registry / termdock / 1.4.152

termdock@1.4.152

A complete web-based terminal application with modern UI

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Installing the package can alter the host by installing tmux through available package managers, including sudo. Starting its CLI retries that action when tmux is missing.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation or starting the termdock CLI on a host without tmux

Impact

It can prompt for elevation, change system packages, and delete and rebuild dependency binaries without a separate user request.

Mechanism

automatic lifecycle and startup system-package installation

Attack narrative

The postinstall hook is automatically activated by npm. On Linux it selects an available package manager and executes sudo installation commands for tmux; on other platforms it also uses package managers. The same behavior is embedded in the CLI boot check, so it is retried during normal use. The hook also removes node-pty prebuilt files and invokes a rebuild. These are unconsented host mutations outside ordinary npm dependency setup.

Rationale

This package uses an automatic npm lifecycle hook to install a system package, including privileged commands, and repeats that behavior at runtime. That is concrete unconsented install-hook abuse even though no secret exfiltration was found.

Evidence

package.jsonscripts/postinstall.mjsdist/server/utils/bootCheck.jsnode_modules/node-pty/prebuilds/*~/.termdock/.boot-check-ok

Decision evidence

public snapshot

AI called this Malicious at 97.0% confidence as Malware with low false-positive risk.

Evidence for block

The install lifecycle automatically runs a package script.
That script invokes operating-system package managers, including sudo, to install tmux without an explicit user command.
The CLI repeats the automatic system-package installation on startup if tmux is absent.
The install script deletes node-pty prebuilt files and runs a rebuild command.

Evidence against

No credential collection or remote exfiltration was found in the inspected lifecycle and boot-check code.
The reviewed network-related update code targets the official npm registry, not an unrelated host.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 161 file(s), 6.88 MB of source, external domains: api.anthropic.com, api.github.com, api.kimi.com, api.openai.com, api.x.ai, bit.ly, brew.sh, chatgpt.com, chevrotain.io, en.wikipedia.org, generativelanguage.googleapis.com, github.com, jcgt.org, langium.org, nodejs.org, reactjs.org, registry.npmjs.org, www.w3.org

Oversized source lightweight scan

dist/client/assets/index-CHsO9fJ1.js2.01 MB file, sampled 256 KB

NetworkChildProcessWebSocketHighEntropyStringsMinifiedUrlStringsgithub.com

Source & flagged code

25 flagged

package.jsonView file

Lines 24-64json

24 "dev:client": "vite",

25 "dev:server": "cross-env PORT=9835 tsx watch src/server/entry.ts",

26 "build": "npm run clean && npm run build:client && npm run build:server && npm run build:runtime-manifest",

27 "build:desktop": "node scripts/prepare-desktop-tokens.mjs && tsc -p tsconfig.desktop.json && esbuild desktop/preload.cts --bundle --platform=node --format=cjs --external:electron --outfile=.desktop-dist/preload.cjs",

28 "desktop:dev": "npm run build && npm run build:desktop && electron-forge start",

29 "desktop:prepare": "npm run build && npm run build:desktop && node scripts/prepare-desktop-runtime.mjs",

30 "desktop:make": "node scripts/ensure-macos-appdmg.mjs && npm run desktop:prepare && electron-forge make",

31 "build:client": "vite build",

32 "build:server": "tsc -p tsconfig.server.json && node -e \"require('fs').chmodSync('dist/server/cli.js', 0o755)\"",

33 "build:runtime-manifest": "node scripts/generate-runtime-manifest.mjs",

34 "generate:pwa-assets": "pwa-assets-generator --config pwa-assets.config.ts",

35 "preview": "vite preview",

36 "start": "node dist/server/cli.js",

37 "lint": "tsc --noEmit",

38 "trace:diff": "node scripts/inspect-diff-trace.mjs",

39 "trace:fsio": "node scripts/inspect-fs-io.mjs",

40 "release:classify": "node scripts/classify-release.mjs",

41 "test": "vitest --passWithNoTests",

42 "test:ui": "vitest --ui",

43 "prepublishOnly": "npm run build",

44 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L44

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L44

45 },

46 "dependencies": {

47 "@dnd-kit/core": "^6.3.1",

48 "@dnd-kit/sortable": "^10.0.0",

49 "@dnd-kit/utilities": "^3.2.2",

50 "@hello-pangea/dnd": "^18.0.1",

51 "@types/cookie-parser": "^1.4.10",

52 "@types/csurf": "^1.11.5",

53 "@types/refractor": "^2.8.0",

54 "@use-gesture/react": "^10.3.1",

55 "@xterm/addon-clipboard": "^0.3.0-beta.287",

56 "@xterm/addon-fit": "^0.12.0-beta.287",

57 "@xterm/addon-image": "^0.10.0-beta.287",

58 "@xterm/addon-ligatures": "^0.11.0-beta.287",

59 "@xterm/addon-progress": "^0.3.0-beta.287",

60 "@xterm/addon-search": "^0.17.0-beta.287",

61 "@xterm/addon-serialize": "^0.15.0-beta.287",

62 "@xterm/addon-unicode11": "^0.10.0-beta.287",

63 "@xterm/addon-web-links": "^0.13.0-beta.287",

64 "@xterm/addon-webgl": "^0.20.0-beta.286",

dist/server/certificateWatcher.jsView file

Lines 1-21javascript

1import { EventEmitter } from 'events';

2import { execFile } from 'child_process';

3import { promisify } from 'util';

High

Child Process

Package source references child process execution.

dist/server/certificateWatcher.jsView on unpkg · L1

dist/server/utils/bootCheck.jsView file

Lines 30-70javascript

30 }

31 catch { /* not in PATH */ }

32 // macOS non-interactive SSH 的 PATH 不包含 Homebrew 路径，手动检查

33 const extraPaths = [

34 '/opt/homebrew/bin',

35 '/usr/local/bin'

dist/server/routes/terminal.jsView file

Lines 1-27javascript

1import express from 'express';

2import fs from 'fs';

3import os from 'os';

4import path from 'path';

dist/server/cli.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2// libuv 线程池默认只有 4 个线程，慢/挂起的异步 IO（fs.promises、crypto 等）

3// 会把池耗尽，表现为整个服务的 IO 全部卡死。必须在任何异步 fs 调用之前

4// 设置（同步 fs 不占线程池，所以放在文件体顶部仍然足够早）。

5process.env.UV_THREADPOOL_SIZE ||= '16';

6import { config as loadDotenv } from 'dotenv';

dist/server/agent/installers.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import fs from 'node:fs'; import os from 'node:os'; import path from 'node:path'; import { execfile, spawn } from 'node:child_process'; import { agentbyslug, ispluginagent } from './registry.js'; import { loadplugins, resolvehooktarget } from './plugins.js'; export const hook_agents = ['claude', 'codex', 'copilot', 'opencode', 'pi', 'grok', 'kimi']; const display_names = { claude: 'claude code', codex: 'codex', copilot: 'copilot cli', opencode: 'opencode', pi: 'pi', grok: 'grok build', kimi: 'kimi code', };

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/server/agent/installers.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = termdock@1.4.122 matchedPath = dist/server/agent/installers.js matchedIdentity = npm:dGVybWRvY2s:1.4.122 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/agent/installers.jsView on unpkg

dist/client/shell-integration/termdock.bashView file

•path = dist/client/shell-integration/termdock.bash kind = build_helper sizeBytes = 3514 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/client/shell-integration/termdock.bashView on unpkg

dist/server/utils/hunkApply.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/server/utils/hunkApply.js#virtual:normalized:round1View on unpkg

scripts/postinstall.mjsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.122 matchedPath = scripts/postinstall.mjs matchedIdentity = npm:dGVybWRvY2s:1.4.122 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.mjsView on unpkg

scripts/prepare-desktop-runtime.mjsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.122 matchedPath = scripts/prepare-desktop-runtime.mjs matchedIdentity = npm:dGVybWRvY2s:1.4.122 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/prepare-desktop-runtime.mjsView on unpkg

dist/server/agent/pluginPackages.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.122 matchedPath = [redacted].js matchedIdentity = npm:dGVybWRvY2s:1.4.122 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/agent/pluginPackages.jsView on unpkg

dist/server/utils/npmUpdate.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.122 matchedPath = dist/server/utils/npmUpdate.js matchedIdentity = npm:dGVybWRvY2s:1.4.122 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/utils/npmUpdate.jsView on unpkg

dist/server/agent/titleNamerCatalog.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/agent/titleNamerCatalog.jsView on unpkg

dist/server/ptyhost/manager.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.122 matchedPath = dist/server/ptyhost/manager.js matchedIdentity = npm:dGVybWRvY2s:1.4.122 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/ptyhost/manager.jsView on unpkg

dist/client/assets/index-Ca-rq7yX.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.122 matchedPath = dist/client/assets/index-Ca-rq7yX.js matchedIdentity = npm:dGVybWRvY2s:1.4.122 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/index-Ca-rq7yX.jsView on unpkg

dist/server/ptyHost.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.122 matchedPath = dist/server/ptyHost.js matchedIdentity = npm:dGVybWRvY2s:1.4.122 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/ptyHost.jsView on unpkg

dist/server/utils/gitStatus.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.122 matchedPath = dist/server/utils/gitStatus.js matchedIdentity = npm:dGVybWRvY2s:1.4.122 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/utils/gitStatus.jsView on unpkg

dist/client/assets/diagram-G47NLZAW-71ML-ld7.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.122 matchedPath = dist/client/assets/diagram-G47NLZAW-1Ifm4uV0.js matchedIdentity = npm:dGVybWRvY2s:1.4.122 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/diagram-G47NLZAW-71ML-ld7.jsView on unpkg

Source & flagged code

25 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/server/certificateWatcher.jsView file

1import { EventEmitter } from 'events'; L2: import { execFile } from 'child_process'; L3: import { promisify } from 'util';

High

Child Process

Package source references child process execution.

dist/server/certificateWatcher.jsView on unpkg · L1

dist/server/utils/bootCheck.jsView file

50const r = spawnSync(cmd, [], { L51: shell: true, L52: timeout: timeoutMs,

High

Shell

Package source references shell execution.

dist/server/utils/bootCheck.jsView on unpkg · L50

•matchType = normalized_sha256 matchedPackage = termdock@1.4.122 matchedPath = dist/server/utils/bootCheck.js matchedIdentity = npm:dGVybWRvY2s:1.4.122 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/utils/bootCheck.jsView on unpkg

dist/server/routes/terminal.jsView file

7Trigger-reachable persistence chain: manifest.exports -> dist/server/entry.js -> dist/server/routes/terminal.js L7: import QRCode from 'qrcode'; L8: import { execFile, spawn } from 'child_process'; L9: import { createHash, randomUUID } from 'crypto'; ... L50: const execFileAsync = promisify(execFile); L51: const TERMDOCK_DIR = `${os.homedir()}/.termdock`; L52: const automationStore = new AutomationStore(`${TERMDOCK_DIR}/automations.json`); ... L58: const raw = await fs.promises.readFile(filePath, 'utf-8'); L59: return JSON.parse(raw); L60: } ... L90: const require_ = createRequire(import.meta.url); L91: // dist/server/routes/terminal.js → ../../../package.json L92: const pkg = require_(path.join(__dirname || '', '..', '..', '..', 'package.json'));

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/server/routes/terminal.jsView on unpkg · L7

7import QRCode from 'qrcode'; L8: import { execFile, spawn } from 'child_process'; L9: import { createHash, randomUUID } from 'crypto'; ... L50: const execFileAsync = promisify(execFile); L51: const TERMDOCK_DIR = `${os.homedir()}/.termdock`; L52: const automationStore = new AutomationStore(`${TERMDOCK_DIR}/automations.json`); ... L58: const raw = await fs.promises.readFile(filePath, 'utf-8'); L59: return JSON.parse(raw); L60: } ... L90: const require_ = createRequire(import.meta.url); L91: // dist/server/routes/terminal.js → ../../../package.json L92: const pkg = require_(path.join(__dirname || '', '..', '..', '..', 'package.json'));

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/server/routes/terminal.jsView on unpkg · L7

dist/server/cli.jsView file

4// 设置（同步 fs 不占线程池，所以放在文件体顶部仍然足够早）。 L5: process.env.UV_THREADPOOL_SIZE ||= '16'; L6: import { config as loadDotenv } from 'dotenv'; ... L13: import fs from 'fs'; L14: import http from 'http'; L15: import https from 'https'; ... L18: import { createHash, randomUUID } from 'crypto'; L19: import { spawn, spawnSync, execFile } from 'child_process'; L20: import { promisify } from 'util';

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/server/cli.jsView on unpkg · L4

4// 设置（同步 fs 不占线程池，所以放在文件体顶部仍然足够早）。 L5: process.env.UV_THREADPOOL_SIZE ||= '16'; L6: import { config as loadDotenv } from 'dotenv'; ... L10: // dotenv 不会覆盖已存在的环境变量，因此系统环境变量和命令行参数优先级最高 L11: loadDotenv({ path: resolve(os.homedir(), '.termdock', '.env'), quiet: true }); L12: loadDotenv({ path: resolve(process.cwd(), '.env'), quiet: true }); L13: import fs from 'fs'; L14: import http from 'http'; L15: import https from 'https'; ... L18: import { createHash, randomUUID } from 'crypto'; L19: import { spawn, spawnSync, execFile } from 'child_process'; L20: import { promisify } from 'util';

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/server/cli.jsView on unpkg · L4

4Trigger-reachable chain: scripts.start -> dist/server/cli.js L4: // 设置（同步 fs 不占线程池，所以放在文件体顶部仍然足够早）。 L5: process.env.UV_THREADPOOL_SIZE ||= '16'; L6: import { config as loadDotenv } from 'dotenv'; ... L10: // dotenv 不会覆盖已存在的环境变量，因此系统环境变量和命令行参数优先级最高 L11: loadDotenv({ path: resolve(os.homedir(), '.termdock', '.env'), quiet: true }); L12: loadDotenv({ path: resolve(process.cwd(), '.env'), quiet: true }); L13: import fs from 'fs'; L14: import http from 'http'; L15: import https from 'https'; ... L18: import { createHash, randomUUID } from 'crypto'; L19: import { spawn, spawnSync, execFile } from 'child_process'; L20: import { promisify } from 'util';

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/server/cli.jsView on unpkg · L4

4Detached bundled service listener: dist/server/cli.js spawns dist/server/entry.js; helper exposes a broad-bound HTTP listener. L4: // 设置（同步 fs 不占线程池，所以放在文件体顶部仍然足够早）。 L5: process.env.UV_THREADPOOL_SIZE ||= '16'; L6: import { config as loadDotenv } from 'dotenv'; ... L10: // dotenv 不会覆盖已存在的环境变量，因此系统环境变量和命令行参数优先级最高 L11: loadDotenv({ path: resolve(os.homedir(), '.termdock', '.env'), quiet: true }); L12: loadDotenv({ path: resolve(process.cwd(), '.env'), quiet: true }); L13: import fs from 'fs'; L14: import http from 'http'; L15: import https from 'https'; ... L18: import { createHash, randomUUID } from 'crypto'; L19: import { spawn, spawnSync, execFile } from 'child_process'; L20: import { promisify } from 'util';

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/server/cli.jsView on unpkg · L4

dist/server/agent/installers.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/server/agent/installers.jsView on unpkg

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/agent/installers.jsView on unpkg

dist/client/shell-integration/termdock.bashView file

•path = dist/client/shell-integration/termdock.bash kind = build_helper sizeBytes = 3514 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/client/shell-integration/termdock.bashView on unpkg

dist/server/utils/hunkApply.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/server/utils/hunkApply.js#virtual:normalized:round1View on unpkg

scripts/postinstall.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.mjsView on unpkg

scripts/prepare-desktop-runtime.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/prepare-desktop-runtime.mjsView on unpkg

dist/server/agent/pluginPackages.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/agent/pluginPackages.jsView on unpkg

dist/server/utils/npmUpdate.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/utils/npmUpdate.jsView on unpkg

dist/server/agent/titleNamerCatalog.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/agent/titleNamerCatalog.jsView on unpkg

dist/server/ptyhost/manager.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/ptyhost/manager.jsView on unpkg

dist/client/assets/index-Ca-rq7yX.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/index-Ca-rq7yX.jsView on unpkg

dist/server/ptyHost.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/ptyHost.jsView on unpkg

dist/server/utils/gitStatus.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/utils/gitStatus.jsView on unpkg

dist/client/assets/diagram-G47NLZAW-71ML-ld7.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/diagram-G47NLZAW-71ML-ld7.jsView on unpkg

Findings

3 Critical19 High8 Medium7 Low

CriticalSame File Env Network Executiondist/server/cli.js

CriticalDownload Executedist/server/cli.js

CriticalTrigger Reachable Dangerous Capabilitydist/server/cli.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/server/certificateWatcher.js

HighShelldist/server/utils/bootCheck.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/server/agent/installers.js

HighSpawned Bundled Service Listenerdist/server/cli.js

HighTrigger Reachable Persistencedist/server/routes/terminal.js

HighSemantic Analysis Limiteddist/server/utils/hunkApply.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/server/utils/bootCheck.js

HighKnown Malware Source Similarityscripts/postinstall.mjs

HighKnown Malware Source Similarityscripts/prepare-desktop-runtime.mjs

HighKnown Malware Source Similaritydist/server/agent/pluginPackages.js

HighKnown Malware Source Similaritydist/server/utils/npmUpdate.js

HighKnown Malware Source Similaritydist/server/agent/installers.js

HighKnown Malware Source Similaritydist/server/agent/titleNamerCatalog.js

HighKnown Malware Source Similaritydist/server/ptyhost/manager.js

HighKnown Malware Source Similaritydist/client/assets/index-Ca-rq7yX.js

HighKnown Malware Source Similaritydist/server/ptyHost.js

HighKnown Malware Source Similaritydist/server/utils/gitStatus.js

HighKnown Malware Source Similaritydist/client/assets/diagram-G47NLZAW-71ML-ld7.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Require

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/server/routes/terminal.js

MediumProtestware

MediumShips Build Helperdist/client/shell-integration/termdock.bash

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings