rakumux@0.1.39
Terminal session manager for coding agents, with a fast TUI, a background session daemon and an MCP server
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe postinstall hook copies bundled scripts and platform binaries into the package's dist directory. The only observed network activity is a TUI-triggered check for rakumux's own release version, with no evidence of unrelated data collection or harmful actions.
Static reason
One or more suspicious static signals were detected.
Trigger
The postinstall hook stages assets. The background update check runs when the TUI opens.
Impact
No harmful impact was identified in the inspected source.
Mechanism
Install copies scripts and platform binaries into dist. The update check queries the package version using npm or Homebrew.
AI rationale
The postinstall hook copies bundled scripts and platform binaries into the package's dist directory. The only observed network activity is a TUI-triggered check for rakumux's own release version, with no evidence of unrelated data collection or harmful actions.
Evidence
dist/
Network endpoints2
npm registry via `npm view rakumux version`Homebrew via `brew info rakumux`
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The postinstall hook runs install.js.
- The install routine copies bundled scripts and platform binaries into the package's dist directory.
- Opening the TUI starts a background update check; it queries the version of rakumux from npm or Homebrew.
Evidence against
- The install hook stages package assets and does not show credential, project, or host data collection.
- The update check is limited to checking the package's version and is triggered when the TUI opens.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemShell
UrlStrings
Source & flagged code
7 flaggedpackage.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg44"scripts": {
"postinstall": "node install.js"
},
"engines": {
"node": ">=14.0.0"
},
"os": [
"darwi
Low
install.jsView file
Findings
2 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilityinstall.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumShips Native Binaryresources/prebuilt/macos-intel/rakumux-ptyd
MediumShips Build Helperresources/scripts/rakumux.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidenceinstall.js
Affected versions and remediation
This report applies to rakumux@0.1.39.
See all versions of rakumux for other recorded verdicts.
- Review the evidence and your use of rakumux@0.1.39 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.