termdock@1.4.222: Malicious npm security report (Block)

Loading npm security reports…

termdock@1.4.222: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

30 flagged

package.jsonView file

Lines 24-64json

24 "dev:client": "vite",

25 "dev:server": "cross-env PORT=9835 tsx watch src/server/entry.ts",

26 "build": "npm run clean && npm run build:client && npm run build:server && npm run build:runtime-manifest",

27 "build:desktop": "node scripts/prepare-desktop-tokens.mjs && tsc -p tsconfig.desktop.json && esbuild desktop/preload.cts --bundle --platform=node --format=cjs --external:electron --outfile=.desktop-dist/preload.cjs && esbuild desktop/renderer/services.tsx --bundle --platform=browser --format=iife --minify --outfile=desktop/renderer/services.js",

28 "desktop:dev": "npm run build && npm run build:desktop && electron-forge start",

29 "desktop:prepare": "npm run build && npm run build:desktop && node scripts/prepare-desktop-runtime.mjs",

30 "desktop:make": "node scripts/ensure-macos-appdmg.mjs && npm run desktop:prepare && electron-forge make",

31 "build:client": "vite build && node scripts/precompress-client.mjs",

32 "build:server": "tsc -p tsconfig.server.json && node -e \"require('fs').chmodSync('dist/server/cli.js', 0o755)\"",

33 "build:runtime-manifest": "node scripts/generate-runtime-manifest.mjs",

34 "generate:pwa-assets": "pwa-assets-generator --config pwa-assets.config.ts",

35 "preview": "vite preview",

36 "start": "node dist/server/cli.js",

37 "lint": "tsc --noEmit",

38 "trace:diff": "node scripts/inspect-diff-trace.mjs",

39 "trace:fsio": "node scripts/inspect-fs-io.mjs",

40 "release:classify": "node scripts/classify-release.mjs",

41 "test": "vitest --passWithNoTests",

42 "test:ui": "vitest --ui",

43 "prepublishOnly": "npm run build",

44 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L44

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L44

45 },

46 "dependencies": {

47 "@chainsafe/libp2p-noise": "17.0.0",

48 "@dnd-kit/core": "^6.3.1",

49 "@dnd-kit/sortable": "^10.0.0",

50 "@dnd-kit/utilities": "^3.2.2",

51 "@hello-pangea/dnd": "^18.0.1",

52 "@libp2p/crypto": "5.1.9",

53 "@libp2p/interface": "3.1.0",

54 "@libp2p/peer-id": "6.0.0",

55 "@libp2p/utils": "7.0.7",

56 "@noble/hashes": "2.4.0",

57 "@serenity-kit/opaque": "1.1.0",

58 "@types/cookie-parser": "^1.4.10",

59 "@types/csurf": "^1.11.5",

60 "@types/refractor": "^2.8.0",

61 "@use-gesture/react": "^10.3.1",

62 "@xterm/addon-clipboard": "^0.3.0-beta.287",

63 "@xterm/addon-fit": "^0.12.0-beta.287",

64 "@xterm/addon-image": "^0.10.0-beta.287",

dist/server/certificateWatcher.jsView file

Lines 1-21javascript

1import { EventEmitter } from 'events';

2import { execFile } from 'child_process';

3import { promisify } from 'util';

High

Child Process

Package source references child process execution.

dist/server/certificateWatcher.jsView on unpkg · L1

dist/server/utils/bootCheck.jsView file

Lines 31-71javascript

31 }

32 catch { /* not in PATH */ }

33 // macOS non-interactive SSH 的 PATH 不包含 Homebrew 路径，手动检查

34 const extraPaths = [

35 '/opt/homebrew/bin',

36 '/usr/local/bin'

dist/client/assets/passwordBootstrap-CL6A4jgo.jsView file

Lines 1-3javascript

1import{o as JA,y as NA,p as y,aW as EA,aK as cA,G as z,a2 as hA,c1 as DA,r as GA,c3 as AA,bC as G,bX as wA,u as aA,aJ

dist/server/routes/terminal.jsView file

Lines 1-34javascript

1import { ensureNodePty } from '../utils/ensureNodePty.js';

2import { PtySpawnBackoff, PtySpawnDeferredError } from '../utils/ptySpawnBackoff.js';

3import { collaborationGroupRoutes } from '../agent/collaborationGroupRoutes.js';

4import { TerminalClientAttachment } from '../utils/terminalClientAttachment.js'

dist/server/cli.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2// libuv 线程池默认只有 4 个线程，慢/挂起的异步 IO（fs.promises、crypto 等）

3// 会把池耗尽，表现为整个服务的 IO 全部卡死。必须在任何异步 fs 调用之前

4// 设置（同步 fs 不占线程池，所以放在文件体顶部仍然足够早）。

5process.env.UV_THREADPOOL_SIZE ||= '16';

6import { config as loadDotenv } from 'dotenv';

scripts/postinstall.mjsView file

Lines 1-30javascript

1#!/usr/bin/env node

3/**

4 * Termdock postinstall — 确保原生模块可用 + 自动安装 tmux

5 *

6 * 对于 npm 全局安装 (npm i -g termdock) 的场景，npm 10+ 默认不运行

7 * lifecycle scripts。此时 postinstall 不会执行，但 cli.ts 启动时的

8 * bootCheck 会做同样的检查并写入 marker，确保首次启动时一切就绪。

9 */

11import { execSync, spawnSync } from

dist/server/agent/installers.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import fs from 'node:fs'; import os from 'node:os'; import path from 'node:path'; import { execfile, spawn } from 'node:child_process'; import { agentbyslug, ispluginagent } from './registry.js'; import { loadplugins, resolvehooktarget } from './plugins.js'; export const hook_agents = ['claude', 'codex', 'copilot', 'opencode', 'pi', 'grok', 'kimi']; const display_names = { claude: 'claude code', codex: 'codex', copilot: 'copilot cli', opencode: 'opencode', pi: 'pi', grok: 'grok build', kimi: 'kimi code', };

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/server/agent/installers.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = termdock@1.4.220 matchedPath = dist/server/agent/installers.js matchedIdentity = npm:dGVybWRvY2s:1.4.220 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/agent/installers.jsView on unpkg

dist/client/assets/terminal-C7X98Amf.jsView file

4contains invisible/control Unicode U+200E (left-to-right mark) `)})),this._register(this._bufferService.onResize(()=>this.queueSync())),this._register(this._bufferService.buffers.onBufferActivate(()=>{this._latestYDisp=void 0,this.queueSync()})),this._register(this._bufferService.onScroll(()=>this._syn

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/client/assets/terminal-C7X98Amf.jsView on unpkg · L4

scripts/ensure-node-pty.cjsView file

51console.log('Rebuilding node-pty with the Termdock macOS FD cleanup fix...'); L52: const result = spawnSync('npx', ['--yes', 'node-gyp', 'rebuild'], { L53: cwd: ptyRoot, stdio: 'inherit', timeout: 180_000,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/ensure-node-pty.cjsView on unpkg · L51

dist/client/shell-integration/termdock.bashView file

•path = dist/client/shell-integration/termdock.bash kind = build_helper sizeBytes = 3514 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/client/shell-integration/termdock.bashView on unpkg

dist/client/sw-encrypted-background.js.brView file

•path = dist/client/sw-encrypted-background.js.br kind = high_entropy_blob sizeBytes = 64690 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/sw-encrypted-background.js.brView on unpkg

•path = dist/client/sw-encrypted-background.js.br kind = compressed_blob sizeBytes = 64690 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/client/sw-encrypted-background.js.brView on unpkg

dist/client/assets/defaultLocale-CrowFXzY.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/client/assets/defaultLocale-CrowFXzY.js#virtual:normalized:round1View on unpkg

scripts/prepare-desktop-runtime.mjsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.220 matchedPath = scripts/prepare-desktop-runtime.mjs matchedIdentity = npm:dGVybWRvY2s:1.4.220 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/prepare-desktop-runtime.mjsView on unpkg

.desktop-dist/main.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.220 matchedPath = .desktop-dist/main.js matchedIdentity = npm:dGVybWRvY2s:1.4.220 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

.desktop-dist/main.jsView on unpkg

dist/server/agent/pluginPackages.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.220 matchedPath = [redacted].js matchedIdentity = npm:dGVybWRvY2s:1.4.220 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/agent/pluginPackages.jsView on unpkg

dist/server/utils/npmUpdate.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.220 matchedPath = dist/server/utils/npmUpdate.js matchedIdentity = npm:dGVybWRvY2s:1.4.220 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/utils/npmUpdate.jsView on unpkg

dist/client/assets/DiffViewer-CSYkLmfZ.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.220 matchedPath = dist/client/assets/DiffViewer-YXYaQJCI.js matchedIdentity = npm:dGVybWRvY2s:1.4.220 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/DiffViewer-CSYkLmfZ.jsView on unpkg

dist/server/agent/titleNamerCatalog.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/agent/titleNamerCatalog.jsView on unpkg

dist/server/ptyhost/manager.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.220 matchedPath = dist/server/ptyhost/manager.js matchedIdentity = npm:dGVybWRvY2s:1.4.220 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/ptyhost/manager.jsView on unpkg

Source & flagged code

30 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/server/certificateWatcher.jsView file

1import { EventEmitter } from 'events'; L2: import { execFile } from 'child_process'; L3: import { promisify } from 'util';

High

Child Process

Package source references child process execution.

dist/server/certificateWatcher.jsView on unpkg · L1

dist/server/utils/bootCheck.jsView file

51const r = spawnSync(cmd, [], { L52: shell: true, L53: timeout: timeoutMs,

High

Shell

Package source references shell execution.

dist/server/utils/bootCheck.jsView on unpkg · L51

•matchType = normalized_sha256 matchedPackage = termdock@1.4.220 matchedPath = dist/server/utils/bootCheck.js matchedIdentity = npm:dGVybWRvY2s:1.4.220 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/utils/bootCheck.jsView on unpkg

dist/client/assets/passwordBootstrap-CL6A4jgo.jsView file

1import{o as JA,y as NA,p as y,aW as EA,aK as cA,G as z,a2 as hA,c1 as DA,r as GA,c3 as AA,bC as G,bX as wA,u as aA,aJ as ZA}from"./app-C5_tJqmt.js";import"./react-XDCjal2T.js";impo... L2: ${g.stack}`:Q}function iA(g,A){return g=g>>>0,u().subarray(g/1,g/1+A)}let K=null;function l(){return(K===null||K.buffer.detached===!0||K.buffer.detached===void 0&&K.buffer!==k.memo...

High

Eval

Package source references dynamic code evaluation.

dist/client/assets/passwordBootstrap-CL6A4jgo.jsView on unpkg · L1

dist/server/routes/terminal.jsView file

14Trigger-reachable persistence chain: manifest.exports -> dist/server/entry.js -> dist/server/routes/terminal.js L14: import QRCode from 'qrcode'; L15: import { execFile, spawn } from 'child_process'; L16: import { createHash, randomBytes, randomUUID } from 'crypto'; ... L67: const execFileAsync = promisify(execFile); L68: const TERMDOCK_DIR = `${os.homedir()}/.termdock`; L69: const automationStore = new AutomationStore(`${TERMDOCK_DIR}/automations.json`); ... L83: const raw = await fs.promises.readFile(filePath, 'utf-8'); L84: return JSON.parse(raw); L85: } ... L115: const require_ = createRequire(import.meta.url); L116: // dist/server/routes/terminal.js → ../../../package.json L117: const pkg = require_(path.join(__dirname || '', '..', '..', '..', 'package.json'));

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/server/routes/terminal.jsView on unpkg · L14

•matchType = normalized_sha256 matchedPackage = termdock@1.4.220 matchedPath = dist/server/routes/terminal.js matchedIdentity = npm:dGVybWRvY2s:1.4.220 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/routes/terminal.jsView on unpkg

14import QRCode from 'qrcode'; L15: import { execFile, spawn } from 'child_process'; L16: import { createHash, randomBytes, randomUUID } from 'crypto'; ... L67: const execFileAsync = promisify(execFile); L68: const TERMDOCK_DIR = `${os.homedir()}/.termdock`; L69: const automationStore = new AutomationStore(`${TERMDOCK_DIR}/automations.json`); ... L83: const raw = await fs.promises.readFile(filePath, 'utf-8'); L84: return JSON.parse(raw); L85: } ... L115: const require_ = createRequire(import.meta.url); L116: // dist/server/routes/terminal.js → ../../../package.json L117: const pkg = require_(path.join(__dirname || '', '..', '..', '..', 'package.json'));

dist/server/cli.jsView file

4// 设置（同步 fs 不占线程池，所以放在文件体顶部仍然足够早）。 L5: process.env.UV_THREADPOOL_SIZE ||= '16'; L6: import { config as loadDotenv } from 'dotenv'; ... L10: // dotenv 不会覆盖已存在的环境变量，因此系统环境变量和命令行参数优先级最高 L11: loadDotenv({ path: resolve(os.homedir(), '.termdock', '.env'), quiet: true }); L12: loadDotenv({ path: resolve(process.cwd(), '.env'), quiet: true }); ... L21: import fs from 'fs'; L22: import http from 'http'; L23: import https from 'https'; ... L26: import { createHash, randomUUID } from 'crypto'; L27: import { spawn, spawnSync, execFile } from 'child_process'; L28: import { promisify } from 'util';

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/server/cli.jsView on unpkg · L4

4Trigger-reachable chain: scripts.start -> dist/server/cli.js L4: // 设置（同步 fs 不占线程池，所以放在文件体顶部仍然足够早）。 L5: process.env.UV_THREADPOOL_SIZE ||= '16'; L6: import { config as loadDotenv } from 'dotenv'; ... L10: // dotenv 不会覆盖已存在的环境变量，因此系统环境变量和命令行参数优先级最高 L11: loadDotenv({ path: resolve(os.homedir(), '.termdock', '.env'), quiet: true }); L12: loadDotenv({ path: resolve(process.cwd(), '.env'), quiet: true }); ... L21: import fs from 'fs'; L22: import http from 'http'; L23: import https from 'https'; ... L26: import { createHash, randomUUID } from 'crypto'; L27: import { spawn, spawnSync, execFile } from 'child_process'; L28: import { promisify } from 'util';

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/server/cli.jsView on unpkg · L4

4Detached bundled service listener: dist/server/cli.js spawns dist/server/entry.js; helper exposes a broad-bound HTTP listener. L4: // 设置（同步 fs 不占线程池，所以放在文件体顶部仍然足够早）。 L5: process.env.UV_THREADPOOL_SIZE ||= '16'; L6: import { config as loadDotenv } from 'dotenv'; ... L10: // dotenv 不会覆盖已存在的环境变量，因此系统环境变量和命令行参数优先级最高 L11: loadDotenv({ path: resolve(os.homedir(), '.termdock', '.env'), quiet: true }); L12: loadDotenv({ path: resolve(process.cwd(), '.env'), quiet: true }); ... L21: import fs from 'fs'; L22: import http from 'http'; L23: import https from 'https'; ... L26: import { createHash, randomUUID } from 'crypto'; L27: import { spawn, spawnSync, execFile } from 'child_process'; L28: import { promisify } from 'util';

scripts/postinstall.mjsView file

10L11: import { execSync, spawnSync } from 'child_process'; L12: import { createRequire } from 'module'; ... L31: const r = spawnSync(cmd, [], { shell: true, timeout: timeoutMs, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }); L32: return { ok: r.status === 0, stdout: r.stdout, stderr: r.stderr }; L33: } catch { ... L51: const { ensureNodePty } = require_('./ensure-node-pty.cjs'); L52: const PTY_PATH = require_.resolve('node-pty/package.json', { paths: [pkgRoot] }).replace('/package.json', ''); L53: ... L83: const pty = require_(PTY_PATH); L84: const proc = pty.spawn(process.env.SHELL || '/bin/bash', [], { name: 'xterm', cols: 80, rows: 24 }); L85: proc.kill();

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.mjsView on unpkg · L10

•matchType = normalized_sha256 matchedPackage = termdock@1.4.220 matchedPath = scripts/postinstall.mjs matchedIdentity = npm:dGVybWRvY2s:1.4.220 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.mjsView on unpkg

dist/server/agent/installers.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/server/agent/installers.jsView on unpkg

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/agent/installers.jsView on unpkg

dist/client/assets/terminal-C7X98Amf.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/client/assets/terminal-C7X98Amf.jsView on unpkg · L4

scripts/ensure-node-pty.cjsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/ensure-node-pty.cjsView on unpkg · L51

dist/client/shell-integration/termdock.bashView file

•path = dist/client/shell-integration/termdock.bash kind = build_helper sizeBytes = 3514 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/client/shell-integration/termdock.bashView on unpkg

dist/client/sw-encrypted-background.js.brView file

•path = dist/client/sw-encrypted-background.js.br kind = high_entropy_blob sizeBytes = 64690 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/sw-encrypted-background.js.brView on unpkg

•path = dist/client/sw-encrypted-background.js.br kind = compressed_blob sizeBytes = 64690 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/client/sw-encrypted-background.js.brView on unpkg

dist/client/assets/defaultLocale-CrowFXzY.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/client/assets/defaultLocale-CrowFXzY.js#virtual:normalized:round1View on unpkg

scripts/prepare-desktop-runtime.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/prepare-desktop-runtime.mjsView on unpkg

.desktop-dist/main.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

.desktop-dist/main.jsView on unpkg

dist/server/agent/pluginPackages.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/agent/pluginPackages.jsView on unpkg

dist/server/utils/npmUpdate.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/utils/npmUpdate.jsView on unpkg

dist/client/assets/DiffViewer-CSYkLmfZ.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/DiffViewer-CSYkLmfZ.jsView on unpkg

dist/server/agent/titleNamerCatalog.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/agent/titleNamerCatalog.jsView on unpkg

dist/server/ptyhost/manager.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/ptyhost/manager.jsView on unpkg

Findings

3 Critical23 High7 Medium6 Low

CriticalDownload Executedist/server/cli.js

CriticalTrojan Source Unicodedist/client/assets/terminal-C7X98Amf.js

CriticalTrigger Reachable Dangerous Capabilitydist/server/cli.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/server/certificateWatcher.js

HighShelldist/server/utils/bootCheck.js

HighEvaldist/client/assets/passwordBootstrap-CL6A4jgo.js

HighSandbox Evasion Gated Capabilityscripts/postinstall.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/server/agent/installers.js

HighSpawned Bundled Service Listenerdist/server/cli.js

HighTrigger Reachable Persistencedist/server/routes/terminal.js

HighRuntime Package Installscripts/ensure-node-pty.cjs

HighShips High Entropy Blobdist/client/sw-encrypted-background.js.br

HighSemantic Analysis Limiteddist/client/assets/defaultLocale-CrowFXzY.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/server/cli.js

HighKnown Malware Source Similaritydist/server/utils/bootCheck.js

HighKnown Malware Source Similarityscripts/postinstall.mjs

HighKnown Malware Source Similaritydist/server/routes/terminal.js

HighKnown Malware Source Similarityscripts/prepare-desktop-runtime.mjs

HighKnown Malware Source Similarity.desktop-dist/main.js

HighKnown Malware Source Similaritydist/server/agent/pluginPackages.js

HighKnown Malware Source Similaritydist/server/utils/npmUpdate.js

HighKnown Malware Source Similaritydist/client/assets/DiffViewer-CSYkLmfZ.js

HighKnown Malware Source Similaritydist/server/agent/installers.js

HighKnown Malware Source Similaritydist/server/agent/titleNamerCatalog.js

HighKnown Malware Source Similaritydist/server/ptyhost/manager.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/server/routes/terminal.js

MediumShips Build Helperdist/client/shell-integration/termdock.bash

MediumShips Compressed Blobdist/client/sw-encrypted-background.js.br

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings