aicodeman@1.41.1

⚠ Under review

Self-hosted mission control for AI coding agents: run Claude Code, Codex, OpenCode, Gemini, DeepSeek, Grok and more 24/7 in tmux, from any device.

AI Security Review

scanned 9d ago · by lpm-firewall-ai

Inspected source does not establish a concrete attack, but the required compressed browser asset remains unresolved. Manual review is therefore appropriate; the available evidence does not support blocking publication.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

The unresolved artifact is included with the package; the inspected postinstall behavior is triggered by npm installation.

Impact

The available source does not establish malicious impact; the unresolved asset prevents a clean determination.

Mechanism

The inspected postinstall can start the package’s web server in the background. The unresolved asset’s behavior could not be determined.

AI rationale

Evidence

dist/web/public/i18n.9afd8e4d.js.br

Decision evidence

public snapshot

AI called this Manual Review at 70.0% confidence as Unknown with medium false-positive risk.

AI review observations

The manifest runs scripts/postinstall.js during installation.
The postinstall code can start this package’s web server as a detached process, unless CI or an opt-out variable is set.
The attachment command reads Codeman credentials and sends them to the API URL selected for that command when a session ID is supplied.
The required compressed browser asset could not be assessed as UTF-8 source, so a clean verdict is not supported.

Evidence against

The attachment request is tied to an explicit CLI command and uses the supplied API URL, environment setting, or loopback default.
The inspected source does not establish an unrelated credential recipient or a confirmed malicious agent-configuration change.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStrings

Source & flagged code

30 flagged

package.jsonView file

Lines 1-34json

2 "name": "aicodeman",

3 "version": "1.41.1",

4 "description": "Self-hosted mission control for AI coding agents: run Claude Code, Codex, OpenCode, Gemini, DeepSeek, Grok and more 24/7 in tmux, from any device.",

5 "mcpName": "io.github.Ark0N/codeman",

6 "type": "module",

7 "main": "dist/index.js",

8 "types": "dist/index.d.ts",

9 "bin": {

10 "aicodeman": "./dist/index.js",

11 "codeman": "./dist/index.js"

12 },

13 "scripts": {

14 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L14

15 "build": "node scripts/build.mjs",

16 "build:gesture": "node scripts/build-gesture-bundle.mjs",

17 "generate:cli-catalog": "tsx scripts/generate-cli-catalog.mts",

18 "start": "NODE_COMPILE_CACHE=${HOME}/.codeman/compile-cache node dist/index.js",

19 "dev": "tsx src/index.ts web",

20 "web": "node dist/index.js web",

21 "clean": "rm -rf dist",

22 "test": "vitest run --config config/vitest.ci.config.ts",

23 "test:watch": "vitest --config config/vitest.ci.config.ts",

24 "test:coverage": "vitest run --config config/vitest.ci.config.ts --coverage",

25 "test:ci": "vitest run --config config/vitest.ci.config.ts",

26 "test:browser": "vitest run --config config/vitest.browser.config.ts",

27 "test:perf": "vitest run --config config/vitest.perf.config.ts",

28 "test:all": "vitest run --config config/vitest.config.ts",

29 "pretest:mobile": "node scripts/prepare-test-vendor.mjs",

30 "test:mobile": "vitest run --config test/mobile/vitest.config.ts",

31 "check:frontend-syntax": "node scripts/check-frontend-syntax.mjs",

32 "check:browser-excludes": "node scripts/check-browser-test-excludes.mjs",

33 "fix:node-pty": "node scripts/fix-node-pty.mjs",

34 "typecheck": "tsc --noEmit && tsc -p config/tsconfig.scripts.json",

dist/ai-checker-base.jsView file

Lines 4-44javascript

4 * Provides shared functionality for AI-powered checkers that spawn fresh Claude CLI

5 * sessions to analyze terminal output. This base class handles:

6 * - Mux session spawning and cleanup

dist/remote-hosts.jsView file

Lines 1-27javascript

1import { existsSync, mkdirSync } from 'node:fs';

2import fs from 'node:fs/promises';

3import { join } from 'node:path';

4import { homedir } from 'node:os';

dist/web/public/vendor/exceljs.min.jsView file

21https://github.[redacted] L22: */!function(e){"object"==typeof r&&void 0!==t?t.exports=e():("undefined"!=typeof window?window:void 0!==i?i:"undefined"!=typeof self?self:this).JSZip=e()}((function(){return functi... L23: /*! safe-buffer. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */var n=e("buffer"),i=n.Buffer;function s(e,t){for(var r in e)t[r]=e[r]}function o(e,t,r){return i...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/web/public/vendor/exceljs.min.jsView on unpkg · L21

dist/web/repo-status.jsView file

Lines 23-63javascript

23 *

24 * PERFORMANCE: every git invocation is ASYNC (`execFile`), never `execFileSync`

25 * — the fetch path can spend `2 × FETCH_TIMEOUT_MS` per remote on the network,

26 * and a synchronous version froze the whole event loop (SSE

dist/service-installer.jsView file

Lines 6-46javascript

6 * now" half in daemon-control.ts. `install.sh` already does this for people who

7 * install with the one-liner; this exists for `npm i -g aicodeman` users, who

8 * otherwise have to hand-write a plist.

9 *

dist/deepseek-web-server.jsView file

Lines 147-187javascript

147 * prevent. The second caller now simply waits and reuses the first's server.

148 */

149let startLock = Promise.resolve();

150/**

151 * Start (or reuse) the background `dsh web` for `authority`.

152 *

153

dist/web/webview-egress-policy.jsView file

6* at different stages: the Zod schema (a URL being saved), the sync check on a L7: * hostname that is already an IP literal (Node's `net.connect` skips DNS for L8: * those, so a lookup hook never sees them), and the DNS lookup hook that judges ... L123: * connect to. Non-IP input is never blocked here: names are judged by L124: * `isBlockedWebviewHostname()` at save time and by their resolved addresses at L125: * connect time.

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/web/webview-egress-policy.jsView on unpkg · L6

scripts/postinstall.jsView file

23join(home, '.local/bin/claude'), L24: join(home, '.claude/local/claude'), L25: '/usr/local/bin/claude', ... L256: L257: const { mkdirSync, copyFileSync } = await import('fs'); L258: mkdirSync(vendorDir, { recursive: true }); L259: copyFileSync(join(xtermDir, 'css', 'xterm.css'), join(vendorDir, 'xterm.css')); L260: ... L269: // Fallback: copy unminified L270: copyFileSync(join(xtermDir, 'lib', 'xterm.js'), join(vendorDir, 'xterm.min.js')); L271: copyFileSync(join(fitDir, 'lib', 'addon-fit.js'), join(vendorDir, 'xterm-addon-fit.min.js')); L272: copyFileSync(join(serializeDir, 'lib', 'addon-serialize.js'), join(vendorDir, 'xterm-addon-serialize.min.js'));

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L23

7Cross-file remote execution chain: scripts/postinstall.js spawns dist/web/public/vendor/xterm-addon-webgl.min.js; helper contains network access plus dynamic code execution. L7: L8: import { execSync, spawn } from 'child_process'; L9: import { existsSync } from 'fs'; ... L20: // Claude CLI search paths (must match src/session.ts) L21: const home = homedir(); L22: const CLAUDE_SEARCH_PATHS = [ ... L33: L34: const useColor = process.stdout.isTTY && !process.env.NO_COLOR; L35: ... L83: const ok = await new Promise((resolve) => { L84: const conn = net.createConnection({ port, host: '127.0.0.1' }); L85: conn.once('connect', () => { conn.destroy(); resolve(true); });

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/postinstall.jsView on unpkg · L7

dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasmView file

•path = dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasm kind = wasm_module sizeBytes = 9448638 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasmView on unpkg

skills/codeman/preamble.shView file

•path = skills/codeman/preamble.sh kind = build_helper sizeBytes = 21244 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/codeman/preamble.shView on unpkg

dist/web/public/i18n.9afd8e4d.js.brView file

•path = dist/web/public/i18n.9afd8e4d.js.br kind = high_entropy_blob sizeBytes = 27657 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/public/i18n.9afd8e4d.js.brView on unpkg

•path = dist/web/public/i18n.9afd8e4d.js.br kind = compressed_blob sizeBytes = 27657 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/web/public/i18n.9afd8e4d.js.brView on unpkg

dist/agent-case-marker.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 14

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agent-case-marker.js#virtual:normalized:round1View on unpkg

dist/web/routes/system-routes.jsView file

•matchType = token_shingles matchedPackage = aicodeman@1.24.6 matchedPath = dist/web/routes/system-routes.js matchedIdentity = npm:YWljb2RlbWFu:1.24.6 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High