders so they can be unit-tested without L27: * touching launchctl/systemctl. L28: * ... L30: */ L31: import { execFileSync } from 'node:child_process'; L32: import { existsSync, mkdirSync, unlinkSync, writeFileSync } from 'node:fs'; ... L168: export function detectServiceKind() { L169: if (process.platform === 'darwin') L170: return 'launchd'; ... L176: return kind === 'launchd' L177: ? join(homedir(), 'Library', 'LaunchAgents', `${LAUNCHD_LABEL}.plist`) L178: : join(homedir(), '.config', 'systemd', 'user', SYSTEMD_UNIT);

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/service-installer.jsView on unpkg · L26

26* The file writers are pure string builders so they can be unit-tested without L27: * touching launchctl/systemctl. L28: * ... L30: */ L31: import { execFileSync } from 'node:child_process'; L32: import { existsSync, mkdirSync, unlinkSync, writeFileSync } from 'node:fs'; ... L168: export function detectServiceKind() { L169: if (process.platform === 'darwin') L170: return 'launchd'; ... L176: return kind === 'launchd' L177: ? join(homedir(), 'Library', 'LaunchAgents', `${LAUNCHD_LABEL}.plist`) L178: : join(homedir(), '.config', 'systemd', 'user', SYSTEMD_UNIT);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/service-installer.jsView on unpkg · L26

dist/deepseek-web-server.jsView file

Lines 147-187javascript

147 * prevent. The second caller now simply waits and reuses the first's server.

148 */

149let startLock = Promise.resolve();

150/**

151 * Start (or reuse) the background `dsh web` for `authority`.

152 *

153

dist/web/webview-egress-policy.jsView file

Lines 1-26javascript

1/**

2 * @fileoverview Egress policy for the web-tab proxy: which upstream ADDRESSES

3 * a saved dashboard URL may never resolve to.

4 *

5 * Pure (no IO), so the same predicate serves three call sites that see the target

6 * at different stages: the Zod schema (a URL being saved), the sync check on a

7 * hostname that is already an IP literal (Node's `net.connect` skips DNS for

8 * those, so a lookup hook never sees them), and the DNS lookup hook that judges

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

scripts/postinstall.jsView file

23join(home, '.local/bin/claude'), L24: join(home, '.claude/local/claude'), L25: '/usr/local/bin/claude', ... L256: L257: const { mkdirSync, copyFileSync } = await import('fs'); L258: mkdirSync(vendorDir, { recursive: true }); L259: copyFileSync(join(xtermDir, 'css', 'xterm.css'), join(vendorDir, 'xterm.css')); L260: ... L269: // Fallback: copy unminified L270: copyFileSync(join(xtermDir, 'lib', 'xterm.js'), join(vendorDir, 'xterm.min.js')); L271: copyFileSync(join(fitDir, 'lib', 'addon-fit.js'), join(vendorDir, 'xterm-addon-fit.min.js')); L272: copyFileSync(join(serializeDir, 'lib', 'addon-serialize.js'), join(vendorDir, 'xterm-addon-serialize.min.js'));

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L23

7Cross-file remote execution chain: scripts/postinstall.js spawns dist/web/public/vendor/xterm-addon-webgl.min.js; helper contains network access plus dynamic code execution. L7: L8: import { execSync, spawn } from 'child_process'; L9: import { existsSync } from 'fs'; ... L20: // Claude CLI search paths (must match src/session.ts) L21: const home = homedir(); L22: const CLAUDE_SEARCH_PATHS = [ ... L33: L34: const useColor = process.stdout.isTTY && !process.env.NO_COLOR; L35: ... L83: const ok = await new Promise((resolve) => { L84: const conn = net.createConnection({ port, host: '127.0.0.1' }); L85: conn.once('connect', () => { conn.destroy(); resolve(true); });

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/postinstall.jsView on unpkg · L7

dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasmView file

•path = dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasm kind = wasm_module sizeBytes = 9448638 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasmView on unpkg

skills/codeman/preamble.shView file

•path = skills/codeman/preamble.sh kind = build_helper sizeBytes = 16972 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/codeman/preamble.shView on unpkg

dist/web/public/upload.html.brView file

•path = dist/web/public/upload.html.br kind = compressed_blob sizeBytes = 1836 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/web/public/upload.html.brView on unpkg

dist/web/public/keyboard-accessory.2cf04f17.js.gzView file

•path = dist/web/public/keyboard-accessory.2cf04f17.js.gz kind = high_entropy_blob sizeBytes = 15129 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/public/keyboard-accessory.2cf04f17.js.gzView on unpkg

dist/agent-case-marker.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 10

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agent-case-marker.js#virtual:normalized:round1View on unpkg

dist/web/routes/system-routes.jsView file

•matchType = token_shingles matchedPackage = aicodeman@1.24.6 matchedPath = dist/web/routes/system-routes.js matchedIdentity = npm:YWljb2RlbWFu:1.24.6 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High