registry / linkshell-cli / 0.6.1
linkshell-cli@0.6.1
Remote terminal bridge for Claude Code / Codex / Gemini / Copilot — control from your phone
AI Security Review
scanned 26d ago · by lpm-firewall-aiInspected source shows a narrow native-helper permission fix, user-invoked CLI operations, and targeted LinkShell hook cleanup; it does not establish malicious behavior. The scanner’s execution and network signals are consistent with these package functions.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Package installation runs a permission fix; login, upgrade, and host behavior require their respective CLI flows.
Impact
No confirmed attack surface was established in the inspected code.
Mechanism
The install script adjusts node-pty helper permissions; login handles an authentication callback locally; hook cleanup recognizes LinkShell entries in named agent configuration files.
AI rationale
Inspected source shows a narrow native-helper permission fix, user-invoked CLI operations, and targeted LinkShell hook cleanup; it does not establish malicious behavior. The scanner’s execution and network signals are consistent with these package functions.
Evidence
package.jsonscripts/postinstall.mjsdist/cli/src/runtime/hook-command.jssrc/runtime/acp/claude-sdk-client.tssrc/runtime/hook-command.tsdist/host/src/ports.jsdist/cli/src/runtime/screen-fallback.jsdist/cli/src/commands/login.jsdist/cli/src/commands/upgrade.jsdist/cli/src/commands/host.jsdist/host/src/drivers/claude/driver.js
Network endpoints2
itool.tech/en/auth/linkshellregistry.npmjs.org/linkshell-cli/latest
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines a postinstall script that runs scripts/postinstall.mjs; the script only adjusts node-pty spawn-helper permissions.
- The hook cleanup targets LinkShell hook entries in specific Claude, Codex, and Gemini configuration files.
- The source hook cleanup uses the same targeted configuration paths.
- The Claude SDK client location is part of normal Claude project transcript path handling.
- The host port code opens a socket to a selected host and port for forwarding.
- The screen fallback uses local process and temporary-file APIs as part of its terminal helper.
- Login binds its callback server to 127.0.0.1 and receives the browser callback locally.
- The upgrade command installs linkshell-cli@latest only when the user invokes the upgrade flow and a newer version is found.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
Source & flagged code
10 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/host/src/ports.jsView file
1import { execFile } from "node:child_process";
L2: import { readlink } from "node:fs/promises";
High
Child Process
Package source references child process execution.
dist/host/src/ports.jsView on unpkg · L1Findings
1 Critical7 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/host/src/drivers/claude/driver.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/host/src/ports.js
HighShelldist/cli/src/runtime/screen-fallback.js
HighCommand Output Exfiltrationdist/cli/src/commands/login.js
HighTrigger Reachable Command Output Exfiltrationdist/cli/src/commands/login.js
HighRuntime Package Installdist/cli/src/commands/upgrade.js
HighSemantic Analysis Limiteddist/cli/src/commands/host.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to linkshell-cli@0.6.1.
See all versions of linkshell-cli for other recorded verdicts.
- Review the evidence and your use of linkshell-cli@0.6.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.