Loading npm security reports…

codeam-cli@2.76.16: Manual Review npm security report (Allow) | LPM Firewall

registry / codeam-cli / 2.76.16

codeam-cli@2.76.16

⚠ Under review

Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

No attack was confirmed from the readable source. The main entrypoint remains unreviewable because the source inspection tools rejected it as containing NUL bytes.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

The package postinstall hook runs during installation; the CLI entrypoint runs when invoked.

Impact

The installation message has no identified adverse effect; entrypoint impact is unresolved.

Mechanism

The readable postinstall script prints CLI instructions. The main entrypoint behavior could not be established.

AI rationale

The postinstall script visibly prints setup guidance, and the inspected vendored files are PTY support code. The manifest-reachable dist/index.js could not be searched or read because inspection rejected it as a binary or unapproved NUL source file, leaving key behavior unresolved.

Decision evidence

public snapshot

AI called this Manual Review at 92.0% confidence as Unknown with medium false-positive risk.

AI review observations

The package has a postinstall hook, but its referenced script only prints CLI setup instructions.
The main entrypoint could not be inspected: read_file and search rejected dist/index.js as a binary or unapproved NUL source file.
The flagged node-pty files show native PTY loading and Windows process support.

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

92// src/integrations/stdio-proxy.ts L93: var import_node_child_process37, import_node_readline3, RESTART_CHECK_INTERVAL_MS, SIGKILL_ESCALATION_MS, TOOL_CALL_TIMEOUT_MS, REPLAY_INIT_ID, RestartableStdioProxy; L94: var init_stdio_proxy = __esm({

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L92

8692var STARTUP_EXEC_ARGV = [ L8693: ...globalThis.process?.execArgv ?? [] L8694: ];

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L8692

10690process.stderr.write( L10691: "\n codeam-cli sends anonymous + identified usage events to PostHog\n (same project as the mobile + web apps). Opt out at any time:\n export CODEAM_TELEMETRY=0\n See https://... L10692: ); ... L10696: function vercelBypassHeader() { L10697: const token = process.env.CODEAM_VERCEL_BYPASS; L10698: return token ? { "x-vercel-protection-bypass": token } : {}; ... L10701: // src/lib/git-branch.ts L10702: var import_child_process = require("child_process"); L10703: function detectCurrentBranch(cwd = process.cwd()) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L10690

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: var import_node_child_process37, import_node_readline3, RESTART_CHECK_INTERVAL_MS, SIGKILL_ESCALATION_MS, TOOL_CALL_TIMEOUT_MS, REPLAY_INIT_ID, RestartableStdioProxy; import_node_readline3 = __toESM(require("readline")); const rl = import_node_readline3.default.createInterface({ input: stdin, crlfDelay: Infinity }); const rl = import_node_readline3.default.createInterface({ input: child.stdout, crlfDelay: Infinity }); async function adminQuery(baseUrl, key, api, body, fetchImpl = fetch) { const res = await fetchImpl(`${baseUrl}/api/${api}`, { headers: { Authorization: `Convex ${key}`, "Content-Type": "application/json" }

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

1970// Verified 2026-09-03 over MCP with a dummy key (`tools/list` → 162, no L1971: // licence gate, no paywall on stderr) and supply-chain audited from the L1972: // tarball: the only network hosts are api.clickup.com / L1973: // developer.clickup.com, no child_process/eval, deps = MCP SDK, axios, L1974: // zod, dotenv, form-data. Young package (2 releases, one author) — the L1975: // pin is EXACT and the licence audit watches every bump.

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1970

92// src/integrations/stdio-proxy.ts L93: var import_node_child_process37, import_node_readline3, RESTART_CHECK_INTERVAL_MS, SIGKILL_ESCALATION_MS, TOOL_CALL_TIMEOUT_MS, REPLAY_INIT_ID, RestartableStdioProxy; L94: var init_stdio_proxy = __esm({ ... L101: TOOL_CALL_TIMEOUT_MS = (() => { L102: const raw = Number(process.env.CODEAM_MCP_TOOL_TIMEOUT_MS); L103: return Number.isFinite(raw) && raw > 0 ? raw : 12e4; ... L116: toolTimers = /* @__PURE__ */ new Map(); L117: stdout = null; L118: swapping = false; ... L127: rl.on("line", (line) => this.onClientLine(line)); L128: rl.on("close", () => this.child?.stdin?.end()); L129: const timer = setInterval(() => this.checkRestart(stdout), RESTART_CHECK_INTERVAL_MS);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L92

92// src/integrations/stdio-proxy.ts L93: var import_node_child_process37, import_node_readline3, RESTART_CHECK_INTERVAL_MS, SIGKILL_ESCALATION_MS, TOOL_CALL_TIMEOUT_MS, REPLAY_INIT_ID, RestartableStdioProxy; L94: var init_stdio_proxy = __esm({ ... L389: } L390: async function adminQuery(baseUrl, key, api, body, fetchImpl = fetch) { L391: const res = await fetchImpl(`${baseUrl}/api/${api}`, { ... L3541: const tmp = `${debugFilePath}.${process.pid}.tmp`; L3542: fs.writeFileSync(tmp, header); L3543: fs.renameSync(tmp, debugFilePath);

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L92

12508package = codeam-cli; repositoryIdentity = codeagent-mobile-clients; dependency = chokidar L12508: try { L12509: return require("chokidar"); L12510: } catch {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L12508

1970Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js L1970: // Verified 2026-09-03 over MCP with a dummy key (`tools/list` → 162, no L1971: // licence gate, no paywall on stderr) and supply-chain audited from the L1972: // tarball: the only network hosts are api.clickup.com / L1973: // developer.clickup.com, no child_process/eval, deps = MCP SDK, axios, L1974: // zod, dotenv, form-data. Young package (2 releases, one author) — the L1975: // pin is EXACT and the licence audit watches every bump.

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L1970

16695fs9.writeFileSync(this.helperPath, PYTHON_PTY_HELPER, { mode: 420 }); L16696: this.proc = (0, import_child_process7.spawn)(python, [this.helperPath, cmd, ...args2], { L16697: stdio: ["pipe", "pipe", "inherit"], ... L16710: \u2717 Failed to launch Claude Code: ${err.message} L16711: Make sure claude is correctly installed: npm install -g @anthropic-ai/claude-code L16712: `

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L16695

11}; L12: var __commonJS = (cb, mod) => function __require() { L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L11

dist/vendor/node-pty/prebuilds/win32-arm64/pty.nodeView file

•path = dist/vendor/node-pty/prebuilds/win32-arm64/pty.node kind = native_binary sizeBytes = 293376 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/node-pty/prebuilds/win32-arm64/pty.nodeView on unpkg

dist/vendor/node-pty/lib/unixTerminal.jsView file

•matchType = normalized_sha256 matchedPackage = agent-tower@0.7.0 matchedPath = node_modules/@shitiandmw/node-pty/lib/unixTerminal.js matchedIdentity = npm:YWdlbnQtdG93ZXI:0.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/vendor/node-pty/lib/unixTerminal.jsView on unpkg

dist/vendor/node-pty/lib/windowsPtyAgent.jsView file

•matchType = normalized_sha256 matchedPackage = agent-tower@0.7.0 matchedPath = node_modules/@shitiandmw/node-pty/lib/windowsPtyAgent.js matchedIdentity = npm:YWdlbnQtdG93ZXI:0.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/vendor/node-pty/lib/windowsPtyAgent.jsView on unpkg

Source & flagged code

16 flagged

package.jsonView file

Lines 4-44json

4 "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",

5 "type": "commonjs",

6 "main": "dist/index.js",

7 "bin": {

8 "codeam": "dist/index.js"

9 },

10 "files": [

11 "dist/index.js",

12 "dist/postinstall.js",

13 "dist/vendor",

14 "README.md",

15 "CHANGELOG.md",

16 "LICENSE"

17 ],

18 "scripts": {

19 "build": "tsup && node scripts/vendor-node-pty.js",

20 "dev": "tsup --watch",

21 "test": "vitest run",

22 "test:coverage": "vitest run --coverage",

23 "typecheck": "tsc --noEmit",

24 "postinstall": "node dist/postinstall.js || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "prepublishOnly": "npm run build",

26 "e2e": "playwright test"

27 },

28 "keywords": [

29 "claude",

30 "claude-code",

31 "ai",

32 "ai-agent",

33 "ai-coding",

34 "ai-workflow",

35 "ai-workflow-continuity",

36 "async-ai-productivity",

37 "remote-ai-supervision",

38 "cli",

39 "developer-tools",

40 "devtools",

41 "codeagent",

42 "codeam",

43 "anthropic",

44 "openai-codex",

dist/index.jsView file

92// src/integrations/stdio-proxy.ts L93: var import_node_child_process37, import_node_readline3, RESTART_CHECK_INTERVAL_MS, SIGKILL_ESCALATION_MS, TOOL_CALL_TIMEOUT_MS, REPLAY_INIT_ID, RestartableStdioProxy; L94: var init_stdio_proxy = __esm({

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L92

8692var STARTUP_EXEC_ARGV = [ L8693: ...globalThis.process?.execArgv ?? [] L8694: ];

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L8692

10690process.stderr.write( L10691: "\n codeam-cli sends anonymous + identified usage events to PostHog\n (same project as the mobile + web apps). Opt out at any time:\n export CODEAM_TELEMETRY=0\n See https://... L10692: ); ... L10696: function vercelBypassHeader() { L10697: const token = process.env.CODEAM_VERCEL_BYPASS; L10698: return token ? { "x-vercel-protection-bypass": token } : {}; ... L10701: // src/lib/git-branch.ts L10702: var import_child_process = require("child_process"); L10703: function detectCurrentBranch(cwd = process.cwd()) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L10690

•

dist/vendor/node-pty/prebuilds/win32-arm64/pty.nodeView file

•path = dist/vendor/node-pty/prebuilds/win32-arm64/pty.node kind = native_binary sizeBytes = 293376 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/node-pty/prebuilds/win32-arm64/pty.nodeView on unpkg

dist/vendor/node-pty/lib/unixTerminal.jsView file

•matchType = normalized_sha256 matchedPackage = agent-tower@0.7.0 matchedPath = node_modules/@shitiandmw/node-pty/lib/unixTerminal.js matchedIdentity = npm:YWdlbnQtdG93ZXI:0.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/vendor/node-pty/lib/unixTerminal.jsView on unpkg

dist/vendor/node-pty/lib/windowsPtyAgent.jsView file

•matchType = normalized_sha256 matchedPackage = agent-tower@0.7.0 matchedPath = node_modules/@shitiandmw/node-pty/lib/windowsPtyAgent.js matchedIdentity = npm:YWdlbnQtdG93ZXI:0.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/vendor/node-pty/lib/windowsPtyAgent.jsView on unpkg