Loading npm security reports…
aicodeman@1.44.0: Credential exfiltration – npm package flagged | LPM Firewall
Flagged — allowed with a warning
Allowed by default policy, but 38 finding(s) warrant review before installing.
aicodeman@1.44.0 Self-hosted mission control for AI coding agents: run Claude Code, Codex, OpenCode, Gemini, DeepSeek, Grok and more 24/7 in tmux, from any device.
scanned 9h ago · by lpm-firewall-ai The voice feature is off by default and normally connects to Anthropic, but an override can direct the saved Claude bearer token to an unrestricted websocket origin. This is a conditional credential exposure risk, not evidence of a hidden default transfer or malicious intent.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
An operator sets CODEMAN_VOICE_STREAM_BASE, enables Claude voice, and an allowed voice websocket request opens.
Impact
The configured recipient receives the existing Claude token, potentially exposing Claude account access. The source does not restrict the override host.
Mechanism
The server reads the saved token and passes it to a relay that attaches it as a bearer authorization header to the websocket connection at the configured origin.
AI rationale
The voice feature is off by default and normally connects to Anthropic, but an override can direct the saved Claude bearer token to an unrestricted websocket origin. This is a conditional credential exposure risk, not evidence of a hidden default transfer or malicious intent.
Evidence
dist/claude-credentials.js dist/web/routes/voice-routes.js dist/web/voice-stream.js dist/config/voice.js dist/web/server.js
public snapshot AI called this Suspicious at 93.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
The credential reader loads the saved Claude OAuth token from the Claude configuration file, with a macOS keychain fallback. Voice dictation is off unless enabled in settings, and incoming voice requests must pass host and origin checks. After those checks, the route passes the saved access token to the relay and connects it. The relay accepts a CODEMAN_VOICE_STREAM_BASE override using either ws or wss; its URL uses that override, while the default is Anthropic’s speech endpoint. The relay attaches the token as a bearer authorization header to the upstream websocket. The feature and destination defaults limit the exposure, but enabling voice does not restrict an overridden recipient. Evidence against
Without a valid override, the relay uses wss://api.anthropic.com. The saved token is not sent unless voice is enabled and an incoming request passes the host and origin checks. Behavioral surface
Source ChildProcess Crypto DynamicRequire EnvironmentVars
30 flagged · loading source • scripts.postinstall = node scripts/postinstall.js
High Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.json View on unpkg • scripts.postinstall = node scripts/postinstall.js
Medium Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.json View on unpkg 24 */
L25: import { execSync, spawn as childSpawn } from 'node:child_process';
L26: import { existsSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
High Child Process
Package source references child process execution.
dist/ai-checker-base.js View on unpkg · L24
1 Critical 22 High 9 Medium 6 Low
Critical Ai Agent Control Hijack scripts/postinstall.js
High Install Time Lifecycle Scripts package.json
High Child Process dist/ai-checker-base.js
High Shell dist/remote-hosts.js
High Same File Env Network Execution dist/deepseek-web-server.js
High Cloud Metadata Access dist/web/webview-egress-policy.js
High Cross File Remote Execution Context scripts/postinstall.js
High Trigger Reachable Persistence dist/service-installer.js
High Runtime Package Install scripts/postinstall.js
High Ships High Entropy Blob dist/web/public/tab-layout-browser.2d6189f7.js.gz
High Semantic Analysis Limited dist/agent-case-marker.js#virtual:normalized:round1
Affected versions and remediation This report applies to aicodeman@1.44.0 .
See all versions of aicodeman for other recorded verdicts.
Review the evidence and your use of aicodeman@1.44.0 before allowing it. Restrict the permissions described in this report. Choose an independently verified alternative or release. This report does not establish that other versions are safe. Evidence last updated: 2026-10-22 18:48:16.536Z (UTC) .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced .
93% Suspicious
AI assessment confidence
Package metadata npm Author arkon
Maintainers ark0n
Version 1.44.0
Published Oct 22, 2026
License MIT
Dependencies 26
Integrity verified
Package size 19.0 MB
Files 1,482
Keywords claude-code claude-ai claude anthropic opencode codex antigravity pi
Eval
Filesystem
Network
Shell
WebSocket
Supply chain HighEntropyStrings Minified PossibleObfuscation Telemetry UrlStrings
Manifest No manifest risk signals triggered.
scanned 380 file(s), 8.97 MB of source, external domains: 127.0.0.1, antigravity.google, api.github.com, cdn.jsdelivr.net, claude.ai, developer.mozilla.org, developers.cloudflare.com, developers.openai.com, docs.claude.com, github.com, nodejs.org, ntfy.sh, omp.sh, opencode.ai, pi.dev, purl.org, schemas.microsoft.com, schemas.openxmlformats.org, storage.googleapis.com, stuk.github.io, www.apple.com, www.w3.org, x.ai
7 import { getCli } from './config/cli-registry/registry.js';
L8: const execAsync = promisify(exec);
L9: const REMOTE_HOSTS_FILE = 'remote-hosts.json';
dist/web/public/vendor/exceljs.min.js View file 21 https://github.[redacted]
L22: */!function(e){"object"==typeof r&&void 0!==t?t.exports=e():("undefined"!=typeof window?window:void 0!==i?i:"undefined"!=typeof self?self:this).JSZip=e()}((function(){return functi...
L23: /*! safe-buffer. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */var n=e("buffer"),i=n.Buffer;function s(e,t){for(var r in e)t[r]=e[r]}function o(e,t,r){return i...
Low Eval
Package source references a known benign dynamic code generation pattern.
dist/web/public/vendor/exceljs.min.js View on unpkg · L21 • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/web/repo-status.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/web/repo-status.js View on unpkg 43 import { getInstallInfo } from './self-update.js';
L44: const require = createRequire(import.meta.url);
L45: const { version: APP_VERSION } = require('../../package.json');
Medium Dynamic Require
Package source references dynamic require/import behavior.
dist/web/repo-status.js View on unpkg · L43 26 Trigger-reachable persistence chain: scripts.start -> dist/index.js -> dist/cli.js -> dist/service-installer.js
L26: * The file writers are pure string builders so they can be unit-tested without
L27: * touching launchctl/systemctl.
L28: *
...
L30: */
L31: import { execFileSync } from 'node:child_process';
L32: import { existsSync, mkdirSync, unlinkSync, writeFileSync } from 'node:fs';
...
L168: export function detectServiceKind() {
L169: if (process.platform === 'darwin')
L170: return 'launchd';
...
L176: return kind === 'launchd'
L177: ? join(homedir(), 'Library', 'LaunchAgents', `${LAUNCHD_LABEL}.plist`)
L178: : join(homedir(), '.config', 'systemd', 'user', SYSTEMD_UNIT);
High Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/service-installer.js View on unpkg · L26 26 * The file writers are pure string builders so they can be unit-tested without
L27: * touching launchctl/systemctl.
L28: *
...
L30: */
L31: import { execFileSync } from 'node:child_process';
L32: import { existsSync, mkdirSync, unlinkSync, writeFileSync } from 'node:fs';
...
L168: export function detectServiceKind() {
L169: if (process.platform === 'darwin')
L170: return 'launchd';
...
L176: return kind === 'launchd'
L177: ? join(homedir(), 'Library', 'LaunchAgents', `${LAUNCHD_LABEL}.plist`)
L178: : join(homedir(), '.config', 'systemd', 'user', SYSTEMD_UNIT);
Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/service-installer.js View on unpkg · L26 167 if (current.authority === authority && (await answersHttp(current.port))) {
L168: return { ok: true, port: current.port, url: `http://127.0.0.1:${current.port}`, reused: true };
L169: }
...
L177: try {
L178: child = spawn(join(dshDir, 'dsh'), ['web', '--no-open', '--host', '127.0.0.1', '--port', String(port), '--trusted-host', authority], {
L179: stdio: ['ignore', 'pipe', 'pipe'],
...
L181: detached: true,
L182: env: process.env,
L183: });
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/deepseek-web-server.js View on unpkg · L167 • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/deepseek-web-server.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/deepseek-web-server.js View on unpkg 6 * at different stages: the Zod schema (a URL being saved), the sync check on a
L7: * hostname that is already an IP literal (Node's `net.connect` skips DNS for
L8: * those, so a lookup hook never sees them), and the DNS lookup hook that judges
...
L123: * connect to. Non-IP input is never blocked here: names are judged by
L124: * `isBlockedWebviewHostname()` at save time and by their resolved addresses at
L125: * connect time.
High Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
dist/web/webview-egress-policy.js View on unpkg · L6 23 join(home, '.local/bin/claude'),
L24: join(home, '.claude/local/claude'),
L25: '/usr/local/bin/claude',
...
L256:
L257: const { mkdirSync, copyFileSync } = await import('fs');
L258: mkdirSync(vendorDir, { recursive: true });
L259: copyFileSync(join(xtermDir, 'css', 'xterm.css'), join(vendorDir, 'xterm.css'));
L260:
...
L269: // Fallback: copy unminified
L270: copyFileSync(join(xtermDir, 'lib', 'xterm.js'), join(vendorDir, 'xterm.min.js'));
L271: copyFileSync(join(fitDir, 'lib', 'addon-fit.js'), join(vendorDir, 'xterm-addon-fit.min.js'));
L272: copyFileSync(join(serializeDir, 'lib', 'addon-serialize.js'), join(vendorDir, 'xterm-addon-serialize.min.js'));
Critical Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/postinstall.js View on unpkg · L23 7 Cross-file remote execution chain: scripts/postinstall.js spawns dist/web/public/vendor/xterm-addon-webgl.min.js; helper contains network access plus dynamic code execution.
L7:
L8: import { execSync, spawn } from 'child_process';
L9: import { existsSync } from 'fs';
...
L20: // Claude CLI search paths (must match src/session.ts)
L21: const home = homedir();
L22: const CLAUDE_SEARCH_PATHS = [
...
L33:
L34: const useColor = process.stdout.isTTY && !process.env.NO_COLOR;
L35:
...
L83: const ok = await new Promise((resolve) => {
L84: const conn = net.createConnection({ port, host: '127.0.0.1' });
L85: conn.once('connect', () => { conn.destroy(); resolve(true); });
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
scripts/postinstall.js View on unpkg · L7 262 try {
L263: execSync(`npx esbuild "${join(xtermDir, 'lib', 'xterm.js')}" --minify --outfile="${join(vendorDir, 'xterm.min.js')}"`, { stdio: 'pipe' });
L264: execSync(`npx esbuild "${join(fitDir, 'lib', 'addon-fit.js')}" --minify --outfile="${join(vendorDir, 'xterm-addon-fit.min.js')}"`, { stdio: 'pipe' });
High Runtime Package Install
Package source invokes a package manager install command at runtime.
scripts/postinstall.js View on unpkg · L262 dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasm View file • path = dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasm
kind = wasm_module
sizeBytes = 9448638
magicHex = [redacted]
Medium Ships Wasm Module
Package ships WebAssembly modules.
dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasm View on unpkg • path = skills/codeman/preamble.sh
kind = build_helper
sizeBytes = 22265
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
skills/codeman/preamble.sh View on unpkg dist/web/public/tab-layout-browser.2d6189f7.js.gz View file • path = dist/web/public/tab-layout-browser.2d6189f7.js.gz
kind = high_entropy_blob
sizeBytes = 5251
magicHex = [redacted]
High Ships High Entropy Blob
Package ships high-entropy non-source blobs.
dist/web/public/tab-layout-browser.2d6189f7.js.gz View on unpkg • path = dist/web/public/tab-layout-browser.2d6189f7.js.gz
kind = compressed_blob
sizeBytes = 5251
magicHex = [redacted]
Medium Ships Compressed Blob
Package ships compressed or archive-like blobs.
dist/web/public/tab-layout-browser.2d6189f7.js.gz View on unpkg dist/agent-case-marker.js#virtual:normalized:round1 View file • stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 16
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/agent-case-marker.js#virtual:normalized:round1 View on unpkg • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = scripts/fix-node-pty.mjs
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/fix-node-pty.mjs View on unpkg • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/claude-credentials.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/claude-credentials.js View on unpkg • matchType = token_shingles
matchedPackage = aicodeman@1.24.6
matchedPath = dist/daemon-control.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
shingleOverlap = 48
summary = source token shingles overlapped finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/daemon-control.js View on unpkg • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/tunnel-manager.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/tunnel-manager.js View on unpkg • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/utils/codex-cli-resolver.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/utils/codex-cli-resolver.js View on unpkg • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/utils/grok-cli-resolver.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/utils/grok-cli-resolver.js View on unpkg • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/utils/omp-cli-resolver.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/utils/omp-cli-resolver.js View on unpkg • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/utils/claude-cli-resolver.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/utils/claude-cli-resolver.js View on unpkg • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/utils/cli-resolver.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/utils/cli-resolver.js View on unpkg • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/utils/pi-cli-resolver.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/utils/pi-cli-resolver.js View on unpkg High Known Malware Source Similarity scripts/fix-node-pty.mjs
High Known Malware Source Similarity dist/claude-credentials.js
High Known Malware Source Similarity dist/daemon-control.js
High Known Malware Source Similarity dist/web/repo-status.js
High Known Malware Source Similarity dist/deepseek-web-server.js
High Known Malware Source Similarity dist/tunnel-manager.js
High Known Malware Source Similarity dist/utils/codex-cli-resolver.js
High Known Malware Source Similarity dist/utils/grok-cli-resolver.js
High Known Malware Source Similarity dist/utils/omp-cli-resolver.js
High Known Malware Source Similarity dist/utils/claude-cli-resolver.js
High Known Malware Source Similarity dist/utils/cli-resolver.js
High Known Malware Source Similarity dist/utils/pi-cli-resolver.js
Medium Ambiguous Install Lifecycle Script package.json
Medium Dynamic Require dist/web/repo-status.js
Medium Install Persistence dist/service-installer.js
Medium Ships Wasm Module dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasm
Medium Ships Build Helper skills/codeman/preamble.sh
Medium Ships Compressed Blob dist/web/public/tab-layout-browser.2d6189f7.js.gz
Medium Structural Risk Force Deep Review
Low Eval dist/web/public/vendor/exceljs.min.js
Runtime surface package.json
Entrypoints main → dist/index.js types → dist/index.d.ts bin → aicodeman, codeman
Runtime node >=22.0.0
Artifact 44.6 MB · 1,482 files 2 signature(s)
Install lifecycle postinstall
Behavioral surface ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem Network Shell WebSocket HighEntropyStrings Minified PossibleObfuscation Telemetry UrlStrings Manifest: clean
30 flagged • scripts.postinstall = node scripts/postinstall.js
High Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.json View on unpkg • scripts.postinstall = node scripts/postinstall.js
Medium Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.json View on unpkg 24 */
L25: import { execSync, spawn as childSpawn } from 'node:child_process';
L26: import { existsSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
High Child Process
Package source references child process execution.
dist/ai-checker-base.js View on unpkg · L24 7 import { getCli } from './config/cli-registry/registry.js';
L8: const execAsync = promisify(exec);
L9: const REMOTE_HOSTS_FILE = 'remote-hosts.json';
dist/web/public/vendor/exceljs.min.js View file 21 https://github.[redacted]
L22: */!function(e){"object"==typeof r&&void 0!==t?t.exports=e():("undefined"!=typeof window?window:void 0!==i?i:"undefined"!=typeof self?self:this).JSZip=e()}((function(){return functi...
L23: /*! safe-buffer. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */var n=e("buffer"),i=n.Buffer;function s(e,t){for(var r in e)t[r]=e[r]}function o(e,t,r){return i...
Low Eval
Package source references a known benign dynamic code generation pattern.
dist/web/public/vendor/exceljs.min.js View on unpkg · L21 • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/web/repo-status.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/web/repo-status.js View on unpkg 43 import { getInstallInfo } from './self-update.js';
L44: const require = createRequire(import.meta.url);
L45: const { version: APP_VERSION } = require('../../package.json');
Medium Dynamic Require
Package source references dynamic require/import behavior.
dist/web/repo-status.js View on unpkg · L43 26 Trigger-reachable persistence chain: scripts.start -> dist/index.js -> dist/cli.js -> dist/service-installer.js
L26: * The file writers are pure string builders so they can be unit-tested without
L27: * touching launchctl/systemctl.
L28: *
...
L30: */
L31: import { execFileSync } from 'node:child_process';
L32: import { existsSync, mkdirSync, unlinkSync, writeFileSync } from 'node:fs';
...
L168: export function detectServiceKind() {
L169: if (process.platform === 'darwin')
L170: return 'launchd';
...
L176: return kind === 'launchd'
L177: ? join(homedir(), 'Library', 'LaunchAgents', `${LAUNCHD_LABEL}.plist`)
L178: : join(homedir(), '.config', 'systemd', 'user', SYSTEMD_UNIT);
High Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/service-installer.js View on unpkg · L26 26 * The file writers are pure string builders so they can be unit-tested without
L27: * touching launchctl/systemctl.
L28: *
...
L30: */
L31: import { execFileSync } from 'node:child_process';
L32: import { existsSync, mkdirSync, unlinkSync, writeFileSync } from 'node:fs';
...
L168: export function detectServiceKind() {
L169: if (process.platform === 'darwin')
L170: return 'launchd';
...
L176: return kind === 'launchd'
L177: ? join(homedir(), 'Library', 'LaunchAgents', `${LAUNCHD_LABEL}.plist`)
L178: : join(homedir(), '.config', 'systemd', 'user', SYSTEMD_UNIT);
Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/service-installer.js View on unpkg · L26 167 if (current.authority === authority && (await answersHttp(current.port))) {
L168: return { ok: true, port: current.port, url: `http://127.0.0.1:${current.port}`, reused: true };
L169: }
...
L177: try {
L178: child = spawn(join(dshDir, 'dsh'), ['web', '--no-open', '--host', '127.0.0.1', '--port', String(port), '--trusted-host', authority], {
L179: stdio: ['ignore', 'pipe', 'pipe'],
...
L181: detached: true,
L182: env: process.env,
L183: });
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/deepseek-web-server.js View on unpkg · L167 • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/deepseek-web-server.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/deepseek-web-server.js View on unpkg 6 * at different stages: the Zod schema (a URL being saved), the sync check on a
L7: * hostname that is already an IP literal (Node's `net.connect` skips DNS for
L8: * those, so a lookup hook never sees them), and the DNS lookup hook that judges
...
L123: * connect to. Non-IP input is never blocked here: names are judged by
L124: * `isBlockedWebviewHostname()` at save time and by their resolved addresses at
L125: * connect time.
High Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
dist/web/webview-egress-policy.js View on unpkg · L6 23 join(home, '.local/bin/claude'),
L24: join(home, '.claude/local/claude'),
L25: '/usr/local/bin/claude',
...
L256:
L257: const { mkdirSync, copyFileSync } = await import('fs');
L258: mkdirSync(vendorDir, { recursive: true });
L259: copyFileSync(join(xtermDir, 'css', 'xterm.css'), join(vendorDir, 'xterm.css'));
L260:
...
L269: // Fallback: copy unminified
L270: copyFileSync(join(xtermDir, 'lib', 'xterm.js'), join(vendorDir, 'xterm.min.js'));
L271: copyFileSync(join(fitDir, 'lib', 'addon-fit.js'), join(vendorDir, 'xterm-addon-fit.min.js'));
L272: copyFileSync(join(serializeDir, 'lib', 'addon-serialize.js'), join(vendorDir, 'xterm-addon-serialize.min.js'));
Critical Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/postinstall.js View on unpkg · L23 7 Cross-file remote execution chain: scripts/postinstall.js spawns dist/web/public/vendor/xterm-addon-webgl.min.js; helper contains network access plus dynamic code execution.
L7:
L8: import { execSync, spawn } from 'child_process';
L9: import { existsSync } from 'fs';
...
L20: // Claude CLI search paths (must match src/session.ts)
L21: const home = homedir();
L22: const CLAUDE_SEARCH_PATHS = [
...
L33:
L34: const useColor = process.stdout.isTTY && !process.env.NO_COLOR;
L35:
...
L83: const ok = await new Promise((resolve) => {
L84: const conn = net.createConnection({ port, host: '127.0.0.1' });
L85: conn.once('connect', () => { conn.destroy(); resolve(true); });
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
scripts/postinstall.js View on unpkg · L7
dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasm View file • path = dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasm
kind = wasm_module
sizeBytes = 9448638
magicHex = [redacted]
Medium Ships Wasm Module
Package ships WebAssembly modules.
dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasm View on unpkg • path = skills/codeman/preamble.sh
kind = build_helper
sizeBytes = 22265
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
skills/codeman/preamble.sh View on unpkg dist/web/public/tab-layout-browser.2d6189f7.js.gz View file • path = dist/web/public/tab-layout-browser.2d6189f7.js.gz
kind = high_entropy_blob
sizeBytes = 5251
magicHex = [redacted]
High Ships High Entropy Blob
Package ships high-entropy non-source blobs.
dist/web/public/tab-layout-browser.2d6189f7.js.gz View on unpkg • path = dist/web/public/tab-layout-browser.2d6189f7.js.gz
kind = compressed_blob
sizeBytes = 5251
magicHex = [redacted]
Medium Ships Compressed Blob
Package ships compressed or archive-like blobs.
dist/web/public/tab-layout-browser.2d6189f7.js.gz View on unpkg dist/agent-case-marker.js#virtual:normalized:round1 View file • stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 16
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/agent-case-marker.js#virtual:normalized:round1 View on unpkg • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = scripts/fix-node-pty.mjs
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/fix-node-pty.mjs View on unpkg • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/claude-credentials.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/claude-credentials.js View on unpkg • matchType = token_shingles
matchedPackage = aicodeman@1.24.6
matchedPath = dist/daemon-control.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
shingleOverlap = 48
summary = source token shingles overlapped finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/daemon-control.js View on unpkg • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/tunnel-manager.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/tunnel-manager.js View on unpkg • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/utils/codex-cli-resolver.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/utils/codex-cli-resolver.js View on unpkg • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/utils/grok-cli-resolver.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/utils/grok-cli-resolver.js View on unpkg • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/utils/omp-cli-resolver.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/utils/omp-cli-resolver.js View on unpkg • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/utils/claude-cli-resolver.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/utils/claude-cli-resolver.js View on unpkg • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/utils/cli-resolver.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/utils/cli-resolver.js View on unpkg • matchType = normalized_sha256
matchedPackage = aicodeman@1.24.6
matchedPath = dist/utils/pi-cli-resolver.js
matchedIdentity = npm:YWljb2RlbWFu:1.24.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/utils/pi-cli-resolver.js View on unpkg 262 try {
L263: execSync(`npx esbuild "${join(xtermDir, 'lib', 'xterm.js')}" --minify --outfile="${join(vendorDir, 'xterm.min.js')}"`, { stdio: 'pipe' });
L264: execSync(`npx esbuild "${join(fitDir, 'lib', 'addon-fit.js')}" --minify --outfile="${join(vendorDir, 'xterm-addon-fit.min.js')}"`, { stdio: 'pipe' });
High Runtime Package Install
Package source invokes a package manager install command at runtime.
scripts/postinstall.js View on unpkg · L262