registry / termdock / 1.4.153

termdock@1.4.153

A complete web-based terminal application with modern UI

AI Security Review

scanned 3h ago · by lpm-firewall-ai

npm installation automatically runs commands that can alter the operating system and request administrator privileges. The same automatic installation path also runs whenever the CLI starts without tmux.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the npm package, or launching its CLI when tmux is absent.

Impact

It can install software through the host package manager, invoke sudo, alter installed dependency files, and create user-home state without explicit user action.

Mechanism

Automatic system package installation and dependency rebuild through shell commands.

Attack narrative

On npm install, the manifest runs scripts/postinstall.mjs. If tmux is missing, it chooses a host package manager and attempts commands such as sudo apt-get install -y tmux. It also deletes node-pty prebuilds and invokes npx node-gyp rebuild. If installation did not complete the check, launching the CLI repeats the package-manager installation attempts. This is unconsented install-time and runtime modification of the host rather than ordinary package-local setup.

Rationale

This package automatically performs privileged host package installation and dependency mutation during lifecycle execution, then repeats the behavior at CLI startup. No exfiltration was confirmed, but the unconsented command execution is sufficient to block publication.

Evidence

package.jsonscripts/postinstall.mjsdist/server/utils/bootCheck.jsnode_modules/node-pty/prebuilds~/.termdock/.boot-check-ok

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

The manifest automatically runs a postinstall script during npm installation.
The postinstall script invokes system package managers, including privileged Linux commands, to install tmux.
The postinstall script deletes node-pty prebuilds and runs npx node-gyp rebuild.
The CLI repeats the automatic tmux installation attempt when launched.
The install script writes a user-home marker after its checks.

Evidence against

The inspected install and boot-check code contains no credential collection or data exfiltration.
The stated commands are tied to terminal dependencies, but they run without an explicit user command or consent.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 161 file(s), 6.88 MB of source, external domains: api.anthropic.com, api.github.com, api.kimi.com, api.openai.com, api.x.ai, bit.ly, brew.sh, chatgpt.com, chevrotain.io, en.wikipedia.org, generativelanguage.googleapis.com, github.com, jcgt.org, langium.org, nodejs.org, reactjs.org, registry.npmjs.org, www.w3.org

Oversized source lightweight scan

dist/client/assets/index-BiZD1WJ9.js2.01 MB file, sampled 256 KB

NetworkChildProcessWebSocketHighEntropyStringsMinifiedUrlStringsgithub.com

Source & flagged code

25 flagged

package.jsonView file

Lines 24-64json

24 "dev:client": "vite",

25 "dev:server": "cross-env PORT=9835 tsx watch src/server/entry.ts",

26 "build": "npm run clean && npm run build:client && npm run build:server && npm run build:runtime-manifest",

27 "build:desktop": "node scripts/prepare-desktop-tokens.mjs && tsc -p tsconfig.desktop.json && esbuild desktop/preload.cts --bundle --platform=node --format=cjs --external:electron --outfile=.desktop-dist/preload.cjs",

28 "desktop:dev": "npm run build && npm run build:desktop && electron-forge start",

29 "desktop:prepare": "npm run build && npm run build:desktop && node scripts/prepare-desktop-runtime.mjs",

30 "desktop:make": "node scripts/ensure-macos-appdmg.mjs && npm run desktop:prepare && electron-forge make",

31 "build:client": "vite build",

32 "build:server": "tsc -p tsconfig.server.json && node -e \"require('fs').chmodSync('dist/server/cli.js', 0o755)\"",

33 "build:runtime-manifest": "node scripts/generate-runtime-manifest.mjs",

34 "generate:pwa-assets": "pwa-assets-generator --config pwa-assets.config.ts",

35 "preview": "vite preview",

36 "start": "node dist/server/cli.js",

37 "lint": "tsc --noEmit",

38 "trace:diff": "node scripts/inspect-diff-trace.mjs",

39 "trace:fsio": "node scripts/inspect-fs-io.mjs",

40 "release:classify": "node scripts/classify-release.mjs",

41 "test": "vitest --passWithNoTests",

42 "test:ui": "vitest --ui",

43 "prepublishOnly": "npm run build",

44 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L44

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L44

45 },

46 "dependencies": {

47 "@dnd-kit/core": "^6.3.1",

48 "@dnd-kit/sortable": "^10.0.0",

49 "@dnd-kit/utilities": "^3.2.2",

50 "@hello-pangea/dnd": "^18.0.1",

51 "@types/cookie-parser": "^1.4.10",

52 "@types/csurf": "^1.11.5",

53 "@types/refractor": "^2.8.0",

54 "@use-gesture/react": "^10.3.1",

55 "@xterm/addon-clipboard": "^0.3.0-beta.287",

56 "@xterm/addon-fit": "^0.12.0-beta.287",

57 "@xterm/addon-image": "^0.10.0-beta.287",

58 "@xterm/addon-ligatures": "^0.11.0-beta.287",

59 "@xterm/addon-progress": "^0.3.0-beta.287",

60 "@xterm/addon-search": "^0.17.0-beta.287",

61 "@xterm/addon-serialize": "^0.15.0-beta.287",

62 "@xterm/addon-unicode11": "^0.10.0-beta.287",

63 "@xterm/addon-web-links": "^0.13.0-beta.287",

64 "@xterm/addon-webgl": "^0.20.0-beta.286",

dist/server/certificateWatcher.jsView file

Lines 1-21javascript

1import { EventEmitter } from 'events';

2import { execFile } from 'child_process';

3import { promisify } from 'util';

High

Child Process

Package source references child process execution.

dist/server/certificateWatcher.jsView on unpkg · L1

dist/server/utils/bootCheck.jsView file

Lines 30-70javascript

30 }

31 catch { /* not in PATH */ }

32 // macOS non-interactive SSH 的 PATH 不包含 Homebrew 路径，手动检查

33 const extraPaths = [

34 '/opt/homebrew/bin',

35 '/usr/local/bin'

dist/server/routes/terminal.jsView file

Lines 1-27javascript

1import express from 'express';

2import fs from 'fs';

3import os from 'os';

4import path from 'path';

dist/server/cli.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2// libuv 线程池默认只有 4 个线程，慢/挂起的异步 IO（fs.promises、crypto 等）

3// 会把池耗尽，表现为整个服务的 IO 全部卡死。必须在任何异步 fs 调用之前

4// 设置（同步 fs 不占线程池，所以放在文件体顶部仍然足够早）。

5process.env.UV_THREADPOOL_SIZE ||= '16';

6import { config as loadDotenv } from 'dotenv';

dist/server/agent/installers.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import fs from 'node:fs'; import os from 'node:os'; import path from 'node:path'; import { execfile, spawn } from 'node:child_process'; import { agentbyslug, ispluginagent } from './registry.js'; import { loadplugins, resolvehooktarget } from './plugins.js'; export const hook_agents = ['claude', 'codex', 'copilot', 'opencode', 'pi', 'grok', 'kimi']; const display_names = { claude: 'claude code', codex: 'codex', copilot: 'copilot cli', opencode: 'opencode', pi: 'pi', grok: 'grok build', kimi: 'kimi code', };

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/server/agent/installers.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = termdock@1.4.152 matchedPath = dist/server/agent/installers.js matchedIdentity = npm:dGVybWRvY2s:1.4.152 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/agent/installers.jsView on unpkg

dist/client/shell-integration/termdock.bashView file

•path = dist/client/shell-integration/termdock.bash kind = build_helper sizeBytes = 3514 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/client/shell-integration/termdock.bashView on unpkg

dist/server/utils/hunkApply.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/server/utils/hunkApply.js#virtual:normalized:round1View on unpkg

scripts/postinstall.mjsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.152 matchedPath = scripts/postinstall.mjs matchedIdentity = npm:dGVybWRvY2s:1.4.152 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.mjsView on unpkg

scripts/prepare-desktop-runtime.mjsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.152 matchedPath = scripts/prepare-desktop-runtime.mjs matchedIdentity = npm:dGVybWRvY2s:1.4.152 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/prepare-desktop-runtime.mjsView on unpkg

.desktop-dist/main.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.152 matchedPath = .desktop-dist/main.js matchedIdentity = npm:dGVybWRvY2s:1.4.152 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

.desktop-dist/main.jsView on unpkg

dist/server/agent/pluginPackages.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.152 matchedPath = [redacted].js matchedIdentity = npm:dGVybWRvY2s:1.4.152 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/agent/pluginPackages.jsView on unpkg

dist/server/utils/npmUpdate.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.152 matchedPath = dist/server/utils/npmUpdate.js matchedIdentity = npm:dGVybWRvY2s:1.4.152 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/utils/npmUpdate.jsView on unpkg

dist/server/agent/titleNamerCatalog.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/agent/titleNamerCatalog.jsView on unpkg

dist/server/ptyhost/manager.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.152 matchedPath = dist/server/ptyhost/manager.js matchedIdentity = npm:dGVybWRvY2s:1.4.152 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/ptyhost/manager.jsView on unpkg

dist/client/assets/index-Ca-rq7yX.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.152 matchedPath = dist/client/assets/index-Ca-rq7yX.js matchedIdentity = npm:dGVybWRvY2s:1.4.152 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/index-Ca-rq7yX.jsView on unpkg

Source & flagged code

25 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/server/certificateWatcher.jsView file

1import { EventEmitter } from 'events'; L2: import { execFile } from 'child_process'; L3: import { promisify } from 'util';

High

Child Process

Package source references child process execution.

dist/server/certificateWatcher.jsView on unpkg · L1

dist/server/utils/bootCheck.jsView file

50const r = spawnSync(cmd, [], { L51: shell: true, L52: timeout: timeoutMs,

High

Shell

Package source references shell execution.

dist/server/utils/bootCheck.jsView on unpkg · L50

•matchType = normalized_sha256 matchedPackage = termdock@1.4.152 matchedPath = dist/server/utils/bootCheck.js matchedIdentity = npm:dGVybWRvY2s:1.4.152 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/utils/bootCheck.jsView on unpkg

dist/server/routes/terminal.jsView file

7Trigger-reachable persistence chain: manifest.exports -> dist/server/entry.js -> dist/server/routes/terminal.js L7: import QRCode from 'qrcode'; L8: import { execFile, spawn } from 'child_process'; L9: import { createHash, randomUUID } from 'crypto'; ... L50: const execFileAsync = promisify(execFile); L51: const TERMDOCK_DIR = `${os.homedir()}/.termdock`; L52: const automationStore = new AutomationStore(`${TERMDOCK_DIR}/automations.json`); ... L58: const raw = await fs.promises.readFile(filePath, 'utf-8'); L59: return JSON.parse(raw); L60: } ... L90: const require_ = createRequire(import.meta.url); L91: // dist/server/routes/terminal.js → ../../../package.json L92: const pkg = require_(path.join(__dirname || '', '..', '..', '..', 'package.json'));

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/server/routes/terminal.jsView on unpkg · L7

•matchType = normalized_sha256 matchedPackage = termdock@1.4.152 matchedPath = dist/server/routes/terminal.js matchedIdentity = npm:dGVybWRvY2s:1.4.152 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/routes/terminal.jsView on unpkg

7import QRCode from 'qrcode'; L8: import { execFile, spawn } from 'child_process'; L9: import { createHash, randomUUID } from 'crypto'; ... L50: const execFileAsync = promisify(execFile); L51: const TERMDOCK_DIR = `${os.homedir()}/.termdock`; L52: const automationStore = new AutomationStore(`${TERMDOCK_DIR}/automations.json`); ... L58: const raw = await fs.promises.readFile(filePath, 'utf-8'); L59: return JSON.parse(raw); L60: } ... L90: const require_ = createRequire(import.meta.url); L91: // dist/server/routes/terminal.js → ../../../package.json L92: const pkg = require_(path.join(__dirname || '', '..', '..', '..', 'package.json'));

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/server/routes/terminal.jsView on unpkg · L7

dist/server/cli.jsView file

4// 设置（同步 fs 不占线程池，所以放在文件体顶部仍然足够早）。 L5: process.env.UV_THREADPOOL_SIZE ||= '16'; L6: import { config as loadDotenv } from 'dotenv'; ... L13: import fs from 'fs'; L14: import http from 'http'; L15: import https from 'https'; ... L18: import { createHash, randomUUID } from 'crypto'; L19: import { spawn, spawnSync, execFile } from 'child_process'; L20: import { promisify } from 'util';

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/server/cli.jsView on unpkg · L4

4// 设置（同步 fs 不占线程池，所以放在文件体顶部仍然足够早）。 L5: process.env.UV_THREADPOOL_SIZE ||= '16'; L6: import { config as loadDotenv } from 'dotenv'; ... L10: // dotenv 不会覆盖已存在的环境变量，因此系统环境变量和命令行参数优先级最高 L11: loadDotenv({ path: resolve(os.homedir(), '.termdock', '.env'), quiet: true }); L12: loadDotenv({ path: resolve(process.cwd(), '.env'), quiet: true }); L13: import fs from 'fs'; L14: import http from 'http'; L15: import https from 'https'; ... L18: import { createHash, randomUUID } from 'crypto'; L19: import { spawn, spawnSync, execFile } from 'child_process'; L20: import { promisify } from 'util';

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/server/cli.jsView on unpkg · L4

4Trigger-reachable chain: scripts.start -> dist/server/cli.js L4: // 设置（同步 fs 不占线程池，所以放在文件体顶部仍然足够早）。 L5: process.env.UV_THREADPOOL_SIZE ||= '16'; L6: import { config as loadDotenv } from 'dotenv'; ... L10: // dotenv 不会覆盖已存在的环境变量，因此系统环境变量和命令行参数优先级最高 L11: loadDotenv({ path: resolve(os.homedir(), '.termdock', '.env'), quiet: true }); L12: loadDotenv({ path: resolve(process.cwd(), '.env'), quiet: true }); L13: import fs from 'fs'; L14: import http from 'http'; L15: import https from 'https'; ... L18: import { createHash, randomUUID } from 'crypto'; L19: import { spawn, spawnSync, execFile } from 'child_process'; L20: import { promisify } from 'util';

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/server/cli.jsView on unpkg · L4

4Detached bundled service listener: dist/server/cli.js spawns dist/server/entry.js; helper exposes a broad-bound HTTP listener. L4: // 设置（同步 fs 不占线程池，所以放在文件体顶部仍然足够早）。 L5: process.env.UV_THREADPOOL_SIZE ||= '16'; L6: import { config as loadDotenv } from 'dotenv'; ... L10: // dotenv 不会覆盖已存在的环境变量，因此系统环境变量和命令行参数优先级最高 L11: loadDotenv({ path: resolve(os.homedir(), '.termdock', '.env'), quiet: true }); L12: loadDotenv({ path: resolve(process.cwd(), '.env'), quiet: true }); L13: import fs from 'fs'; L14: import http from 'http'; L15: import https from 'https'; ... L18: import { createHash, randomUUID } from 'crypto'; L19: import { spawn, spawnSync, execFile } from 'child_process'; L20: import { promisify } from 'util';

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/server/cli.jsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = termdock@1.4.152 matchedPath = dist/server/cli.js matchedIdentity = npm:dGVybWRvY2s:1.4.152 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/cli.jsView on unpkg

dist/server/agent/installers.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/server/agent/installers.jsView on unpkg

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/agent/installers.jsView on unpkg

dist/client/shell-integration/termdock.bashView file

•path = dist/client/shell-integration/termdock.bash kind = build_helper sizeBytes = 3514 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/client/shell-integration/termdock.bashView on unpkg

dist/server/utils/hunkApply.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/server/utils/hunkApply.js#virtual:normalized:round1View on unpkg

scripts/postinstall.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.mjsView on unpkg

scripts/prepare-desktop-runtime.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/prepare-desktop-runtime.mjsView on unpkg

.desktop-dist/main.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

.desktop-dist/main.jsView on unpkg

dist/server/agent/pluginPackages.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/agent/pluginPackages.jsView on unpkg

dist/server/utils/npmUpdate.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/utils/npmUpdate.jsView on unpkg

dist/server/agent/titleNamerCatalog.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/agent/titleNamerCatalog.jsView on unpkg

dist/server/ptyhost/manager.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/ptyhost/manager.jsView on unpkg

dist/client/assets/index-Ca-rq7yX.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/index-Ca-rq7yX.jsView on unpkg

Findings

3 Critical19 High8 Medium7 Low

CriticalSame File Env Network Executiondist/server/cli.js

CriticalDownload Executedist/server/cli.js

CriticalTrigger Reachable Dangerous Capabilitydist/server/cli.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/server/certificateWatcher.js

HighShelldist/server/utils/bootCheck.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/server/agent/installers.js

HighSpawned Bundled Service Listenerdist/server/cli.js

HighTrigger Reachable Persistencedist/server/routes/terminal.js

HighSemantic Analysis Limiteddist/server/utils/hunkApply.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/server/cli.js

HighKnown Malware Source Similaritydist/server/utils/bootCheck.js

HighKnown Malware Source Similarityscripts/postinstall.mjs

HighKnown Malware Source Similaritydist/server/routes/terminal.js

HighKnown Malware Source Similarityscripts/prepare-desktop-runtime.mjs

HighKnown Malware Source Similarity.desktop-dist/main.js

HighKnown Malware Source Similaritydist/server/agent/pluginPackages.js

HighKnown Malware Source Similaritydist/server/utils/npmUpdate.js

HighKnown Malware Source Similaritydist/server/agent/installers.js

HighKnown Malware Source Similaritydist/server/agent/titleNamerCatalog.js

HighKnown Malware Source Similaritydist/server/ptyhost/manager.js

HighKnown Malware Source Similaritydist/client/assets/index-Ca-rq7yX.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Require

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/server/routes/terminal.js

MediumProtestware

MediumShips Build Helperdist/client/shell-integration/termdock.bash

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings