registry / mulmoterminal / 0.6.0

mulmoterminal@0.6.0

MulmoTerminal — browser terminal + GUI panel for Claude Code. One command to start.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. The risky primitives are aligned with a browser terminal and Claude GUI wrapper and are activated by running the CLI/server, not by covert install-time payloads.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs npx mulmoterminal or installed mulmoterminal CLI; postinstall runs during npm install

Impact

Expected local PTY, workspace artifact writes, optional update check, and node-pty permission fix

Mechanism

local Claude terminal server with plugin-backed GUI tools

Rationale

Static inspection found high-risk capabilities, but they are transparent product behavior for a local terminal/Claude GUI and include origin checks, argv-based spawning, path validation, and scoped filesystem writes. The install hook is limited to fixing node-pty helper permissions and does not harvest data, persist malware, or exfiltrate secrets.

Evidence

package.jsonbin/mulmoterminal.jsbin/update-check.jsserver/fix-pty-perms.jsserver/index.tsserver/claude-args.tsserver/plugins-registry.tsserver/pick-file.tsserver/open-dir.tsserver/backends/artifacts.tsnode-pty/prebuilds/*/spawn-helper~/.mulmoterminal/dev-terminal-sessions.json<workspace>/artifacts/**<workspace>/config/shortcuts.json

Network endpoints3

registry.npmjs.orglocalhost:<PORT>127.0.0.1:<PORT>

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for block

package.json has postinstall running server/fix-pty-perms.js
bin/mulmoterminal.js uses child_process to check claude, spawn server, and open localhost URL
server/index.ts spawns Claude PTYs and exposes local WebSocket/API control surfaces
server/plugins-registry.ts dynamically imports configured plugin packages from plugins/plugins.json

Evidence against

server/fix-pty-perms.js only chmods node-pty prebuild spawn-helper files to 0755
bin/update-check.js only fetches package latest metadata from npm registry and fails closed
server/index.ts origin-checks browser-driven local action routes/sockets to localhost/127.0.0.1/::1
server/claude-args.ts builds argv arrays with -- delimiter for prompts; no shell interpolation for Claude spawn
server/pick-file.ts/open-dir.ts/gitRemote.ts use fixed commands with argv, not user-built shell strings
File writes are app/workspace artifacts or local state with path containment checks in inspected backends

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 167 file(s), 4.10 MB of source, external domains: 127.0.0.1, bitbucket.org, cdn.jsdelivr.net, cdn.plot.ly, cdnjs.cloudflare.com, chevrotain.io, en.wikipedia.org, evil.example, fonts.bunny.net, fonts.googleapis.com, fonts.gstatic.com, github.com, langium.org, registry.npmjs.org, unpkg.com, www.w3.org

Oversized source lightweight scan

dist/assets/index-Cq5XDyLc.js2.55 MB file, sampled 256 KB

NetworkChildProcessHighEntropyStringsMinifiedUrlStringsProtestwarewww.w3.org

dist/assets/marp-cCC1_YXp.js3.39 MB file, sampled 256 KB

ChildProcessObfuscatedHighEntropyStringsUrlStringscdn.jsdelivr.netfonts.bunny.netwww.w3.org

Source & flagged code

10 flagged

package.jsonView file

Lines 26-66json

26 "server/",

27 "plugins/"

28 ],

29 "engines": {

30 "node": ">=22.9"

31 },

32 "scripts": {

33 "dev": "concurrently -n server,vite -c blue,green \"node --watch --import tsx --env-file-if-exists=.env server/index.ts\" \"vite\"",

34 "dev:server": "node --watch --import tsx --env-file-if-exists=.env server/index.ts",

35 "dev:client": "vite",

36 "build": "vue-tsc -b && vite build",

37 "typecheck": "vue-tsc -b",

38 "typecheck:server": "tsc -p tsconfig.server.json",

39 "lint": "eslint .",

40 "format": "prettier --write .",

41 "format:check": "prettier --check .",

42 "preview": "vite preview",

43 "server": "node --import tsx --env-file-if-exists=.env server/index.ts",

44 "test": "vitest run",

45 "prepack": "vue-tsc -b && vite build",

46 "postinstall": "node server/fix-pty-perms.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L46

47 },

48 "dependencies": {

49 "@google/genai": "^2.10.0",

50 "@marp-team/marp-core": "^4.3.0",

51 "@modelcontextprotocol/sdk": "^1.29.0",

52 "@mulmochat-plugin/generate-image": "^0.5.0",

53 "@mulmochat-plugin/ui-image": "^0.4.0",

54 "@mulmoclaude/accounting-plugin": "^0.3.1",

55 "@mulmoclaude/chart-plugin": "^0.1.3",

56 "@mulmoclaude/collection-plugin": "^0.5.21",

57 "@mulmoclaude/core": "^0.5.1",

58 "@mulmoclaude/form-plugin": "^0.1.4",

59 "@mulmoclaude/html-plugin": "^0.2.5",

60 "@mulmoclaude/markdown-plugin": "^0.1.10",

61 "@mulmoclaude/x-plugin": "^0.1.2",

62 "@receptron/task-scheduler": "^0.1.0",

63 "@xterm/addon-attach": "^0.12.0",

64 "@xterm/addon-fit": "^0.11.0",

65 "@xterm/addon-web-links": "^0.12.0",

66 "@xterm/xterm": "^6.0.0",

bin/mulmoterminal.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

3// MulmoTerminal launcher — `npx mulmoterminal` entry point.

4//

5// Ships the server source (TypeScript) + a pre-built client (Vite dist/), and

6// runs the server via tsx. Mirrors the mulmoclaude launcher.

8import { execSync, spawn } from "node:child_process";

9import { existsSync, statSync } from "node:fs";

High

Child Process

server/pick-file.tsView file

Lines 13-53typescript

13 return {

14 cmd: "osascript",

15 args: [

16 "-e",

17 `set chosen to choose file with prompt "${PICK_PROMPT}" with multiple selections allowed`,

18 "-e",

19 "set text item delimiters to linefeed",

20 "-e",

server/plugins-registry.tsView file

Lines 45-85typescript

45// The gui-chat-protocol ToolContext.files — generic file capabilities keyed by

46// area. `artifacts` is the shared, user-browsable output area (rooted at

47// <workspace>/artifacts), used by @mulmoclaude/chart-plugin's executeChart to

48// persist the chart document. Plugins that don't write artifacts ignore it.

49const FILES_CONTEXT = { artifacts: artifactsFileOps };

51function loadConfig() {

52 const raw = fs.

server/worktrees.tsView file

Lines 1-26typescript

1// Per-agent git worktree isolation: each cell can run claude in its own throwaway

2// worktree (a separate working tree sharing the repo's single .git), so several

3// agents work the same repo without clobbering each other. Worktrees live under a

4// managed root (~/.mulmoterminal/worktrees/<repo>-<hash>/<task>) so the repo dir

5// stays clean and we only ever remove paths WE created. The pure helpers (slug /

6// parse / paths) are split out for unit tests; the rest shell out to git.

7import { spawn } from "node:child_process";

8import { createHash } from "node:crypto";

dist/assets/mermaid-parser.core-DC7NPJ_M-DgfQQlG5.jsView file

46contains invisible/control Unicode U+FEFF (zero width no-break space) \r \v \xA0  \u2028\u2029  　<U+FEFF>`.split(``);function ka(e){let t=typeof e==`string`?new RegExp(e):e;return Oa.some(e=>t.test(e))}s(ka,`isWhitespace`);function Aa(e){return e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`)}s(Aa,`escapeReg

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/assets/mermaid-parser.core-DC7NPJ_M-DgfQQlG5.jsView on unpkg · L46

dist/assets/material-symbols-outlined-DKJDg2oJ.woff2View file

•path = dist/assets/material-symbols-outlined-DKJDg2oJ.woff2 kind = high_entropy_blob sizeBytes = 3960064 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/material-symbols-outlined-DKJDg2oJ.woff2View on unpkg

dist/assets/marp-cCC1_YXp.jsView file

•path = dist/assets/marp-cCC1_YXp.js kind = oversized_source_file sizeBytes = 3555296 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/marp-cCC1_YXp.jsView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node server/fix-pty-perms.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/mulmoterminal.jsView file

7L8: import { execSync, spawn } from "node:child_process"; L9: import { existsSync, statSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/mulmoterminal.jsView on unpkg · L7

7Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, execution+network L7: L8: import { execSync, spawn } from "node:child_process"; L9: import { existsSync, statSync } from "node:fs"; L10: import { get as httpGet } from "node:http"; L11: import { createRequire } from "node:module"; ... L16: L17: const __dirname = dirname(fileURLToPath(import.meta.url)); L18: const PKG_DIR = join(__dirname, ".."); ... L22: const MAX_BIND_RETRIES = 5; L23: // Server exit code meaning "port taken at bind time" — keep in sync with L24: // server/index.ts (PORT_IN_USE_EXIT_CODE). ... L26:

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/mulmoterminal.jsView on unpkg · L7

193log(`Starting MulmoTerminal on port ${port}...`); L194: const server = spawn(process.execPath, ["--import", "tsx", SERVER_ENTRY], { L195: cwd: PKG_DIR, L196: env: { ...process.env, NODE_ENV: "production", PORT: String(port), CLAUDE_CWD: cwd }, L197: stdio: "inherit", ... L200: L201: const url = `http://localhost:${port}`; L202: const cancelReady = waitUntilReady(port, () => {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/mulmoterminal.jsView on unpkg · L193

server/pick-file.tsView file

33return { L34: cmd: "powershell", L35: args: [

High

Shell

Package source references shell execution.

server/pick-file.tsView on unpkg · L33

server/plugins-registry.tsView file

65async function loadPackage(name: string) { L66: const mod = await import(name); L67: const definition = mod.TOOL_DEFINITION ?? mod.pluginCore?.toolDefinition;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

server/plugins-registry.tsView on unpkg · L65

server/worktrees.tsView file

6// parse / paths) are split out for unit tests; the rest shell out to git. L7: import { spawn } from "node:child_process"; L8: import { createHash } from "node:crypto"; ... L15: // realpath so it matches the realpaths `git worktree list` reports (e.g. macOS L16: // /tmp -> /private/tmp), which the isManagedWorktree filter relies on. L17: function worktreesBase(): string { L18: const base = process.env.MULMOTERMINAL_HOME || path.join(os.homedir(), ".mulmoterminal"); L19: try { ... L101: L102: // Run git with argv (no shell) in `cwd`; resolve { ok, stdout } — never reject, so L103: // a missing git / non-repo dir is just `ok:false` and the caller falls back.

Low

Weak Crypto

Package source references weak cryptographic algorithms.

server/worktrees.tsView on unpkg · L6

dist/assets/mermaid-parser.core-DC7NPJ_M-DgfQQlG5.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/assets/mermaid-parser.core-DC7NPJ_M-DgfQQlG5.jsView on unpkg · L46

dist/assets/material-symbols-outlined-DKJDg2oJ.woff2View file

•path = dist/assets/material-symbols-outlined-DKJDg2oJ.woff2 kind = high_entropy_blob sizeBytes = 3960064 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/material-symbols-outlined-DKJDg2oJ.woff2View on unpkg

dist/assets/marp-cCC1_YXp.jsView file

•path = dist/assets/marp-cCC1_YXp.js kind = oversized_source_file sizeBytes = 3555296 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/marp-cCC1_YXp.jsView on unpkg

Findings

1 Critical7 High5 Medium6 Low

CriticalTrojan Source Unicodedist/assets/mermaid-parser.core-DC7NPJ_M-DgfQQlG5.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/mulmoterminal.js

HighShellserver/pick-file.ts

HighEntrypoint Build Divergencebin/mulmoterminal.js

HighSame File Env Network Executionbin/mulmoterminal.js

HighShips High Entropy Blobdist/assets/material-symbols-outlined-DKJDg2oJ.woff2

HighOversized Source Filedist/assets/marp-cCC1_YXp.js

MediumDynamic Requireserver/plugins-registry.ts

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptoserver/worktrees.ts

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

10 flagged

package.jsonView file

Lines 26-66json

26 "server/",

27 "plugins/"

28 ],

29 "engines": {

30 "node": ">=22.9"

31 },

32 "scripts": {

33 "dev": "concurrently -n server,vite -c blue,green \"node --watch --import tsx --env-file-if-exists=.env server/index.ts\" \"vite\"",

34 "dev:server": "node --watch --import tsx --env-file-if-exists=.env server/index.ts",

35 "dev:client": "vite",

36 "build": "vue-tsc -b && vite build",

37 "typecheck": "vue-tsc -b",

38 "typecheck:server": "tsc -p tsconfig.server.json",

39 "lint": "eslint .",

40 "format": "prettier --write .",

41 "format:check": "prettier --check .",

42 "preview": "vite preview",

43 "server": "node --import tsx --env-file-if-exists=.env server/index.ts",

44 "test": "vitest run",

45 "prepack": "vue-tsc -b && vite build",

46 "postinstall": "node server/fix-pty-perms.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L46

47 },

48 "dependencies": {

49 "@google/genai": "^2.10.0",

50 "@marp-team/marp-core": "^4.3.0",

51 "@modelcontextprotocol/sdk": "^1.29.0",

52 "@mulmochat-plugin/generate-image": "^0.5.0",

53 "@mulmochat-plugin/ui-image": "^0.4.0",

54 "@mulmoclaude/accounting-plugin": "^0.3.1",

55 "@mulmoclaude/chart-plugin": "^0.1.3",

56 "@mulmoclaude/collection-plugin": "^0.5.21",

57 "@mulmoclaude/core": "^0.5.1",

58 "@mulmoclaude/form-plugin": "^0.1.4",

59 "@mulmoclaude/html-plugin": "^0.2.5",

60 "@mulmoclaude/markdown-plugin": "^0.1.10",

61 "@mulmoclaude/x-plugin": "^0.1.2",

62 "@receptron/task-scheduler": "^0.1.0",

63 "@xterm/addon-attach": "^0.12.0",

64 "@xterm/addon-fit": "^0.11.0",

65 "@xterm/addon-web-links": "^0.12.0",

66 "@xterm/xterm": "^6.0.0",

bin/mulmoterminal.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

3// MulmoTerminal launcher — `npx mulmoterminal` entry point.

4//

5// Ships the server source (TypeScript) + a pre-built client (Vite dist/), and

6// runs the server via tsx. Mirrors the mulmoclaude launcher.

8import { execSync, spawn } from "node:child_process";

9import { existsSync, statSync } from "node:fs";

High

Child Process

server/pick-file.tsView file

Lines 13-53typescript

13 return {

14 cmd: "osascript",

15 args: [

16 "-e",

17 `set chosen to choose file with prompt "${PICK_PROMPT}" with multiple selections allowed`,

18 "-e",

19 "set text item delimiters to linefeed",

20 "-e",

server/plugins-registry.tsView file

Lines 45-85typescript

45// The gui-chat-protocol ToolContext.files — generic file capabilities keyed by

46// area. `artifacts` is the shared, user-browsable output area (rooted at

47// <workspace>/artifacts), used by @mulmoclaude/chart-plugin's executeChart to

48// persist the chart document. Plugins that don't write artifacts ignore it.

49const FILES_CONTEXT = { artifacts: artifactsFileOps };

51function loadConfig() {

52 const raw = fs.

server/worktrees.tsView file

Lines 1-26typescript

1// Per-agent git worktree isolation: each cell can run claude in its own throwaway

2// worktree (a separate working tree sharing the repo's single .git), so several

3// agents work the same repo without clobbering each other. Worktrees live under a

4// managed root (~/.mulmoterminal/worktrees/<repo>-<hash>/<task>) so the repo dir

5// stays clean and we only ever remove paths WE created. The pure helpers (slug /

6// parse / paths) are split out for unit tests; the rest shell out to git.

7import { spawn } from "node:child_process";

8import { createHash } from "node:crypto";

dist/assets/mermaid-parser.core-DC7NPJ_M-DgfQQlG5.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/assets/mermaid-parser.core-DC7NPJ_M-DgfQQlG5.jsView on unpkg · L46

dist/assets/material-symbols-outlined-DKJDg2oJ.woff2View file

•path = dist/assets/material-symbols-outlined-DKJDg2oJ.woff2 kind = high_entropy_blob sizeBytes = 3960064 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/material-symbols-outlined-DKJDg2oJ.woff2View on unpkg

dist/assets/marp-cCC1_YXp.jsView file

•path = dist/assets/marp-cCC1_YXp.js kind = oversized_source_file sizeBytes = 3555296 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/assets/marp-cCC1_YXp.jsView on unpkg