termdock@1.4.201
A complete web-based terminal application with modern UI
AI Security Review
scanned 1mo ago · by lpm-firewall-aiSource inspection confirms intrusive automatic lifecycle actions and cross-tool credential collection, but no attacker endpoint, payload loader, self-dependency chain, or unconsented install-time AI-agent control-surface mutation was found. The concrete risks warrant warning rather than a malware block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
npm installation, then normal Termdock CLI or server startup.
Impact
System packages may be installed or native dependencies rebuilt; credentials from other agent tools are used automatically for network requests.
Mechanism
Lifecycle-driven system package installation and automatic credential-backed quota polling.
AI rationale
Source inspection confirms intrusive automatic lifecycle actions and cross-tool credential collection, but no attacker endpoint, payload loader, self-dependency chain, or unconsented install-time AI-agent control-surface mutation was found. The concrete risks warrant warning rather than a malware block.
Evidence
package.jsonscripts/postinstall.mjsdist/server/utils/bootCheck.jsdist/server/quota/tokenDiscovery.jsdist/server/quota/QuotaManager.jsdist/server/quota/providers/codex.js~/.termdock/.boot-check-ok~/.codex/auth.json~/.claude/settings.json~/.local/share/opencode/auth.json~/.termdock/quota-cache.json
Network endpoints7
chatgpt.comapi.openai.comapi.anthropic.comapi.github.comapi.kimi.comapi.x.aigenerativelanguage.googleapis.com
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Installation automatically runs a postinstall script.
- That script attempts privileged system package-manager commands to install tmux.
- Normal CLI startup repeats dependency checks and can rebuild native code or install tmux.
- Runtime code reads OAuth tokens from other agent configuration files and environment variables.
- A quota manager starts automatically and uses discovered tokens in authenticated provider requests.
Evidence against
- The observed token requests target the corresponding official provider APIs, not an attacker-controlled host.
- Agent-hook changes are exposed through explicit local HTTP install routes.
- No self-dependency, obfuscated payload, remote code loader, or non-provider credential destination was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationProtestwareTelemetryUrlStrings
Source & flagged code
32 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/server/certificateWatcher.jsView file
1import { EventEmitter } from 'events';
L2: import { execFile } from 'child_process';
L3: import { promisify } from 'util';
High
Child Process
Package source references child process execution.
dist/server/certificateWatcher.jsView on unpkg · L1dist/server/utils/bootCheck.jsView file
51const r = spawnSync(cmd, [], {
L52: shell: true,
L53: timeout: timeoutMs,
High
•matchType = normalized_sha256
matchedPackage = termdock@1.4.200
matchedPath = dist/server/utils/bootCheck.js
matchedIdentity = npm:dGVybWRvY2s:1.4.200
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/server/utils/bootCheck.jsView on unpkgdist/client/assets/passwordBootstrap-GQ1duPan.jsView file
1import{m as JA,w as oA,n as y,aT as EA,aH as cA,D as z,a0 as hA,bY as DA,p as GA,b_ as AA,bx as G,bS as wA,s as aA,aG as ZA}from"./app-4x1wiaTA.js";import"./react-XDCjal2T.js";impo...
L2: ${g.stack}`:Q}function iA(g,A){return g=g>>>0,u().subarray(g/1,g/1+A)}let K=null;function l(){return(K===null||K.buffer.detached===!0||K.buffer.detached===void 0&&K.buffer!==k.memo...
High
Eval
Package source references dynamic code evaluation.
dist/client/assets/passwordBootstrap-GQ1duPan.jsView on unpkg · L1dist/server/utils/ensureNodePty.jsView file
2// Both src/server/utils and dist/server/utils resolve to the shipped scripts.
L3: const require = createRequire(import.meta.url);
L4: export function ensureNodePty() {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/server/utils/ensureNodePty.jsView on unpkg · L2dist/server/routes/terminal.jsView file
14Trigger-reachable persistence chain: manifest.exports -> dist/server/entry.js -> dist/server/routes/terminal.js
L14: import QRCode from 'qrcode';
L15: import { execFile, spawn } from 'child_process';
L16: import { createHash, randomBytes, randomUUID } from 'crypto';
...
L67: const execFileAsync = promisify(execFile);
L68: const TERMDOCK_DIR = `${os.homedir()}/.termdock`;
L69: const automationStore = new AutomationStore(`${TERMDOCK_DIR}/automations.json`);
...
L83: const raw = await fs.promises.readFile(filePath, 'utf-8');
L84: return JSON.parse(raw);
L85: }
...
L115: const require_ = createRequire(import.meta.url);
L116: // dist/server/routes/terminal.js → ../../../package.json
L117: const pkg = require_(path.join(__dirname || '', '..', '..', '..', 'package.json'));
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/server/routes/terminal.jsView on unpkg · L14•matchType = normalized_sha256
matchedPackage = termdock@1.4.200
matchedPath = dist/server/routes/terminal.js
matchedIdentity = npm:dGVybWRvY2s:1.4.200
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/server/routes/terminal.jsView on unpkg14import QRCode from 'qrcode';
L15: import { execFile, spawn } from 'child_process';
L16: import { createHash, randomBytes, randomUUID } from 'crypto';
...
L67: const execFileAsync = promisify(execFile);
L68: const TERMDOCK_DIR = `${os.homedir()}/.termdock`;
L69: const automationStore = new AutomationStore(`${TERMDOCK_DIR}/automations.json`);
...
L83: const raw = await fs.promises.readFile(filePath, 'utf-8');
L84: return JSON.parse(raw);
L85: }
...
L115: const require_ = createRequire(import.meta.url);
L116: // dist/server/routes/terminal.js → ../../../package.json
L117: const pkg = require_(path.join(__dirname || '', '..', '..', '..', 'package.json'));
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/server/routes/terminal.jsView on unpkg · L14dist/server/cli.jsView file
4// 设置（同步 fs 不占线程池，所以放在文件体顶部仍然足够早）。
L5: process.env.UV_THREADPOOL_SIZE ||= '16';
L6: import { config as loadDotenv } from 'dotenv';
...
L10: // dotenv 不会覆盖已存在的环境变量，因此系统环境变量和命令行参数优先级最高
L11: loadDotenv({ path: resolve(os.homedir(), '.termdock', '.env'), quiet: true });
L12: loadDotenv({ path: resolve(process.cwd(), '.env'), quiet: true });
...
L19: import fs from 'fs';
L20: import http from 'http';
L21: import https from 'https';
...
L24: import { createHash, randomUUID } from 'crypto';
L25: import { spawn, spawnSync, execFile } from 'child_process';
L26: import { promisify } from 'util';
Critical
Download Execute
Source downloads or fetches remote code and executes it.
dist/server/cli.jsView on unpkg · L44Trigger-reachable chain: scripts.start -> dist/server/cli.js
L4: // 设置（同步 fs 不占线程池，所以放在文件体顶部仍然足够早）。
L5: process.env.UV_THREADPOOL_SIZE ||= '16';
L6: import { config as loadDotenv } from 'dotenv';
...
L10: // dotenv 不会覆盖已存在的环境变量，因此系统环境变量和命令行参数优先级最高
L11: loadDotenv({ path: resolve(os.homedir(), '.termdock', '.env'), quiet: true });
L12: loadDotenv({ path: resolve(process.cwd(), '.env'), quiet: true });
...
L19: import fs from 'fs';
L20: import http from 'http';
L21: import https from 'https';
...
L24: import { createHash, randomUUID } from 'crypto';
L25: import { spawn, spawnSync, execFile } from 'child_process';
L26: import { promisify } from 'util';
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/server/cli.jsView on unpkg · L44Detached bundled service listener: dist/server/cli.js spawns dist/server/entry.js; helper exposes a broad-bound HTTP listener.
L4: // 设置（同步 fs 不占线程池，所以放在文件体顶部仍然足够早）。
L5: process.env.UV_THREADPOOL_SIZE ||= '16';
L6: import { config as loadDotenv } from 'dotenv';
...
L10: // dotenv 不会覆盖已存在的环境变量，因此系统环境变量和命令行参数优先级最高
L11: loadDotenv({ path: resolve(os.homedir(), '.termdock', '.env'), quiet: true });
L12: loadDotenv({ path: resolve(process.cwd(), '.env'), quiet: true });
...
L19: import fs from 'fs';
L20: import http from 'http';
L21: import https from 'https';
...
L24: import { createHash, randomUUID } from 'crypto';
L25: import { spawn, spawnSync, execFile } from 'child_process';
L26: import { promisify } from 'util';
High
Spawned Bundled Service Listener
Source launches a detached bundled service that exposes a broad-bound HTTP listener.
dist/server/cli.jsView on unpkg · L4•matchType = normalized_sha256
matchedPackage = termdock@1.4.200
matchedPath = dist/server/cli.js
matchedIdentity = npm:dGVybWRvY2s:1.4.200
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/server/cli.jsView on unpkgscripts/postinstall.mjsView file
10L11: import { execSync, spawnSync } from 'child_process';
L12: import { createRequire } from 'module';
...
L31: const r = spawnSync(cmd, [], { shell: true, timeout: timeoutMs, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
L32: return { ok: r.status === 0, stdout: r.stdout, stderr: r.stderr };
L33: } catch {
...
L51: const { ensureNodePty } = require_('./ensure-node-pty.cjs');
L52: const PTY_PATH = require_.resolve('node-pty/package.json', { paths: [pkgRoot] }).replace('/package.json', '');
L53:
...
L83: const pty = require_(PTY_PATH);
L84: const proc = pty.spawn(process.env.SHELL || '/bin/bash', [], { name: 'xterm', cols: 80, rows: 24 });
L85: proc.kill();
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
scripts/postinstall.mjsView on unpkg · L10•matchType = normalized_sha256
matchedPackage = termdock@1.4.200
matchedPath = scripts/postinstall.mjs
matchedIdentity = npm:dGVybWRvY2s:1.4.200
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/postinstall.mjsView on unpkgdist/server/agent/installers.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
import fs from 'node:fs';
import os from 'node:os';
import path from 'node:path';
import { execfile, spawn } from 'node:child_process';
import { agentbyslug, ispluginagent } from './registry.js';
import { loadplugins, resolvehooktarget } from './plugins.js';
export const hook_agents = ['claude', 'codex', 'copilot', 'opencode', 'pi', 'grok', 'kimi'];
const display_names = {
claude: 'claude code',
codex: 'codex',
copilot: 'copilot cli',
opencode: 'opencode',
pi: 'pi',
grok: 'grok build',
kimi: 'kimi code',
};
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/server/agent/installers.jsView on unpkg•matchType = normalized_sha256
matchedPackage = termdock@1.4.200
matchedPath = dist/server/agent/installers.js
matchedIdentity = npm:dGVybWRvY2s:1.4.200
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/server/agent/installers.jsView on unpkgdist/client/assets/terminal-C7X98Amf.jsView file
4contains invisible/control Unicode U+200E (left-to-right mark)
`)})),this._register(this._bufferService.onResize(()=>this.queueSync())),this._register(this._bufferService.buffers.onBufferActivate(()=>{this._latestYDisp=void 0,this.queueSync()})),this._register(this._bufferService.onScroll(()=>this._syn
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/client/assets/terminal-C7X98Amf.jsView on unpkg · L4scripts/ensure-node-pty.cjsView file
15source = source.replace(' int stat_loc;', ' int stat_loc = 0;');
L16: source = source.replace(' }\n#else\n while (true)', ' }\n if (kq >= 0) close(kq);\n#else\n while (true)');
L17: source = source.replace('throw Napi::Error::New(napiEnv, "posix_spawnp failed.");',
Critical
Protestware
Package source matches protestware-related patterns.
scripts/ensure-node-pty.cjsView on unpkg · L1551console.log('Rebuilding node-pty with the Termdock macOS FD cleanup fix...');
L52: const result = spawnSync('npx', ['--yes', 'node-gyp', 'rebuild'], {
L53: cwd: ptyRoot, stdio: 'inherit', timeout: 180_000,
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
scripts/ensure-node-pty.cjsView on unpkg · L51dist/client/shell-integration/termdock.bashView file
•path = dist/client/shell-integration/termdock.bash
kind = build_helper
sizeBytes = 3514
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
dist/client/shell-integration/termdock.bashView on unpkgdist/client/sw-encrypted-background.js.brView file
•path = dist/client/sw-encrypted-background.js.br
kind = high_entropy_blob
sizeBytes = 64490
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
dist/client/sw-encrypted-background.js.brView on unpkg•path = dist/client/sw-encrypted-background.js.br
kind = compressed_blob
sizeBytes = 64490
magicHex = [redacted]
Medium
Ships Compressed Blob
Package ships compressed or archive-like blobs.
dist/client/sw-encrypted-background.js.brView on unpkgdist/client/assets/chunk-TICWLB2K-rZ5OsWBg.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/client/assets/chunk-TICWLB2K-rZ5OsWBg.js#virtual:normalized:round1View on unpkgscripts/prepare-desktop-runtime.mjsView file
•matchType = normalized_sha256
matchedPackage = termdock@1.4.200
matchedPath = scripts/prepare-desktop-runtime.mjs
matchedIdentity = npm:dGVybWRvY2s:1.4.200
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/prepare-desktop-runtime.mjsView on unpkg.desktop-dist/main.jsView file
•matchType = normalized_sha256
matchedPackage = termdock@1.4.200
matchedPath = .desktop-dist/main.js
matchedIdentity = npm:dGVybWRvY2s:1.4.200
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
.desktop-dist/main.jsView on unpkgdist/server/agent/pluginPackages.jsView file
•matchType = normalized_sha256
matchedPackage = termdock@1.4.200
matchedPath = [redacted].js
matchedIdentity = npm:dGVybWRvY2s:1.4.200
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/server/agent/pluginPackages.jsView on unpkgdist/server/utils/npmUpdate.jsView file
•matchType = normalized_sha256
matchedPackage = termdock@1.4.200
matchedPath = dist/server/utils/npmUpdate.js
matchedIdentity = npm:dGVybWRvY2s:1.4.200
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/server/utils/npmUpdate.jsView on unpkgdist/client/assets/DiffViewer-Dewe1_Hs.jsView file
•matchType = normalized_sha256
matchedPackage = termdock@1.4.200
matchedPath = dist/client/assets/DiffViewer-DyC8uspo.js
matchedIdentity = npm:dGVybWRvY2s:1.4.200
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/client/assets/DiffViewer-Dewe1_Hs.jsView on unpkgdist/server/agent/titleNamerCatalog.jsView file
•matchType = normalized_sha256
matchedPackage = termdock@1.4.200
matchedPath = [redacted].js
matchedIdentity = npm:dGVybWRvY2s:1.4.200
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/server/agent/titleNamerCatalog.jsView on unpkgdist/server/ptyhost/manager.jsView file
•matchType = normalized_sha256
matchedPackage = termdock@1.4.200
matchedPath = dist/server/ptyhost/manager.js
matchedIdentity = npm:dGVybWRvY2s:1.4.200
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/server/ptyhost/manager.jsView on unpkgFindings
4 Critical23 High8 Medium6 Low
CriticalDownload Executedist/server/cli.js
CriticalTrojan Source Unicodedist/client/assets/terminal-C7X98Amf.js
CriticalTrigger Reachable Dangerous Capabilitydist/server/cli.js
CriticalProtestwarescripts/ensure-node-pty.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/server/certificateWatcher.js
HighShelldist/server/utils/bootCheck.js
HighEvaldist/client/assets/passwordBootstrap-GQ1duPan.js
HighSandbox Evasion Gated Capabilityscripts/postinstall.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/server/agent/installers.js
HighSpawned Bundled Service Listenerdist/server/cli.js
HighTrigger Reachable Persistencedist/server/routes/terminal.js
HighRuntime Package Installscripts/ensure-node-pty.cjs
HighShips High Entropy Blobdist/client/sw-encrypted-background.js.br
HighSemantic Analysis Limiteddist/client/assets/chunk-TICWLB2K-rZ5OsWBg.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/server/cli.js
HighKnown Malware Source Similaritydist/server/utils/bootCheck.js
HighKnown Malware Source Similarityscripts/postinstall.mjs
HighKnown Malware Source Similaritydist/server/routes/terminal.js
HighKnown Malware Source Similarityscripts/prepare-desktop-runtime.mjs
HighKnown Malware Source Similarity.desktop-dist/main.js
HighKnown Malware Source Similaritydist/server/agent/pluginPackages.js
HighKnown Malware Source Similaritydist/server/utils/npmUpdate.js
HighKnown Malware Source Similaritydist/client/assets/DiffViewer-Dewe1_Hs.js
HighKnown Malware Source Similaritydist/server/agent/installers.js
HighKnown Malware Source Similaritydist/server/agent/titleNamerCatalog.js
HighKnown Malware Source Similaritydist/server/ptyhost/manager.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/server/utils/ensureNodePty.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/server/routes/terminal.js
MediumShips Build Helperdist/client/shell-integration/termdock.bash
MediumShips Compressed Blobdist/client/sw-encrypted-background.js.br
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to termdock@1.4.201.
See all versions of termdock for other recorded verdicts.
- Review the evidence and your use of termdock@1.4.201 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.