Loading npm security reports…
aicodeman@1.33.0: Agent extension lifecycle risk – flagged | LPM Firewall
Flagged as agent extension risk
Allowed by default with warning: install-time first-party agent extension setup was detected.
scanned 25d ago · by lpm-firewall-ai The install hook launches the product server, and that server’s default recovery path writes first-party Claude Code hooks into existing managed workspaces. The behavior is scoped, setting-gated, and product-aligned, so it is a guarded agent-extension lifecycle risk rather than a hidden credential-theft or broad hijack payload.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
npm install runs postinstall, which spawns the web server unless CI or CODEMAN_NO_AUTOSTART is set; server recovery then installs hooks.
Impact
Install can change Claude Code behavior in previously managed project directories without a fresh consent prompt, adding Codeman-controlled hook commands to those workspaces.
Mechanism
The detached server calls ensureHooksForRecoveredWorkspaces and applyWorkspaceHooks, and ensureCodemanHooks writes Claude Code hook commands that POST session events to the local Codeman API.
AI rationale
The install hook launches the product server, and that server’s default recovery path writes first-party Claude Code hooks into existing managed workspaces. The behavior is scoped, setting-gated, and product-aligned, so it is a guarded agent-extension lifecycle risk rather than a hidden credential-theft or broad hijack payload.
Evidence
package.json scripts/postinstall.js dist/web/server.js dist/hooks-config.js .claude/settings.local.json
public snapshot AI called this Suspicious at 74.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
package.json registers a postinstall script that runs scripts/postinstall.js during npm install. Unless CI or CODEMAN_NO_AUTOSTART is set, postinstall detaches and starts node dist/index.js web. Server startup calls ensureHooksForRecoveredWorkspaces, which invokes applyWorkspaceHooks(workspace, true) for recovered local Claude sessions. workspaceHooksEnabled is treated as on when the settings key is absent or settings.json cannot be read, and that path installs Codeman hooks via ensureCodemanHooks. Those hooks are written into each workspace .claude/settings.local.json so Claude Code commands post events back to the local Codeman API. Evidence against
Autostart is skipped when CI or CODEMAN_NO_AUTOSTART is set. Hook writes are limited to existing recovered Claude workspaces, refuse symlink escapes, and can be disabled with workspaceHooksEnabled false. Published dependencies do not include a runtime self-dependency on aicodeman, and the install path does not send Claude OAuth tokens to an operator-chosen host. 29 flagged · loading source • scripts.postinstall = node scripts/postinstall.js
High Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.json View on unpkg • scripts.postinstall = node scripts/postinstall.js
Medium Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.json View on unpkg 24 */
L25: import { execSync, spawn as childSpawn } from 'node:child_process';
L26: import { existsSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
High Child Process
Package source references child process execution.
dist/ai-checker-base.js View on unpkg · L24
1 Critical 22 High 9 Medium 5 Low
Critical Ai Agent Control Hijack scripts/postinstall.js
High Install Time Lifecycle Scripts package.json
High Child Process dist/ai-checker-base.js
High Shell dist/remote-hosts.js
High Same File Env Network Execution dist/deepseek-web-server.js
High Cloud Metadata Access dist/web/webview-egress-policy.js
High Cross File Remote Execution Context scripts/postinstall.js
High Trigger Reachable Persistence dist/service-installer.js
High Runtime Package Install scripts/postinstall.js
High Ships High Entropy Blob dist/web/public/panels-ui.67646701.js.gz
High Semantic Analysis Limited dist/agent-case-marker.js#virtual:normalized:round1
Affected versions and remediation This report applies to aicodeman@1.33.0 .
See all versions of aicodeman for other recorded verdicts.
Review the evidence and your use of aicodeman@1.33.0 before allowing it. Restrict the permissions described in this report. Choose an independently verified alternative or release. This report does not establish that other versions are safe. Evidence last updated: 2026-09-27 21:33:29.199Z (UTC) .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced .
74% Suspicious
AI assessment confidence
Package metadata npm Author arkon
Maintainers ark0n
Version 1.33.0
Latest on npm 1.44.0
Published Sep 24, 2026
License MIT
Dependencies 25
Integrity verified
Package size 17.2 MB
Files 1,306
Keywords claude-code claude-ai claude anthropic opencode codex antigravity pi
ChildProcess
Crypto
DynamicRequire
EnvironmentVars
Filesystem
Network
Shell
WebSocket
Supply chain HighEntropyStrings Minified PossibleObfuscation Telemetry UrlStrings
Manifest No manifest risk signals triggered.
scanned 333 file(s), 6.67 MB of source, external domains: 127.0.0.1, antigravity.google, api.github.com, cdn.jsdelivr.net, claude.ai, developer.mozilla.org, developers.cloudflare.com, developers.openai.com, docs.claude.com, github.com, nodejs.org, omp.sh, opencode.ai, pi.dev, storage.googleapis.com, www.apple.com, www.w3.org, x.ai
7 import { getCli } from './config/cli-registry/registry.js';
L8: const execAsync = promisify(exec);
L9: const REMOTE_HOSTS_FILE = 'remote-hosts.json';
• matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/web/repo-status.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/web/repo-status.js View on unpkg 43 import { getInstallInfo } from './self-update.js';
L44: const require = createRequire(import.meta.url);
L45: const { version: APP_VERSION } = require('../../package.json');
Medium Dynamic Require
Package source references dynamic require/import behavior.
dist/web/repo-status.js View on unpkg · L43 26 Trigger-reachable persistence chain: scripts.start -> dist/index.js -> dist/cli.js -> dist/service-installer.js
L26: * The file writers are pure string builders so they can be unit-tested without
L27: * touching launchctl/systemctl.
L28: *
...
L30: */
L31: import { execFileSync } from 'node:child_process';
L32: import { existsSync, mkdirSync, unlinkSync, writeFileSync } from 'node:fs';
...
L168: export function detectServiceKind() {
L169: if (process.platform === 'darwin')
L170: return 'launchd';
...
L176: return kind === 'launchd'
L177: ? join(homedir(), 'Library', 'LaunchAgents', `${LAUNCHD_LABEL}.plist`)
L178: : join(homedir(), '.config', 'systemd', 'user', SYSTEMD_UNIT);
High Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/service-installer.js View on unpkg · L26 26 * The file writers are pure string builders so they can be unit-tested without
L27: * touching launchctl/systemctl.
L28: *
...
L30: */
L31: import { execFileSync } from 'node:child_process';
L32: import { existsSync, mkdirSync, unlinkSync, writeFileSync } from 'node:fs';
...
L168: export function detectServiceKind() {
L169: if (process.platform === 'darwin')
L170: return 'launchd';
...
L176: return kind === 'launchd'
L177: ? join(homedir(), 'Library', 'LaunchAgents', `${LAUNCHD_LABEL}.plist`)
L178: : join(homedir(), '.config', 'systemd', 'user', SYSTEMD_UNIT);
Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/service-installer.js View on unpkg · L26 167 if (current.authority === authority && (await answersHttp(current.port))) {
L168: return { ok: true, port: current.port, url: `http://127.0.0.1:${current.port}`, reused: true };
L169: }
...
L177: try {
L178: child = spawn(join(dshDir, 'dsh'), ['web', '--no-open', '--host', '127.0.0.1', '--port', String(port), '--trusted-host', authority], {
L179: stdio: ['ignore', 'pipe', 'pipe'],
...
L181: detached: true,
L182: env: process.env,
L183: });
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/deepseek-web-server.js View on unpkg · L167 • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/deepseek-web-server.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/deepseek-web-server.js View on unpkg 6 * at different stages: the Zod schema (a URL being saved), the sync check on a
L7: * hostname that is already an IP literal (Node's `net.connect` skips DNS for
L8: * those, so a lookup hook never sees them), and the DNS lookup hook that judges
...
L123: * connect to. Non-IP input is never blocked here: names are judged by
L124: * `isBlockedWebviewHostname()` at save time and by their resolved addresses at
L125: * connect time.
High Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
dist/web/webview-egress-policy.js View on unpkg · L6 23 join(home, '.local/bin/claude'),
L24: join(home, '.claude/local/claude'),
L25: '/usr/local/bin/claude',
...
L256:
L257: const { mkdirSync, copyFileSync } = await import('fs');
L258: mkdirSync(vendorDir, { recursive: true });
L259: copyFileSync(join(xtermDir, 'css', 'xterm.css'), join(vendorDir, 'xterm.css'));
L260:
...
L269: // Fallback: copy unminified
L270: copyFileSync(join(xtermDir, 'lib', 'xterm.js'), join(vendorDir, 'xterm.min.js'));
L271: copyFileSync(join(fitDir, 'lib', 'addon-fit.js'), join(vendorDir, 'xterm-addon-fit.min.js'));
L272: copyFileSync(join(serializeDir, 'lib', 'addon-serialize.js'), join(vendorDir, 'xterm-addon-serialize.min.js'));
Critical Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/postinstall.js View on unpkg · L23 7 Cross-file remote execution chain: scripts/postinstall.js spawns dist/web/public/vendor/xterm-addon-webgl.min.js; helper contains network access plus dynamic code execution.
L7:
L8: import { execSync, spawn } from 'child_process';
L9: import { existsSync } from 'fs';
...
L20: // Claude CLI search paths (must match src/session.ts)
L21: const home = homedir();
L22: const CLAUDE_SEARCH_PATHS = [
...
L33:
L34: const useColor = process.stdout.isTTY && !process.env.NO_COLOR;
L35:
...
L83: const ok = await new Promise((resolve) => {
L84: const conn = net.createConnection({ port, host: '127.0.0.1' });
L85: conn.once('connect', () => { conn.destroy(); resolve(true); });
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
scripts/postinstall.js View on unpkg · L7 262 try {
L263: execSync(`npx esbuild "${join(xtermDir, 'lib', 'xterm.js')}" --minify --outfile="${join(vendorDir, 'xterm.min.js')}"`, { stdio: 'pipe' });
L264: execSync(`npx esbuild "${join(fitDir, 'lib', 'addon-fit.js')}" --minify --outfile="${join(vendorDir, 'xterm-addon-fit.min.js')}"`, { stdio: 'pipe' });
High Runtime Package Install
Package source invokes a package manager install command at runtime.
scripts/postinstall.js View on unpkg · L262 • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = scripts/postinstall.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/postinstall.js View on unpkg dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasm View file • path = dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasm
kind = wasm_module
sizeBytes = 9448638
magicHex = [redacted]
Medium Ships Wasm Module
Package ships WebAssembly modules.
dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasm View on unpkg • path = skills/codeman/preamble.sh
kind = build_helper
sizeBytes = 20196
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
skills/codeman/preamble.sh View on unpkg dist/web/public/panels-ui.67646701.js.gz View file • path = dist/web/public/panels-ui.67646701.js.gz
kind = high_entropy_blob
sizeBytes = 30301
magicHex = [redacted]
High Ships High Entropy Blob
Package ships high-entropy non-source blobs.
dist/web/public/panels-ui.67646701.js.gz View on unpkg • path = dist/web/public/panels-ui.67646701.js.gz
kind = compressed_blob
sizeBytes = 30301
magicHex = [redacted]
Medium Ships Compressed Blob
Package ships compressed or archive-like blobs.
dist/web/public/panels-ui.67646701.js.gz View on unpkg dist/agent-case-marker.js#virtual:normalized:round1 View file • stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 9
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/agent-case-marker.js#virtual:normalized:round1 View on unpkg • matchType = token_shingles
matchedPackage = aicodeman@1.24.6
matchedPath = dist/web/routes/system-routes.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
shingleOverlap = 48
summary = source token shingles overlapped finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/web/routes/system-routes.js View on unpkg • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = scripts/fix-node-pty.mjs
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/fix-node-pty.mjs View on unpkg • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/claude-credentials.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/claude-credentials.js View on unpkg • matchType = token_shingles
matchedPackage = aicodeman@1.24.6
matchedPath = dist/daemon-control.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
shingleOverlap = 48
summary = source token shingles overlapped finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/daemon-control.js View on unpkg • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/tunnel-manager.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/tunnel-manager.js View on unpkg • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/utils/codex-cli-resolver.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/utils/codex-cli-resolver.js View on unpkg • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/utils/deepseek-cli-resolver.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/utils/deepseek-cli-resolver.js View on unpkg • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/utils/grok-cli-resolver.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/utils/grok-cli-resolver.js View on unpkg • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/utils/omp-cli-resolver.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/utils/omp-cli-resolver.js View on unpkg High Known Malware Source Similarity dist/web/routes/system-routes.js
High Known Malware Source Similarity scripts/fix-node-pty.mjs
High Known Malware Source Similarity scripts/postinstall.js
High Known Malware Source Similarity dist/claude-credentials.js
High Known Malware Source Similarity dist/daemon-control.js
High Known Malware Source Similarity dist/web/repo-status.js
High Known Malware Source Similarity dist/deepseek-web-server.js
High Known Malware Source Similarity dist/tunnel-manager.js
High Known Malware Source Similarity dist/utils/codex-cli-resolver.js
High Known Malware Source Similarity dist/utils/deepseek-cli-resolver.js
High Known Malware Source Similarity dist/utils/grok-cli-resolver.js
High Known Malware Source Similarity dist/utils/omp-cli-resolver.js
Medium Ambiguous Install Lifecycle Script package.json
Medium Dynamic Require dist/web/repo-status.js
Medium Install Persistence dist/service-installer.js
Medium Ships Wasm Module dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasm
Medium Ships Build Helper skills/codeman/preamble.sh
Medium Ships Compressed Blob dist/web/public/panels-ui.67646701.js.gz
Medium Structural Risk Force Deep Review
Runtime surface package.json Entrypoints main → dist/index.js types → dist/index.d.ts bin → aicodeman, codeman
Runtime node >=22.0.0
Artifact 40.6 MB · 1,306 files 2 signature(s)
Install lifecycle postinstall
Behavioral surface ChildProcess Crypto DynamicRequire EnvironmentVars Filesystem Network Shell WebSocket HighEntropyStrings Minified PossibleObfuscation Telemetry UrlStrings Manifest: clean
29 flagged Lines 1-33 json
4 "description" : "Mission control for AI coding agents - run 20 autonomous agents with real-time monitoring and session persistence" ,
6 "main" : "dist/index.js" ,
7 "types" : "dist/index.d.ts" ,
9 "aicodeman" : "./dist/index.js" ,
10 "codeman" : "./dist/index.js"
13 "postinstall" : "node scripts/postinstall.js" ,
High Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.json View on unpkg · L13 Medium Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.json View on unpkg · L13 14 "build" : "node scripts/build.mjs" ,
15 "build:gesture" : "node scripts/build-gesture-bundle.mjs" ,
16 "generate:cli-catalog" : "tsx scripts/generate-cli-catalog.mts" ,
17 "start" : "NODE_COMPILE_CACHE=${HOME}/.codeman/compile-cache node dist/index.js" ,
18 "dev" : "tsx src/index.ts web" ,
19 "web" : "node dist/index.js web" ,
20 "clean" : "rm -rf dist" ,
21 "test" : "vitest run --config config/vitest.ci.config.ts" ,
22 "test:watch" : "vitest --config config/vitest.ci.config.ts" ,
23 "test:coverage" : "vitest run --config config/vitest.ci.config.ts --coverage" ,
24 "test:ci" : "vitest run --config config/vitest.ci.config.ts" ,
25 "test:browser" : "vitest run --config config/vitest.browser.config.ts" ,
26 "test:perf" : "vitest run --config config/vitest.perf.config.ts" ,
27 "test:all" : "vitest run --config config/vitest.config.ts" ,
28 "pretest:mobile" : "node scripts/prepare-test-vendor.mjs" ,
29 "test:mobile" : "vitest run --config test/mobile/vitest.config.ts" ,
30 "check:frontend-syntax" : "node scripts/check-frontend-syntax.mjs" ,
31 "fix:node-pty" : "node scripts/fix-node-pty.mjs" ,
32 "typecheck" : "tsc --noEmit && tsc -p config/tsconfig.scripts.json" ,
33 "lint" : "eslint --config config/eslint.config.js 'src/**/*.ts'" ,
Lines 4-44 javascript
4 * Provides shared functionality for AI - powered checkers that spawn fresh Claude CLI
5 * sessions to analyze terminal output. This base class handles :
6 * - Mux session spawning and cleanup
Lines 1-27 javascript
1 import { existsSync, mkdirSync } from 'node:fs' ;
2 import fs from 'node:fs/promises' ;
3 import { join } from 'node:path' ;
4 import { homedir } from 'node:os' ;
Lines 23-63 javascript
24 * PERFORMANCE : every git invocation is ASYNC ( `execFile` ), never `execFileSync`
25 * — the fetch path can spend `2 × FETCH_TIMEOUT_MS` per remote on the network,
26 * and a synchronous version froze the whole event loop ( SSE
Lines 6-46 javascript
6 * now " half in daemon-control.ts. `install.sh` already does this for people wh o
7 * install with the one - liner; this exists for `npm i -g aicodeman` users, who
8 * otherwise have to hand - write a plist.
Lines 147-187 javascript
147 * prevent. The second caller now simply waits and reuses the first 's server .
149 let startLock = Promise . resolve ();
151 * Start (or reuse) the background `dsh web` for `authority`.
Lines 1-26 javascript
2 * @fileoverview Egress policy for the web-tab proxy: which upstream ADDRESSES
3 * a saved dashboard URL may never resolve to.
5 * Pure (no IO), so the same predicate serves three call sites that see the target
6 * at different stages: the Zod schema (a URL being saved), the sync check on a
7 * hostname that is already an IP literal (Node's `net.connect` skips DNS for
8 * those, so a lookup hook never sees them), and the DNS lookup hook that judges
High Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
23 join(home, '.local/bin/claude'),
L24: join(home, '.claude/local/claude'),
L25: '/usr/local/bin/claude',
...
L256:
L257: const { mkdirSync, copyFileSync } = await import('fs');
L258: mkdirSync(vendorDir, { recursive: true });
L259: copyFileSync(join(xtermDir, 'css', 'xterm.css'), join(vendorDir, 'xterm.css'));
L260:
...
L269: // Fallback: copy unminified
L270: copyFileSync(join(xtermDir, 'lib', 'xterm.js'), join(vendorDir, 'xterm.min.js'));
L271: copyFileSync(join(fitDir, 'lib', 'addon-fit.js'), join(vendorDir, 'xterm-addon-fit.min.js'));
L272: copyFileSync(join(serializeDir, 'lib', 'addon-serialize.js'), join(vendorDir, 'xterm-addon-serialize.min.js'));
Critical Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/postinstall.js View on unpkg · L23 7 Cross-file remote execution chain: scripts/postinstall.js spawns dist/web/public/vendor/xterm-addon-webgl.min.js; helper contains network access plus dynamic code execution.
L7:
L8: import { execSync, spawn } from 'child_process';
L9: import { existsSync } from 'fs';
...
L20: // Claude CLI search paths (must match src/session.ts)
L21: const home = homedir();
L22: const CLAUDE_SEARCH_PATHS = [
...
L33:
L34: const useColor = process.stdout.isTTY && !process.env.NO_COLOR;
L35:
...
L83: const ok = await new Promise((resolve) => {
L84: const conn = net.createConnection({ port, host: '127.0.0.1' });
L85: conn.once('connect', () => { conn.destroy(); resolve(true); });
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
scripts/postinstall.js View on unpkg · L7
dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasm View file • path = dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasm
kind = wasm_module
sizeBytes = 9448638
magicHex = [redacted]
Medium Ships Wasm Module
Package ships WebAssembly modules.
dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasm View on unpkg • path = skills/codeman/preamble.sh
kind = build_helper
sizeBytes = 20196
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
skills/codeman/preamble.sh View on unpkg dist/web/public/panels-ui.67646701.js.gz View file • path = dist/web/public/panels-ui.67646701.js.gz
kind = high_entropy_blob
sizeBytes = 30301
magicHex = [redacted]
High Ships High Entropy Blob
Package ships high-entropy non-source blobs.
dist/web/public/panels-ui.67646701.js.gz View on unpkg • path = dist/web/public/panels-ui.67646701.js.gz
kind = compressed_blob
sizeBytes = 30301
magicHex = [redacted]
Medium Ships Compressed Blob
Package ships compressed or archive-like blobs.
dist/web/public/panels-ui.67646701.js.gz View on unpkg dist/agent-case-marker.js#virtual:normalized:round1 View file • stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 9
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/agent-case-marker.js#virtual:normalized:round1 View on unpkg • matchType = token_shingles
matchedPackage = aicodeman@1.24.6
matchedPath = dist/web/routes/system-routes.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
shingleOverlap = 48
summary = source token shingles overlapped finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/web/routes/system-routes.js View on unpkg • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = scripts/fix-node-pty.mjs
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/fix-node-pty.mjs View on unpkg • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/claude-credentials.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/claude-credentials.js View on unpkg • matchType = token_shingles
matchedPackage = aicodeman@1.24.6
matchedPath = dist/daemon-control.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
shingleOverlap = 48
summary = source token shingles overlapped finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/daemon-control.js View on unpkg • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/tunnel-manager.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/tunnel-manager.js View on unpkg • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/utils/codex-cli-resolver.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/utils/codex-cli-resolver.js View on unpkg • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/utils/deepseek-cli-resolver.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/utils/deepseek-cli-resolver.js View on unpkg • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/utils/grok-cli-resolver.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/utils/grok-cli-resolver.js View on unpkg • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/utils/omp-cli-resolver.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/utils/omp-cli-resolver.js View on unpkg * - Temp file management for output capture
8 * - Polling for completion markers
9 * - Cooldown management
10 * - Error handling and consecutive error tracking
11 * - Event emission for state changes
13 * Subclasses implement :
14 * - ` muxNamePrefix `: Prefix for mux session names ( e . g ., ' codeman - aicheck -')
15 * - ` doneMarker `: Completion marker in output file ( e . g ., ' __AICHECK_DONE__ ')
16 * - ` tempFilePrefix `: Prefix for temp files ( e . g ., ' codeman - aicheck ')
17 * - ` logPrefix `: Prefix for log messages ( e . g ., '[ AiIdleChecker ]')
18 * - ` buildPrompt ()`: Build the prompt from terminal buffer
19 * - ` parseVerdict ()`: Parse the verdict from AI output
20 * - ` getPositiveVerdict ()`: Return the " positive " verdict that doesn ' t trigger cooldown
21 * - ` defaultConfig `: Default configuration values
23 * @ module ai - checker - base
25 import { execSync , spawn as childSpawn } from 'node:child_process' ;
26 import { existsSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs' ;
High Child Process
Package source references child process execution.
dist/ai-checker-base.js View on unpkg · L24 27 import { tmpdir } from 'node:os' ;
28 import { join } from 'node:path' ;
29 import { EventEmitter } from 'node:events' ;
30 import { getAugmentedPath, ANSI_ESCAPE_PATTERN_SIMPLE } from './utils/index.js' ;
31 import { AI_CHECK_MAX_BACKOFF_MS } from './config/ai-defaults.js' ;
32 import { getErrorMessage } from './types.js' ;
33 // ========== Security Validation ==========
35 * Validates that a model name is safe for shell use.
36 * Model names should only contain alphanumeric characters, hyphens, underscores, and dots.
37 * Exported for the Read My Mind predictor, which reuses these spawn mechanics standalone.
39 export function isValidModelName ( model ) {
40 if ( ! model || typeof model !== 'string' )
42 // Allow: alphanumeric, hyphens, underscores, dots, slashes (for model paths like claude/opus-4.5)
43 // Max length 100 to prevent abuse
44 return / ^ [a-zA-Z0-9._/-] +$ / . test (model) && model. length <= 100 ;
5 import { exec } from 'node:child_process' ;
6 import { promisify } from 'node:util' ;
7 import { getCli } from './config/cli-registry/registry.js' ;
8 const execAsync = promisify (exec);
9 const REMOTE_HOSTS_FILE = 'remote-hosts.json' ;
10 const REMOTE_CASES_FILE = 'remote-cases.json' ;
11 export function remoteHostsPath ( configDir ) {
12 return join (configDir, REMOTE_HOSTS_FILE );
14 export function remoteCasesPath ( configDir ) {
15 return join (configDir, REMOTE_CASES_FILE );
17 async function readJsonArray ( path ) {
19 const raw = await fs. readFile (path, 'utf-8' );
20 const parsed = JSON . parse (raw);
21 return Array. isArray (parsed) ? parsed : [];
27 async function writeJsonArray ( configDir , path , value ) {
,
PTY
streaming) for
27 * up to a minute per request. The computation is additionally single - flight
28 * with a short TTL cache : concurrent requests share one in- flight promise, and
29 * a fresh - enough result is served without spawning git at all.
31 * SECURITY : remote URLs (and git stderr echoing them) can embed
32 * `scheme://user:token@host` credentials, so every `url` / `error` field is
33 * passed through `redactGitCredentials()` (shared with `git-clone.ts` ) before
34 * it reaches a client.
36 * @ module web / repo - status
38 import { execFile } from 'node:child_process' ;
39 import { createRequire } from 'node:module' ;
40 import { promisify } from 'node:util' ;
41 import { EXEC_TIMEOUT_MS } from '../config/exec-timeout.js' ;
42 import { gitNonInteractiveEnv, redactGitCredentials } from '../git-clone.js' ;
43 import { getInstallInfo } from './self-update.js' ;
44 const require = createRequire ( import . meta .url);
45 const { version : APP_VERSION } = require ( '../../package.json' );
Medium Dynamic Require
Package source references dynamic require/import behavior.
dist/web/repo-status.js View on unpkg · L43 46 const execFileAsync = promisify (execFile);
47 /** Network/git timeout for the fetch path (longer than EXEC_TIMEOUT_MS — hits network). */
48 const FETCH_TIMEOUT_MS = 15_000 ;
49 /** Max incoming commit subjects to list per remote. */
50 const MAX_INCOMING = 10 ;
51 /** Fresh-enough window for a cached status — repeated UI polls reuse it instead of re-running git. */
52 const STATUS_CACHE_TTL_MS = 45_000 ;
53 // ─────────────────────────────────────────────────────────────────────────────
54 // PURE helpers (unit tested, no IO)
55 // ─────────────────────────────────────────────────────────────────────────────
57 * Parse `git rev-list --left-right --count HEAD...<ref>` output.
58 * Git prints two tab-separated counts: LEFT (commits in HEAD not in ref → ahead)
59 * and RIGHT (commits in ref not in HEAD → behind). Returns null on malformed input.
61 export function parseAheadBehind ( out ) {
62 const m = out. trim (). match ( / ^ ( \d + ) \s + ( \d + ) $ / );
• matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/web/repo-status.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/web/repo-status.js View on unpkg 10 * Two details are load - bearing and easy to get wrong by hand :
12 * - ** PATH . ** launchd hands a job `/usr/bin:/bin:/usr/sbin:/sbin` and systemd ' s
13 * user manager is nearly as bare , so a Homebrew or nvm `node` , `tmux` or
14 * `claude` is simply not found and sessions fail in a way that reads as a
15 * Codeman bug. The unit therefore carries the PATH of the shell that ran the
16 * install, with the running node 's own directory in front .
17 * - ** The job name. ** It is the one `install.sh` and the self - updater already use
18 * (config / service - names.ts), so re - running install.sh later updates this unit
19 * instead of supervising a second copy of the server.
21 * Secrets are deliberately NOT written here. `CODEMAN_PASSWORD` in the installing
22 * shell is not copied into the unit; the caller is told where to add it instead,
23 * because a unit file is long - lived, world - readable by default , and gets copied
26 * The file writers are pure string builders so they can be unit - tested without
27 * touching launchctl / systemctl.
29 * @ module service - installer
31 import { execFileSync } from 'node:child_process' ;
32 import { existsSync, mkdirSync, unlinkSync, writeFileSync } from 'node:fs' ;
Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/service-installer.js View on unpkg · L26 33 import { homedir, userInfo } from 'node:os' ;
34 import { dirname, join } from 'node:path' ;
35 import { LAUNCHD_LABEL, SYSTEMD_UNIT } from './config/service-names.js' ;
36 import { CODEMAN_INSTANCE } from './config/instance.js' ;
37 import { EXEC_TIMEOUT_MS } from './config/exec-timeout.js' ;
38 import { buildBaseUrl, buildStatusUrl, buildWebArgs, logFilePath, probeServer, } from './daemon-control.js' ;
39 /** Directories worth having on PATH even when the installing shell lacked them. */
40 const FALLBACK_PATH_DIRS = [ '/opt/homebrew/bin' , '/usr/local/bin' , '/usr/bin' , '/bin' , '/usr/sbin' , '/sbin' ];
41 // ─────────────────────────────────────────────────────────────────────────────
43 // ─────────────────────────────────────────────────────────────────────────────
44 /** XML text escaping for plist `<string>` values. */
45 export function xmlEscape ( value ) {
26 Trigger-reachable persistence chain: scripts.start -> dist/index.js -> dist/cli.js -> dist/service-installer.js
L26: * The file writers are pure string builders so they can be unit-tested without
L27: * touching launchctl/systemctl.
L28: *
...
L30: */
L31: import { execFileSync } from 'node:child_process';
L32: import { existsSync, mkdirSync, unlinkSync, writeFileSync } from 'node:fs';
...
L168: export function detectServiceKind() {
L169: if (process.platform === 'darwin')
L170: return 'launchd';
...
L176: return kind === 'launchd'
L177: ? join(homedir(), 'Library', 'LaunchAgents', `${LAUNCHD_LABEL}.plist`)
L178: : join(homedir(), '.config', 'systemd', 'user', SYSTEMD_UNIT);
High Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/service-installer.js View on unpkg · L26 *
@param
dshDir
directory holding the resolved `dsh` binary.
154 * @param authority browser authority to pass as `--trusted-host`.
156 export function startDeepSeekWeb ( dshDir , authority ) {
157 const run = startLock. then (() => startDeepSeekWebLocked (dshDir, authority), () => startDeepSeekWebLocked (dshDir, authority));
158 startLock = run. then (() => undefined , () => undefined );
161 async function startDeepSeekWebLocked ( dshDir , authority ) {
162 // Reuse only when the running server is BOTH healthy and fenced for the
163 // authority now asking. A server trusting the other origin renders a page
164 // whose every API call 403s, which looks like a broken dashboard rather than
165 // a misconfigured one.
167 if (current.authority === authority && ( await answersHttp (current.port))) {
168 return { ok: true , port: current.port, url: `http://127.0.0.1:${ current . port }` , reused: true };
170 await stopDeepSeekWeb ();
172 const port = await findFreePort ();
174 return { ok: false , error: `No free port for the DeepSeek web UI in ${ PORT_BASE }-${ PORT_BASE + PORT_SPAN - 1 }` };
178 child = spawn ( join (dshDir, 'dsh' ), [ 'web' , '--no-open' , '--host' , '127.0.0.1' , '--port' , String (port), '--trusted-host' , authority], {
179 stdio: [ 'ignore' , 'pipe' , 'pipe' ],
180 // Own process group so the whole plugin tree can be signalled at once.
183 });
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/deepseek-web-server.js View on unpkg · L167 186 return { ok: false , error: `Failed to start dsh web: ${ getErrorMessage ( err ) }` };
• matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/deepseek-web-server.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/deepseek-web-server.js View on unpkg dist/web/webview-egress-policy.js
9 * the RESOLVED addresses of a name (`webview-egress.ts`), which is what closes
10 * the rebinding hole a hostname-string check alone leaves open.
12 * What is blocked, and only this: link-local ranges and the fixed cloud-metadata
13 * addresses that live there or beside them. Loopback and RFC1918 are deliberately
14 * ALLOWED: a `localhost` Grafana or a LAN Home Assistant is the documented use
15 * case for web tabs (`docs/web-tabs.md`), and the proxy's reach into the server's
16 * own network is a documented property, not a bug. Nothing a person would
17 * embed as a dashboard lives at 169.254.169.254, while an IAM credential does.
19 import { isIP } from 'node:net' ;
21 * Hostnames that are metadata-service aliases on the clouds that define them.
22 * Belt and braces: each also RESOLVES to a blocked address, which the lookup hook
23 * catches, but naming them here gives the user a clear refusal at save time
24 * instead of a DNS-shaped failure at open time.
26 const BLOCKED_HOSTNAMES = new Set ([
262 try {
L263: execSync(`npx esbuild "${join(xtermDir, 'lib', 'xterm.js')}" --minify --outfile="${join(vendorDir, 'xterm.min.js')}"`, { stdio: 'pipe' });
L264: execSync(`npx esbuild "${join(fitDir, 'lib', 'addon-fit.js')}" --minify --outfile="${join(vendorDir, 'xterm-addon-fit.min.js')}"`, { stdio: 'pipe' });
High Runtime Package Install
Package source invokes a package manager install command at runtime.
scripts/postinstall.js View on unpkg · L262 • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = scripts/postinstall.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/postinstall.js View on unpkg