Loading npm security reports…

port-authority-agent-terminal-mcp@0.4.2: Malicious npm security | LPM Firewall

registry / port-authority-agent-terminal-mcp / 0.4.2

port-authority-agent-terminal-mcp@0.4.2

Cross-platform (Windows + macOS) lane coordinator for AI coding agents (Claude, Codex, etc.) — keeps multiple local agents from colliding on dev-server ports, Chrome debug ports, and Chrome user profiles. Includes a CLI, an MCP server, and a native Tauri

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Installing the package runs code that modifies third-party AI-agent configuration without a separate user command. On Windows it also creates login persistence for a staged executable.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation that runs postinstall, including a global install or installation from the package root.

Impact

Claude Desktop, Codex Desktop, and Claude Code can be configured to launch the package's MCP server; Windows can launch its dashboard at login.

Mechanism

Automatic MCP configuration injection plus Windows startup persistence.

Attack narrative

The package's automatic postinstall hook invokes its MCP installer, which writes package-controlled launch commands into Claude and Codex user configuration. This is an unconsented mutation of external AI-agent control surfaces. On Windows, the same automatic hook additionally installs a Startup-folder shortcut to a copied dashboard executable, creating login persistence.

Rationale

This release automatically modifies foreign AI-agent configuration during npm installation and adds Windows login persistence. Those actions meet the install-hook abuse blocking policy even though no secret exfiltration was found.

Evidence

package.jsonscripts/postinstall.cjsdist/src/cli/install-mcp.jsdist/src/cli/autostart.js%APPDATA%\Claude\claude_desktop_config.json~/.codex/config.toml%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Port Authority Agent Terminal.lnk

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{require('./scripts/postinstall.cjs')}catch(e){if(e&&e.code==='MODULE_NOT_FOUND'&&String(e.message).includes('scripts/postinstall.cjs')){console.warn('[paat postinstall...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('./scripts/postinstall.cjs')}catch(e){if(e&&e.code==='MODULE_NOT_FOUND'&&String(e.message).includes('scripts/postinstall.cjs')){console.warn('[paat postinstall...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/src/core/pagejs.jsView file

18// new Function only PARSES here — nothing is executed. L19: new Function(`return (${expr});`); L20: return expr;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/core/pagejs.jsView on unpkg · L18

scripts/build-dashboard-tauri.cjsView file

31L32: const { spawnSync } = require("node:child_process"); L33: const path = require("node:path"); ... L36: L37: const repoRoot = path.resolve(__dirname, ".."); L38: const guiDir = path.join(repoRoot, "gui"); ... L43: L44: function log(msg) { process.stdout.write(`[build-dashboard] ${msg}\n`); } L45: function warn(msg) { process.stderr.write(`[build-dashboard] ${msg}\n`); } ... L48: * doesn't auto-append .cmd on Windows when shell:false, so we have to. */ L49: function npmCmd() { return process.platform === "win32" ? "npm.cmd" : "npm"; } L50: function cargoCmd() { return process.platform === "win32" ? "cargo.exe" : "cargo"; }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/build-dashboard-tauri.cjsView on unpkg · L31

bin/paat-dashboard.exeView file

•path = bin/paat-dashboard.exe kind = native_binary sizeBytes = 9761280 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/paat-dashboard.exeView on unpkg

dist/src/cli/install-mcp.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/src/cli/install-mcp.js#virtual:normalized:round1View on unpkg

dist/src/cli/install-mcp.jsView file

•matchType = normalized_sha256 matchedPackage = port-authority-agent-terminal-mcp@0.3.10 matchedPath = dist/src/cli/install-mcp.js matchedIdentity = npm:[redacted]:0.3.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/install-mcp.jsView on unpkg

scripts/postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = port-authority-agent-terminal-mcp@0.3.10 matchedPath = scripts/postinstall.cjs matchedIdentity = npm:[redacted]:0.3.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.cjsView on unpkg

dist/src/cli/autostart.jsView file

•matchType = normalized_sha256 matchedPackage = port-authority-agent-terminal-mcp@0.3.10 matchedPath = dist/src/cli/autostart.js matchedIdentity = npm:[redacted]:0.3.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/autostart.jsView on unpkg

dist/src/cli/shortcut.jsView file

•matchType = normalized_sha256 matchedPackage = port-authority-agent-terminal-mcp@0.3.10 matchedPath = dist/src/cli/shortcut.js matchedIdentity = npm:[redacted]:0.3.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/shortcut.jsView on unpkg

dist/src/dashboard/launch.jsView file

•matchType = normalized_sha256 matchedPackage = port-authority-agent-terminal-mcp@0.3.10 matchedPath = dist/src/dashboard/launch.js matchedIdentity = npm:[redacted]:0.3.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/dashboard/launch.jsView on unpkg

dist/src/core/chrome.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = port-authority-agent-terminal-mcp@0.3.6 matchedIdentity = npm:[redacted]:0.3.6 similarity = 0.659 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/core/chrome.jsView on unpkg