registry / aicodeman / 1.6.1

aicodeman@1.6.1

⚠ Under review

Mission control for AI coding agents - run 20 autonomous agents with real-time monitoring and session persistence

Static Scan Results

scanned 15h ago · by rust-scanner

Static analysis flagged 21 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 213 file(s), 4.20 MB of source, external domains: 127.0.0.1, api.github.com, cdn.jsdelivr.net, claude.ai, developer.mozilla.org, developers.cloudflare.com, docs.claude.com, github.com, nodejs.org, opencode.ai, storage.googleapis.com, www.w3.org

Source & flagged code

12 flagged

package.jsonView file

Lines 1-33json

2 "name": "aicodeman",

3 "version": "1.6.1",

4 "description": "Mission control for AI coding agents - run 20 autonomous agents with real-time monitoring and session persistence",

5 "type": "module",

6 "main": "dist/index.js",

7 "types": "dist/index.d.ts",

8 "bin": {

9 "aicodeman": "./dist/index.js",

10 "codeman": "./dist/index.js"

11 },

12 "scripts": {

13 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L13

14 "build": "node scripts/build.mjs",

15 "build:gesture": "node scripts/build-gesture-bundle.mjs",

16 "start": "NODE_COMPILE_CACHE=${HOME}/.codeman/compile-cache node dist/index.js",

17 "dev": "tsx src/index.ts web",

18 "web": "node dist/index.js web",

19 "clean": "rm -rf dist",

20 "test": "vitest run --config config/vitest.config.ts",

21 "test:watch": "vitest --config config/vitest.config.ts",

22 "test:coverage": "vitest run --config config/vitest.config.ts --coverage",

23 "test:ci": "vitest run --config config/vitest.ci.config.ts",

24 "check:frontend-syntax": "node scripts/check-frontend-syntax.mjs",

25 "typecheck": "tsc --noEmit",

26 "lint": "eslint --config config/eslint.config.js 'src/**/*.ts'",

27 "lint:fix": "eslint --config config/eslint.config.js 'src/**/*.ts' --fix",

28 "format": "prettier --write 'src/**/*.ts' 'src/web/public/**/*.{js,css,html,json}'",

29 "format:check": "prettier --check 'src/**/*.ts' 'src/web/public/**/*.{js,css,html,json}'",

30 "check:public-assets": "node scripts/check-public-assets.mjs",

31 "capture:subagents": "node scripts/capture-subagent-screenshots.mjs",

32 "changeset": "changeset",

33 "version-packages": "changeset version && npm install --package-lock-only && node scripts/check-lockfile-sync.mjs",

dist/ai-checker-base.jsView file

Lines 4-44javascript

4 * Provides shared functionality for AI-powered checkers that spawn fresh Claude CLI

5 * sessions to analyze terminal output. This base class handles:

6 * - Mux session spawning and cleanup

dist/remote-hosts.jsView file

Lines 1-26javascript

1import { existsSync, mkdirSync } from 'node:fs';

2import fs from 'node:fs/promises';

3import { join } from 'node:path';

4import { homedir } from 'node:os';

dist/web/self-update.jsView file

Lines 3-43javascript

3 *

4 * Powers App Settings → Updates. Codeman is installed as a git clone and run

5 * under systemd (Linux) or launchd (macOS); updating means `git checkout <release

scripts/postinstall.jsView file

Lines 1-43javascript

1#!/usr/bin/env node

3/**

4 * Codeman postinstall verification script

5 * Runs after `npm install` to check environment readiness

6 */

8import { execSync, spawn } from 'child_process';

9import { chmodSync, existsSync } from

dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasmView file

•path = dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasm kind = wasm_module sizeBytes = 9448638 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasmView on unpkg

dist/web/public/upload.html.brView file

•path = dist/web/public/upload.html.br kind = compressed_blob sizeBytes = 1836 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/web/public/upload.html.brView on unpkg

dist/web/public/voice-input.085e9e73.js.brView file

•path = dist/web/public/voice-input.085e9e73.js.br kind = high_entropy_blob sizeBytes = 8139 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/public/voice-input.085e9e73.js.brView on unpkg

dist/web/server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = aicodeman@1.4.0 matchedIdentity = npm:YWljb2RlbWFu:1.4.0 similarity = 0.733 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/web/server.jsView on unpkg

Source & flagged code

12 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code