registry / termdock / 1.4.238

termdock@1.4.238

A complete web-based terminal application with modern UI

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Inspected source is a real tmux and xterm terminal with optional AI-CLI hook integration, not an install-time hijack or self-dependency chain; scanner malware-similarity is noisy. Remaining risk is dual-use postinstall system setup and first-party writes into other agents' hook files after user install or stale refresh, which warrants a warning rather than a publish block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install runs postinstall; running the CLI or importing the server can auto-install tmux and refresh stale hooks; users install or remove hooks through the app API.

Impact

An unattended install can change system packages. Enabled hooks observe agent events in those CLIs. Harvested tokens are sent to official provider quota endpoints rather than a hidden drop host.

Mechanism

install-time native and tmux setup plus first-party writes into other AI CLI hook configs

AI rationale

Evidence

package.jsonscripts/postinstall.mjsdist/server/agent/installers.jsdist/server/routes/terminal.jsdist/server/quota/tokenDiscovery.js~/.termdock/.boot-check-ok~/.claude/settings.json~/.codex/hooks.json~/.copilot/hooks/termdock.json~/.config/opencode/plugins/termdock.js~/.pi/agent/extensions/termdock/index.ts~/.grok/hooks/termdock.json~/.kimi-code/config.toml

Network endpoints5

registry.npmjs.orgapi.anthropic.com/api/oauth/usage

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

npm postinstall runs scripts/postinstall.mjs, which rebuilds node-pty, may sudo-install tmux, and writes ~/.termdock/.boot-check-ok.
Agent installers write Termdock hook entries into Claude, Codex, Copilot, OpenCode, Pi, Grok, and Kimi config paths.
Importing the server module calls refreshStaleHooksAtLaunch, which reinstalls already-installed but outdated hooks.
Quota code reads other agents' OAuth tokens and sends them to official provider usage APIs.
First CLI start repeats tmux auto-install and native rebuild through bootCheck.

Evidence against

package.json has no runtime self-dependency on termdock, and postinstall does not write agent config files.
New hook installs are user API/CLI actions; launch only rewrites stale Termdock-owned hook entries.
Discovered tokens are used against official Anthropic, OpenAI, ChatGPT, and xAI quota URLs, not an attacker host.
Source is a full xterm/tmux/Electron terminal product matching its stated purpose; scanner malware-similarity looks like earlier termdock releases, not a hidden payload.
No obfuscated loader, reviewer-directed text, or third-party exfil endpoint was found.

Source & flagged code

30 flagged

package.jsonView file

Lines 24-64json

24 "dev:client": "vite",

25 "dev:server": "cross-env PORT=9835 tsx watch src/server/entry.ts",

26 "build": "npm run clean && npm run build:client && npm run build:server && npm run build:runtime-manifest",

27 "build:desktop": "node scripts/prepare-desktop-tokens.mjs && tsc -p tsconfig.desktop.json && esbuild desktop/preload.cts --bundle --platform=node --format=cjs --external:electron --outfile=.desktop-dist/preload.cjs && esbuild desktop/renderer/services.tsx --bundle --platform=browser --format=iife --minify --outfile=desktop/renderer/services.js",

28 "desktop:dev": "npm run build && npm run build:desktop && electron-forge start",

29 "desktop:prepare": "npm run build && npm run build:desktop && node scripts/prepare-desktop-runtime.mjs",

30 "desktop:make": "node scripts/ensure-macos-appdmg.mjs && npm run desktop:prepare && electron-forge make",

31 "build:client": "vite build && node scripts/precompress-client.mjs",

32 "build:server": "tsc -p tsconfig.server.json && node -e \"require('fs').chmodSync('dist/server/cli.js', 0o755)\"",

33 "build:runtime-manifest": "node scripts/generate-runtime-manifest.mjs",

34 "generate:pwa-assets": "pwa-assets-generator --config pwa-assets.config.ts",

35 "preview": "vite preview",

36 "start": "node dist/server/cli.js",

37 "lint": "tsc --noEmit",

38 "trace:diff": "node scripts/inspect-diff-trace.mjs",

39 "trace:fsio": "node scripts/inspect-fs-io.mjs",

40 "release:classify": "node scripts/classify-release.mjs",

41 "test": "vitest --passWithNoTests",

42 "test:ui": "vitest --ui",

43 "prepublishOnly": "npm run build",

44 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L44

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L44

45 },

46 "dependencies": {

47 "@chainsafe/libp2p-noise": "17.0.0",

48 "@dnd-kit/core": "^6.3.1",

49 "@dnd-kit/sortable": "^10.0.0",

50 "@dnd-kit/utilities": "^3.2.2",

51 "@hello-pangea/dnd": "^18.0.1",

52 "@libp2p/crypto": "5.1.9",

53 "@libp2p/interface": "3.1.0",

54 "@libp2p/peer-id": "6.0.0",

55 "@libp2p/utils": "7.0.7",

56 "@noble/hashes": "2.4.0",

57 "@serenity-kit/opaque": "1.1.0",

58 "@types/cookie-parser": "^1.4.10",

59 "@types/csurf": "^1.11.5",

60 "@types/refractor": "^2.8.0",

61 "@use-gesture/react": "^10.3.1",

62 "@xterm/addon-clipboard": "^0.3.0-beta.287",

63 "@xterm/addon-fit": "^0.12.0-beta.287",

64 "@xterm/addon-image": "^0.10.0-beta.287",

dist/server/certificateWatcher.jsView file

Lines 1-21javascript

1import { EventEmitter } from 'events';

2import { execFile } from 'child_process';

3import { promisify } from 'util';

High

Child Process

Package source references child process execution.

dist/server/certificateWatcher.jsView on unpkg · L1

dist/server/utils/bootCheck.jsView file

Lines 31-71javascript

31 }

32 catch { /* not in PATH */ }

33 // macOS non-interactive SSH 的 PATH 不包含 Homebrew 路径，手动检查

34 const extraPaths = [

35 '/opt/homebrew/bin',

36 '/usr/local/bin'

dist/client/assets/passwordBootstrap-B-JP42Ue.jsView file

Lines 1-3javascript

1import{p as JA,F as oA,q as y,bc as EA,a_ as cA,J as z,a5 as hA,cq as DA,s as GA,cu as AA,bX as G,ci as wA,w as aA,aZ

dist/server/routes/terminal.jsView file

Lines 1-36javascript

1import { assertPeerRegistrationAuthority } from '../agent/collaborationPeerTransport.js';

2import { progressRoutes } from '../notifications/progressRoutes.js';

3import { ensureNodePty } from '../utils/ensureNodePty.js';

4import { PtySpawnBackoff, PtySpawnDeferredError } from '../utils/ptySpawnBackoff.js'

dist/server/cli.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2// libuv 线程池默认只有 4 个线程，慢/挂起的异步 IO（fs.promises、crypto 等）

3// 会把池耗尽，表现为整个服务的 IO 全部卡死。必须在任何异步 fs 调用之前

4// 设置（同步 fs 不占线程池，所以放在文件体顶部仍然足够早）。

5process.env.UV_THREADPOOL_SIZE ||= '16';

6import { config as loadDotenv } from 'dotenv';

scripts/postinstall.mjsView file

Lines 1-30javascript

1#!/usr/bin/env node

3/**

4 * Termdock postinstall — 确保原生模块可用 + 自动安装 tmux

5 *

6 * 对于 npm 全局安装 (npm i -g termdock) 的场景，npm 10+ 默认不运行

7 * lifecycle scripts。此时 postinstall 不会执行，但 cli.ts 启动时的

8 * bootCheck 会做同样的检查并写入 marker，确保首次启动时一切就绪。

9 */

11import { execSync, spawnSync } from

dist/server/agent/installers.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import fs from 'node:fs'; import os from 'node:os'; import path from 'node:path'; import { execfile, spawn } from 'node:child_process'; import { agentbyslug, ispluginagent } from './registry.js'; import { loadplugins, resolvehooktarget } from './plugins.js'; export const hook_agents = ['claude', 'codex', 'copilot', 'opencode', 'pi', 'grok', 'kimi']; const display_names = { claude: 'claude code', codex: 'codex', copilot: 'copilot cli', opencode: 'opencode', pi: 'pi', grok: 'grok build', kimi: 'kimi code', };

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/server/agent/installers.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = termdock@1.4.217 matchedPath = dist/server/agent/installers.js matchedIdentity = npm:dGVybWRvY2s:1.4.217 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/agent/installers.jsView on unpkg

dist/client/assets/terminal-C7X98Amf.jsView file

4contains invisible/control Unicode U+200E (left-to-right mark) `)})),this._register(this._bufferService.onResize(()=>this.queueSync())),this._register(this._bufferService.buffers.onBufferActivate(()=>{this._latestYDisp=void 0,this.queueSync()})),this._register(this._bufferService.onScroll(()=>this._syn

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/client/assets/terminal-C7X98Amf.jsView on unpkg · L4

scripts/ensure-node-pty.cjsView file

51console.log('Rebuilding node-pty with the Termdock macOS FD cleanup fix...'); L52: const result = spawnSync('npx', ['--yes', 'node-gyp', 'rebuild'], { L53: cwd: ptyRoot, stdio: 'inherit', timeout: 180_000,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/ensure-node-pty.cjsView on unpkg · L51

dist/client/shell-integration/termdock.bashView file

•path = dist/client/shell-integration/termdock.bash kind = build_helper sizeBytes = 3514 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/client/shell-integration/termdock.bashView on unpkg

dist/client/sw-encrypted-background.js.brView file

•path = dist/client/sw-encrypted-background.js.br kind = high_entropy_blob sizeBytes = 64690 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/sw-encrypted-background.js.brView on unpkg

•path = dist/client/sw-encrypted-background.js.br kind = compressed_blob sizeBytes = 64690 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/client/sw-encrypted-background.js.brView on unpkg

dist/client/assets/chunk-TICWLB2K-Bp824MdF.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/client/assets/chunk-TICWLB2K-Bp824MdF.js#virtual:normalized:round1View on unpkg

scripts/prepare-desktop-runtime.mjsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.217 matchedPath = scripts/prepare-desktop-runtime.mjs matchedIdentity = npm:dGVybWRvY2s:1.4.217 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/prepare-desktop-runtime.mjsView on unpkg

dist/server/agent/pluginPackages.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.217 matchedPath = [redacted].js matchedIdentity = npm:dGVybWRvY2s:1.4.217 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/agent/pluginPackages.jsView on unpkg

dist/server/utils/npmUpdate.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.217 matchedPath = dist/server/utils/npmUpdate.js matchedIdentity = npm:dGVybWRvY2s:1.4.217 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/utils/npmUpdate.jsView on unpkg

dist/client/assets/DiffViewer-BPsVQrjM.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.232 matchedPath = dist/client/assets/DiffViewer-DN5Akyco.js matchedIdentity = npm:dGVybWRvY2s:1.4.232 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/DiffViewer-BPsVQrjM.jsView on unpkg

dist/server/agent/titleNamerCatalog.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/agent/titleNamerCatalog.jsView on unpkg

dist/server/ptyhost/manager.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.217 matchedPath = dist/server/ptyhost/manager.js matchedIdentity = npm:dGVybWRvY2s:1.4.217 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/ptyhost/manager.jsView on unpkg

dist/client/assets/index-UqXCGE5m.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.217 matchedPath = dist/client/assets/index-UqXCGE5m.js matchedIdentity = npm:dGVybWRvY2s:1.4.217 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/index-UqXCGE5m.jsView on unpkg

Source & flagged code

30 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/server/certificateWatcher.jsView file

1import { EventEmitter } from 'events'; L2: import { execFile } from 'child_process'; L3: import { promisify } from 'util';

High

Child Process

Package source references child process execution.

dist/server/certificateWatcher.jsView on unpkg · L1

Findings

3 Critical23 High7 Medium6 Low

CriticalDownload Executedist/server/cli.js

CriticalTrojan Source Unicodedist/client/assets/terminal-C7X98Amf.js

CriticalTrigger Reachable Dangerous Capabilitydist/server/cli.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/server/certificateWatcher.js

HighShelldist/server/utils/bootCheck.js

HighEvaldist/client/assets/passwordBootstrap-B-JP42Ue.js

HighSandbox Evasion Gated Capabilityscripts/postinstall.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/server/agent/installers.js

HighSpawned Bundled Service Listenerdist/server/cli.js

HighTrigger Reachable Persistence

Affected versions and remediation

This report applies to termdock@1.4.238.

See all versions of termdock for other recorded verdicts.

Review the evidence and your use of termdock@1.4.238 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-16 17:10:18.532Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Behavioral surface

Source & flagged code