Loading npm security reports…

codeam-cli@2.75.46: Scan Failed npm security report (Allow) | LPM Firewall

registry / codeam-cli / 2.75.46

codeam-cli@2.75.46

⚠ Under review

Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis completed at 0.0% confidence. No malicious behavior was detected; 26 low-signal pattern(s) were surfaced and cleared.

Static reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

WildcardDependency

scanned 15 file(s), 1.90 MB of source, external domains: 127.0.0.1, api.codeagent-mobile.com, api.github.com, api.kimi.com, astral.sh, auth.kimi.com, brew.sh, claude.ai, cli.coderabbit.ai, cli.github.com, code.kimi.com, codeagent-mobile.com, cursor.com, dev-api.codeagent-mobile.com, dev-stream.codeagent-mobile.com, dev.azure.com, dev.codeagent-mobile.com, discord.gg, docs.gitlab.com, docs.railway.app, eu-assets.i.posthog.com, eu.i.posthog.com, github.com, gitlab.com, gitpod.io, mcp.posthog.com, mcp.vercel.com, opencode.ai, posthog.com, raw.githubusercontent.com, registry.npmjs.org, resend.com, sentry.io, status.anthropic.com, status.cloud.google.com, status.codeagent-mobile.com, status.cursor.com, status.openai.com, stitch.googleapis.com, stream.codeagent-mobile.com, trello.com, us-assets.i.posthog.com, us.i.posthog.com, www.codeagent-mobile.com, www.githubstatus.com, yandex.com, your-workspace.app.n8n.cloud

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

92// src/integrations/stdio-proxy.ts L93: var import_node_child_process31, import_node_readline3, RESTART_CHECK_INTERVAL_MS, SIGKILL_ESCALATION_MS, TOOL_CALL_TIMEOUT_MS, REPLAY_INIT_ID, RestartableStdioProxy; L94: var init_stdio_proxy = __esm({

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L92

8690var STARTUP_EXEC_ARGV = [ L8691: ...globalThis.process?.execArgv ?? [] L8692: ];

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L8690

10688process.stderr.write( L10689: "\n codeam-cli sends anonymous + identified usage events to PostHog\n (same project as the mobile + web apps). Opt out at any time:\n export CODEAM_TELEMETRY=0\n See https://... L10690: ); ... L10694: function vercelBypassHeader() { L10695: const token = process.env.CODEAM_VERCEL_BYPASS; L10696: return token ? { "x-vercel-protection-bypass": token } : {}; ... L10699: // src/lib/git-branch.ts L10700: var import_child_process = require("child_process"); L10701: function detectCurrentBranch(cwd = process.cwd()) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L10688

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: var import_node_child_process31, import_node_readline3, RESTART_CHECK_INTERVAL_MS, SIGKILL_ESCALATION_MS, TOOL_CALL_TIMEOUT_MS, REPLAY_INIT_ID, RestartableStdioProxy; import_node_readline3 = __toESM(require("readline")); const rl = import_node_readline3.default.createInterface({ input: stdin, crlfDelay: Infinity }); const rl = import_node_readline3.default.createInterface({ input: child.stdout, crlfDelay: Infinity }); async function adminQuery(baseUrl, key, api, body, fetchImpl = fetch) { const res = await fetchImpl(`${baseUrl}/api/${api}`, { headers: { Authorization: `Convex ${key}`, "Content-Type": "application/json" }

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

1970// Verified 2026-09-03 over MCP with a dummy key (`tools/list` → 162, no L1971: // licence gate, no paywall on stderr) and supply-chain audited from the L1972: // tarball: the only network hosts are api.clickup.com / L1973: // developer.clickup.com, no child_process/eval, deps = MCP SDK, axios, L1974: // zod, dotenv, form-data. Young package (2 releases, one author) — the L1975: // pin is EXACT and the licence audit watches every bump.

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1970

92// src/integrations/stdio-proxy.ts L93: var import_node_child_process31, import_node_readline3, RESTART_CHECK_INTERVAL_MS, SIGKILL_ESCALATION_MS, TOOL_CALL_TIMEOUT_MS, REPLAY_INIT_ID, RestartableStdioProxy; L94: var init_stdio_proxy = __esm({ ... L101: TOOL_CALL_TIMEOUT_MS = (() => { L102: const raw = Number(process.env.CODEAM_MCP_TOOL_TIMEOUT_MS); L103: return Number.isFinite(raw) && raw > 0 ? raw : 12e4; ... L116: toolTimers = /* @__PURE__ */ new Map(); L117: stdout = null; L118: swapping = false; ... L127: rl.on("line", (line) => this.onClientLine(line)); L128: rl.on("close", () => this.child?.stdin?.end()); L129: const timer = setInterval(() => this.checkRestart(stdout), RESTART_CHECK_INTERVAL_MS);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L92

92// src/integrations/stdio-proxy.ts L93: var import_node_child_process31, import_node_readline3, RESTART_CHECK_INTERVAL_MS, SIGKILL_ESCALATION_MS, TOOL_CALL_TIMEOUT_MS, REPLAY_INIT_ID, RestartableStdioProxy; L94: var init_stdio_proxy = __esm({ ... L389: } L390: async function adminQuery(baseUrl, key, api, body, fetchImpl = fetch) { L391: const res = await fetchImpl(`${baseUrl}/api/${api}`, { ... L3539: const tmp = `${debugFilePath}.${process.pid}.tmp`; L3540: fs.writeFileSync(tmp, header); L3541: fs.renameSync(tmp, debugFilePath);

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L92

12500package = codeam-cli; repositoryIdentity = codeagent-mobile-clients; dependency = chokidar L12500: try { L12501: return require("chokidar"); L12502: } catch {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L12500

1970Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js L1970: // Verified 2026-09-03 over MCP with a dummy key (`tools/list` → 162, no L1971: // licence gate, no paywall on stderr) and supply-chain audited from the L1972: // tarball: the only network hosts are api.clickup.com / L1973: // developer.clickup.com, no child_process/eval, deps = MCP SDK, axios, L1974: // zod, dotenv, form-data. Young package (2 releases, one author) — the L1975: // pin is EXACT and the licence audit watches every bump.

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L1970

16678fs9.writeFileSync(this.helperPath, PYTHON_PTY_HELPER, { mode: 420 }); L16679: this.proc = (0, import_child_process7.spawn)(python, [this.helperPath, cmd, ...args2], { L16680: stdio: ["pipe", "pipe", "inherit"], ... L16693: \u2717 Failed to launch Claude Code: ${err.message} L16694: Make sure claude is correctly installed: npm install -g @anthropic-ai/claude-code L16695: `

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L16678

11}; L12: var __commonJS = (cb, mod) => function __require() { L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L11

dist/vendor/node-pty/prebuilds/win32-arm64/pty.nodeView file

•path = dist/vendor/node-pty/prebuilds/win32-arm64/pty.node kind = native_binary sizeBytes = 293376 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/node-pty/prebuilds/win32-arm64/pty.nodeView on unpkg

dist/vendor/node-pty/lib/unixTerminal.jsView file

•matchType = normalized_sha256 matchedPackage = agent-tower@0.7.0 matchedPath = node_modules/@shitiandmw/node-pty/lib/unixTerminal.js matchedIdentity = npm:YWdlbnQtdG93ZXI:0.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/vendor/node-pty/lib/unixTerminal.jsView on unpkg

dist/vendor/node-pty/lib/windowsPtyAgent.jsView file

•matchType = normalized_sha256 matchedPackage = agent-tower@0.7.0 matchedPath = node_modules/@shitiandmw/node-pty/lib/windowsPtyAgent.js matchedIdentity = npm:YWdlbnQtdG93ZXI:0.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/vendor/node-pty/lib/windowsPtyAgent.jsView on unpkg

Source & flagged code

16 flagged

package.jsonView file

Lines 4-44json

4 "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",

5 "type": "commonjs",

6 "main": "dist/index.js",

7 "bin": {

8 "codeam": "dist/index.js"

9 },

10 "files": [

11 "dist/index.js",

12 "dist/postinstall.js",

13 "dist/vendor",

14 "README.md",

15 "CHANGELOG.md",

16 "LICENSE"

17 ],

18 "scripts": {

19 "build": "tsup && node scripts/vendor-node-pty.js",

20 "dev": "tsup --watch",

21 "test": "vitest run",

22 "test:coverage": "vitest run --coverage",

23 "typecheck": "tsc --noEmit",

24 "postinstall": "node dist/postinstall.js || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "prepublishOnly": "npm run build",

26 "e2e": "playwright test"

27 },

28 "keywords": [

29 "claude",

30 "claude-code",

31 "ai",

32 "ai-agent",

33 "ai-coding",

34 "ai-workflow",

35 "ai-workflow-continuity",

36 "async-ai-productivity",

37 "remote-ai-supervision",

38 "cli",

39 "developer-tools",

40 "devtools",

41 "codeagent",

42 "codeam",

43 "anthropic",

44 "openai-codex",

dist/index.jsView file

92// src/integrations/stdio-proxy.ts L93: var import_node_child_process31, import_node_readline3, RESTART_CHECK_INTERVAL_MS, SIGKILL_ESCALATION_MS, TOOL_CALL_TIMEOUT_MS, REPLAY_INIT_ID, RestartableStdioProxy; L94: var init_stdio_proxy = __esm({

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L92

8690var STARTUP_EXEC_ARGV = [ L8691: ...globalThis.process?.execArgv ?? [] L8692: ];

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L8690

10688process.stderr.write( L10689: "\n codeam-cli sends anonymous + identified usage events to PostHog\n (same project as the mobile + web apps). Opt out at any time:\n export CODEAM_TELEMETRY=0\n See https://... L10690: ); ... L10694: function vercelBypassHeader() { L10695: const token = process.env.CODEAM_VERCEL_BYPASS; L10696: return token ? { "x-vercel-protection-bypass": token } : {}; ... L10699: // src/lib/git-branch.ts L10700: var import_child_process = require("child_process"); L10701: function detectCurrentBranch(cwd = process.cwd()) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L10688

•

dist/vendor/node-pty/prebuilds/win32-arm64/pty.nodeView file

•path = dist/vendor/node-pty/prebuilds/win32-arm64/pty.node kind = native_binary sizeBytes = 293376 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/node-pty/prebuilds/win32-arm64/pty.nodeView on unpkg

dist/vendor/node-pty/lib/unixTerminal.jsView file

•matchType = normalized_sha256 matchedPackage = agent-tower@0.7.0 matchedPath = node_modules/@shitiandmw/node-pty/lib/unixTerminal.js matchedIdentity = npm:YWdlbnQtdG93ZXI:0.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/vendor/node-pty/lib/unixTerminal.jsView on unpkg

dist/vendor/node-pty/lib/windowsPtyAgent.jsView file

•matchType = normalized_sha256 matchedPackage = agent-tower@0.7.0 matchedPath = node_modules/@shitiandmw/node-pty/lib/windowsPtyAgent.js matchedIdentity = npm:YWdlbnQtdG93ZXI:0.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/vendor/node-pty/lib/windowsPtyAgent.jsView on unpkg