registry / Install hook abuse / aicodeman / 1.9.1

aicodeman@1.9.1

Mission control for AI coding agents - run 20 autonomous agents with real-time monitoring and session persistence

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The lifecycle side effects are real and unconsented, warranting a warning. Source review found no concrete malicious chain or foreign/broad AI-agent control-surface mutation.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm postinstall

Impact

Creates a background process and modifies a checkout during dependency installation.

Mechanism

rebuilds a dependency, installs a VCS hook, and launches a loopback web server

AI rationale

The lifecycle side effects are real and unconsented, warranting a warning. Source review found no concrete malicious chain or foreign/broad AI-agent control-surface mutation.

Evidence

package.jsonscripts/postinstall.jsdist/web/server.jsdist/web/middleware/auth.jsdist/web/self-update.jsdist/index.js.git/hooks/pre-commit

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json runs postinstall.
scripts/postinstall.js runs npm rebuild node-pty.
scripts/postinstall.js writes .git/hooks/pre-commit in checkouts.
scripts/postinstall.js detaches dist/index.js web automatically.

Evidence against

Autostart binds the documented loopback default.
Server warns that non-loopback exposure requires explicit user configuration.
No install-time credential harvesting or external exfiltration found.
GitHub update check is behind a manual API route.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 221 file(s), 4.37 MB of source, external domains: 127.0.0.1, api.github.com, cdn.jsdelivr.net, claude.ai, developer.mozilla.org, developers.cloudflare.com, docs.claude.com, github.com, nodejs.org, opencode.ai, storage.googleapis.com, www.w3.org

Source & flagged code

12 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/ai-checker-base.jsView file

24*/ L25: import { execSync, spawn as childSpawn } from 'node:child_process'; L26: import { existsSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/ai-checker-base.jsView on unpkg · L24

dist/remote-hosts.jsView file

6import { promisify } from 'node:util'; L7: const execAsync = promisify(exec); L8: const REMOTE_HOSTS_FILE = 'remote-hosts.json';

High

Shell

Package source references shell execution.

dist/remote-hosts.jsView on unpkg · L6

dist/web/self-update.jsView file

23*/ L24: import { spawn, execFileSync } from 'node:child_process'; L25: import { existsSync, readFileSync, writeFileSync, renameSync, copyFileSync, chmodSync } from 'node:fs'; ... L33: const require = createRequire(import.meta.url); L34: const { version: APP_VERSION } = require('../../package.json'); L35: /** systemd unit name (matches install.sh + scripts/codeman-web.service). */ ... L200: return null; L201: return JSON.parse(readFileSync(STATUS_FILE, 'utf-8')); L202: } ... L222: // ───────────────────────────────────────────────────────────────────────────── L223: /** Run a command, returning trimmed stdout, or null on any error. */ L224: function tryExec(cmd, args, cwd, timeout = EXEC_TIMEOUT_MS) {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/web/self-update.jsView on unpkg · L23

scripts/postinstall.jsView file

23Install-time AI-agent control hijack evidence: L23: join(home, '.local/bin/claude'), L24: join(home, '.claude/local/claude'), L25: '/usr/local/bin/claude', ... L259: L260: const { mkdirSync, copyFileSync } = await import('fs'); L261: mkdirSync(vendorDir, { recursive: true }); L262: copyFileSync(join(xtermDir, 'css', 'xterm.css'), join(vendorDir, 'xterm.css')); L263: ... L272: // Fallback: copy unminified L273: copyFileSync(join(xtermDir, 'lib', 'xterm.js'), join(vendorDir, 'xterm.min.js')); L274: copyFileSync(join(fitDir, 'lib', 'addon-fit.js'), join(vendorDir, 'xterm-addon-fit.min.js')); L275: copyFileSync(join(serializeDir, 'lib', 'addon-serialize.js'), join(vendorDir, 'xterm-addon-serialize.min.js')); Payload evidence from dist/web/public/subagent-windows.69b60c35.js: L353: L354: con

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L23

7Cross-file remote execution chain: scripts/postinstall.js spawns dist/web/public/vendor/xterm-addon-webgl.min.js; helper contains network access plus dynamic code execution. L7: L8: import { execSync, spawn } from 'child_process'; L9: import { chmodSync, existsSync } from 'fs'; ... L20: // Claude CLI search paths (must match src/session.ts) L21: const home = homedir(); L22: const CLAUDE_SEARCH_PATHS = [ ... L33: L34: const useColor = process.stdout.isTTY && !process.env.NO_COLOR; L35: ... L83: const ok = await new Promise((resolve) => { L84: const conn = net.createConnection({ port, host: '127.0.0.1' }); L85: conn.once('connect', () => { conn.destroy(); resolve(true); });

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/postinstall.jsView on unpkg · L7

dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasmView file

•path = dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasm kind = wasm_module sizeBytes = 9448638 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/web/public/gesture/wasm/vision_wasm_nosimd_internal.wasmView on unpkg

dist/web/public/upload.html.brView file

•path = dist/web/public/upload.html.br kind = compressed_blob sizeBytes = 1836 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/web/public/upload.html.brView on unpkg

dist/web/public/voice-input.085e9e73.js.brView file

•path = dist/web/public/voice-input.085e9e73.js.br kind = high_entropy_blob sizeBytes = 8139 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/public/voice-input.085e9e73.js.brView on unpkg

dist/web/server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = aicodeman@1.8.0 matchedIdentity = npm:YWljb2RlbWFu:1.8.0 similarity = 0.900 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/web/server.jsView on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/ai-checker-base.jsView file

24*/ L25: import { execSync, spawn as childSpawn } from 'node:child_process'; L26: import { existsSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/ai-checker-base.jsView on unpkg · L24

Findings

2 Critical6 High7 Medium6 Low

CriticalAi Agent Control Hijackscripts/postinstall.js

CriticalPrevious Version Dangerous Deltadist/web/server.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/ai-checker-base.js

HighShelldist/remote-hosts.js

HighCross File Remote Execution Contextscripts/postinstall.js

HighRuntime Package Installscripts/postinstall.js

HighShips High Entropy Blobdist/web/public/voice-input.085e9e73.js.br

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/web/self-update.js

Affected versions and remediation

This report applies to aicodeman@1.9.1.

See all versions of aicodeman for other recorded verdicts.

Review the evidence and your use of aicodeman@1.9.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-29 15:57:37.261Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code