termdock@1.4.239
A complete web-based terminal application with modern UI
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is a real tmux web terminal, not an npm install-time agent hijack or self-dependency chain. The remaining risk is dual-use: postinstall can install tmux, and the running app can write first-party hooks into other agents' configs.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
npm install runs postinstall. Starting the Termdock server can refresh hooks that were already installed. New hook installs happen through the running app's agent-hooks HTTP API.
Impact
May install tmux with a system package manager. May add Termdock-owned hook entries to third-party agent config files. May read local agent tokens to query official quota APIs.
Mechanism
lifecycle native-module and tmux setup plus runtime first-party agent-hook installers
AI rationale
This is a real tmux web terminal, not an npm install-time agent hijack or self-dependency chain. The remaining risk is dual-use: postinstall can install tmux, and the running app can write first-party hooks into other agents' configs.
Evidence
package.jsonscripts/postinstall.mjsdist/server/agent/installers.jsdist/server/routes/terminal.jsdist/server/quota/tokenDiscovery.js~/.termdock/.boot-check-ok~/.claude/settings.json~/.codex/hooks.json~/.copilot/hooks/termdock.json~/.config/opencode/plugins/termdock.js~/.pi/agent/extensions/termdock/index.ts~/.grok/hooks/termdock.json~/.kimi-code/config.toml
Network endpoints6
api.anthropic.com/api/oauth/usageapi.openai.com/v1/organization/usageapi.github.com/copilot/usageapi.x.ai/v1/usageapi.kimi.com/coding/v1/usagesregistry.npmjs.org
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- npm postinstall rebuilds node-pty and may auto-install tmux with brew, apt-get, and sudo.
- Runtime hook installers write Termdock commands into Claude, Codex, Copilot, OpenCode, Pi, Grok, and Kimi config files.
- Starting the server refreshes already-installed hooks that look outdated, without a new UI click.
- Quota code reads other agents' OAuth tokens from disk and sends them to vendor usage APIs.
Evidence against
- package.json has no self-dependency, and postinstall never writes Claude or other agent configs.
- New hook installs are a product feature reached after the user starts Termdock, via POST /agent-hooks/:agent/install.
- Discovered tokens are used against official Anthropic, OpenAI, GitHub, xAI, and Kimi usage URLs, not an attacker host.
- Scanner malware-similarity hits are this same readable terminal codebase, not a hidden payload or reviewer bait.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
30 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/server/certificateWatcher.jsView file
1import { EventEmitter } from 'events';
L2: import { execFile } from 'child_process';
L3: import { promisify } from 'util';
High
Child Process
Package source references child process execution.
dist/server/certificateWatcher.jsView on unpkg · L1dist/server/utils/bootCheck.jsView file
51const r = spawnSync(cmd, [], {
L52: shell: true,
L53: timeout: timeoutMs,
High
•matchType = normalized_sha256
matchedPackage = termdock@1.4.217
matchedPath = dist/server/utils/bootCheck.js
matchedIdentity = npm:dGVybWRvY2s:1.4.217
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/server/utils/bootCheck.jsView on unpkgdist/client/assets/passwordBootstrap-BkAa-DO2.jsView file
1import{p as JA,F as oA,q as y,bc as EA,a_ as cA,J as z,a5 as hA,cq as DA,s as GA,cu as AA,bX as G,ci as wA,w as aA,aZ as ZA}from"./app-Ctrh4Bku.js";import"./react-XDCjal2T.js";impo...
L2: ${g.stack}`:Q}function iA(g,A){return g=g>>>0,u().subarray(g/1,g/1+A)}let K=null;function l(){return(K===null||K.buffer.detached===!0||K.buffer.detached===void 0&&K.buffer!==k.memo...
High
Eval
Package source references dynamic code evaluation.
dist/client/assets/passwordBootstrap-BkAa-DO2.jsView on unpkg · L1dist/server/routes/terminal.jsView file
16Trigger-reachable persistence chain: manifest.exports -> dist/server/entry.js -> dist/server/routes/terminal.js
L16: import QRCode from 'qrcode';
L17: import { execFile, spawn } from 'child_process';
L18: import { createHash, randomBytes, randomUUID } from 'crypto';
...
L69: const execFileAsync = promisify(execFile);
L70: const TERMDOCK_DIR = `${os.homedir()}/.termdock`;
L71: const automationStore = new AutomationStore(`${TERMDOCK_DIR}/automations.json`);
...
L85: const raw = await fs.promises.readFile(filePath, 'utf-8');
L86: return JSON.parse(raw);
L87: }
...
L117: const require_ = createRequire(import.meta.url);
L118: // dist/server/routes/terminal.js → ../../../package.json
L119: const pkg = require_(path.join(__dirname || '', '..', '..', '..', 'package.json'));
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/server/routes/terminal.jsView on unpkg · L16•matchType = token_shingles
matchedPackage = termdock@1.4.232
matchedPath = dist/server/routes/terminal.js
matchedIdentity = npm:dGVybWRvY2s:1.4.232
similarity = 1.000
shingleOverlap = 48
summary = source token shingles overlapped finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/server/routes/terminal.jsView on unpkg16import QRCode from 'qrcode';
L17: import { execFile, spawn } from 'child_process';
L18: import { createHash, randomBytes, randomUUID } from 'crypto';
...
L69: const execFileAsync = promisify(execFile);
L70: const TERMDOCK_DIR = `${os.homedir()}/.termdock`;
L71: const automationStore = new AutomationStore(`${TERMDOCK_DIR}/automations.json`);
...
L85: const raw = await fs.promises.readFile(filePath, 'utf-8');
L86: return JSON.parse(raw);
L87: }
...
L117: const require_ = createRequire(import.meta.url);
L118: // dist/server/routes/terminal.js → ../../../package.json
L119: const pkg = require_(path.join(__dirname || '', '..', '..', '..', 'package.json'));
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/server/routes/terminal.jsView on unpkg · L16dist/server/cli.jsView file
4// 设置（同步 fs 不占线程池，所以放在文件体顶部仍然足够早）。
L5: process.env.UV_THREADPOOL_SIZE ||= '16';
L6: import { config as loadDotenv } from 'dotenv';
...
L10: // dotenv 不会覆盖已存在的环境变量，因此系统环境变量和命令行参数优先级最高
L11: loadDotenv({ path: resolve(os.homedir(), '.termdock', '.env'), quiet: true });
L12: loadDotenv({ path: resolve(process.cwd(), '.env'), quiet: true });
...
L22: import fs from 'fs';
L23: import http from 'http';
L24: import https from 'https';
...
L27: import { createHash, randomUUID } from 'crypto';
L28: import { spawn, spawnSync, execFile } from 'child_process';
L29: import { promisify } from 'util';
Critical
Download Execute
Source downloads or fetches remote code and executes it.
dist/server/cli.jsView on unpkg · L44Trigger-reachable chain: scripts.start -> dist/server/cli.js
L4: // 设置（同步 fs 不占线程池，所以放在文件体顶部仍然足够早）。
L5: process.env.UV_THREADPOOL_SIZE ||= '16';
L6: import { config as loadDotenv } from 'dotenv';
...
L10: // dotenv 不会覆盖已存在的环境变量，因此系统环境变量和命令行参数优先级最高
L11: loadDotenv({ path: resolve(os.homedir(), '.termdock', '.env'), quiet: true });
L12: loadDotenv({ path: resolve(process.cwd(), '.env'), quiet: true });
...
L22: import fs from 'fs';
L23: import http from 'http';
L24: import https from 'https';
...
L27: import { createHash, randomUUID } from 'crypto';
L28: import { spawn, spawnSync, execFile } from 'child_process';
L29: import { promisify } from 'util';
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/server/cli.jsView on unpkg · L44Detached bundled service listener: dist/server/cli.js spawns dist/server/entry.js; helper exposes a broad-bound HTTP listener.
L4: // 设置（同步 fs 不占线程池，所以放在文件体顶部仍然足够早）。
L5: process.env.UV_THREADPOOL_SIZE ||= '16';
L6: import { config as loadDotenv } from 'dotenv';
...
L10: // dotenv 不会覆盖已存在的环境变量，因此系统环境变量和命令行参数优先级最高
L11: loadDotenv({ path: resolve(os.homedir(), '.termdock', '.env'), quiet: true });
L12: loadDotenv({ path: resolve(process.cwd(), '.env'), quiet: true });
...
L22: import fs from 'fs';
L23: import http from 'http';
L24: import https from 'https';
...
L27: import { createHash, randomUUID } from 'crypto';
L28: import { spawn, spawnSync, execFile } from 'child_process';
L29: import { promisify } from 'util';
High
Spawned Bundled Service Listener
Source launches a detached bundled service that exposes a broad-bound HTTP listener.
dist/server/cli.jsView on unpkg · L4•matchType = normalized_sha256
matchedPackage = termdock@1.4.232
matchedPath = dist/server/cli.js
matchedIdentity = npm:dGVybWRvY2s:1.4.232
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/server/cli.jsView on unpkgscripts/postinstall.mjsView file
10L11: import { execSync, spawnSync } from 'child_process';
L12: import { createRequire } from 'module';
...
L31: const r = spawnSync(cmd, [], { shell: true, timeout: timeoutMs, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
L32: return { ok: r.status === 0, stdout: r.stdout, stderr: r.stderr };
L33: } catch {
...
L51: const { ensureNodePty } = require_('./ensure-node-pty.cjs');
L52: const PTY_PATH = require_.resolve('node-pty/package.json', { paths: [pkgRoot] }).replace('/package.json', '');
L53:
...
L83: const pty = require_(PTY_PATH);
L84: const proc = pty.spawn(process.env.SHELL || '/bin/bash', [], { name: 'xterm', cols: 80, rows: 24 });
L85: proc.kill();
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
scripts/postinstall.mjsView on unpkg · L10•matchType = normalized_sha256
matchedPackage = termdock@1.4.217
matchedPath = scripts/postinstall.mjs
matchedIdentity = npm:dGVybWRvY2s:1.4.217
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/postinstall.mjsView on unpkgdist/server/agent/installers.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
import fs from 'node:fs';
import os from 'node:os';
import path from 'node:path';
import { execfile, spawn } from 'node:child_process';
import { agentbyslug, ispluginagent } from './registry.js';
import { loadplugins, resolvehooktarget } from './plugins.js';
export const hook_agents = ['claude', 'codex', 'copilot', 'opencode', 'pi', 'grok', 'kimi'];
const display_names = {
claude: 'claude code',
codex: 'codex',
copilot: 'copilot cli',
opencode: 'opencode',
pi: 'pi',
grok: 'grok build',
kimi: 'kimi code',
};
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/server/agent/installers.jsView on unpkg•matchType = normalized_sha256
matchedPackage = termdock@1.4.217
matchedPath = dist/server/agent/installers.js
matchedIdentity = npm:dGVybWRvY2s:1.4.217
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/server/agent/installers.jsView on unpkgdist/client/assets/terminal-C7X98Amf.jsView file
4contains invisible/control Unicode U+200E (left-to-right mark)
`)})),this._register(this._bufferService.onResize(()=>this.queueSync())),this._register(this._bufferService.buffers.onBufferActivate(()=>{this._latestYDisp=void 0,this.queueSync()})),this._register(this._bufferService.onScroll(()=>this._syn
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/client/assets/terminal-C7X98Amf.jsView on unpkg · L4scripts/ensure-node-pty.cjsView file
51console.log('Rebuilding node-pty with the Termdock macOS FD cleanup fix...');
L52: const result = spawnSync('npx', ['--yes', 'node-gyp', 'rebuild'], {
L53: cwd: ptyRoot, stdio: 'inherit', timeout: 180_000,
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
scripts/ensure-node-pty.cjsView on unpkg · L51dist/client/shell-integration/termdock.bashView file
•path = dist/client/shell-integration/termdock.bash
kind = build_helper
sizeBytes = 3514
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
dist/client/shell-integration/termdock.bashView on unpkgdist/client/sw-encrypted-background.js.brView file
•path = dist/client/sw-encrypted-background.js.br
kind = high_entropy_blob
sizeBytes = 64690
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
dist/client/sw-encrypted-background.js.brView on unpkg•path = dist/client/sw-encrypted-background.js.br
kind = compressed_blob
sizeBytes = 64690
magicHex = [redacted]
Medium
Ships Compressed Blob
Package ships compressed or archive-like blobs.
dist/client/sw-encrypted-background.js.brView on unpkgdist/client/assets/chunk-TICWLB2K-CS3jsxv7.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/client/assets/chunk-TICWLB2K-CS3jsxv7.js#virtual:normalized:round1View on unpkgscripts/prepare-desktop-runtime.mjsView file
•matchType = normalized_sha256
matchedPackage = termdock@1.4.217
matchedPath = scripts/prepare-desktop-runtime.mjs
matchedIdentity = npm:dGVybWRvY2s:1.4.217
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/prepare-desktop-runtime.mjsView on unpkgdist/server/agent/pluginPackages.jsView file
•matchType = normalized_sha256
matchedPackage = termdock@1.4.217
matchedPath = [redacted].js
matchedIdentity = npm:dGVybWRvY2s:1.4.217
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/server/agent/pluginPackages.jsView on unpkgdist/server/utils/npmUpdate.jsView file
•matchType = normalized_sha256
matchedPackage = termdock@1.4.217
matchedPath = dist/server/utils/npmUpdate.js
matchedIdentity = npm:dGVybWRvY2s:1.4.217
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/server/utils/npmUpdate.jsView on unpkgdist/client/assets/DiffViewer-GLkd1zMQ.jsView file
•matchType = normalized_sha256
matchedPackage = termdock@1.4.232
matchedPath = dist/client/assets/DiffViewer-DN5Akyco.js
matchedIdentity = npm:dGVybWRvY2s:1.4.232
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/client/assets/DiffViewer-GLkd1zMQ.jsView on unpkgdist/server/agent/titleNamerCatalog.jsView file
•matchType = normalized_sha256
matchedPackage = termdock@1.4.217
matchedPath = [redacted].js
matchedIdentity = npm:dGVybWRvY2s:1.4.217
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/server/agent/titleNamerCatalog.jsView on unpkgdist/server/ptyhost/manager.jsView file
•matchType = normalized_sha256
matchedPackage = termdock@1.4.217
matchedPath = dist/server/ptyhost/manager.js
matchedIdentity = npm:dGVybWRvY2s:1.4.217
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/server/ptyhost/manager.jsView on unpkgdist/client/assets/index-UqXCGE5m.jsView file
•matchType = normalized_sha256
matchedPackage = termdock@1.4.217
matchedPath = dist/client/assets/index-UqXCGE5m.js
matchedIdentity = npm:dGVybWRvY2s:1.4.217
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/client/assets/index-UqXCGE5m.jsView on unpkgFindings
3 Critical23 High7 Medium6 Low
CriticalDownload Executedist/server/cli.js
CriticalTrojan Source Unicodedist/client/assets/terminal-C7X98Amf.js
CriticalTrigger Reachable Dangerous Capabilitydist/server/cli.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/server/certificateWatcher.js
HighShelldist/server/utils/bootCheck.js
HighEvaldist/client/assets/passwordBootstrap-BkAa-DO2.js
HighSandbox Evasion Gated Capabilityscripts/postinstall.mjs
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/server/agent/installers.js
HighSpawned Bundled Service Listenerdist/server/cli.js
HighTrigger Reachable Persistencedist/server/routes/terminal.js
HighRuntime Package Installscripts/ensure-node-pty.cjs
HighShips High Entropy Blobdist/client/sw-encrypted-background.js.br
HighSemantic Analysis Limiteddist/client/assets/chunk-TICWLB2K-CS3jsxv7.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/server/cli.js
HighKnown Malware Source Similaritydist/server/utils/bootCheck.js
HighKnown Malware Source Similarityscripts/postinstall.mjs
HighKnown Malware Source Similaritydist/server/routes/terminal.js
HighKnown Malware Source Similarityscripts/prepare-desktop-runtime.mjs
HighKnown Malware Source Similaritydist/server/agent/pluginPackages.js
HighKnown Malware Source Similaritydist/server/utils/npmUpdate.js
HighKnown Malware Source Similaritydist/client/assets/DiffViewer-GLkd1zMQ.js
HighKnown Malware Source Similaritydist/server/agent/installers.js
HighKnown Malware Source Similaritydist/server/agent/titleNamerCatalog.js
HighKnown Malware Source Similaritydist/server/ptyhost/manager.js
HighKnown Malware Source Similaritydist/client/assets/index-UqXCGE5m.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/server/routes/terminal.js
MediumShips Build Helperdist/client/shell-integration/termdock.bash
MediumShips Compressed Blobdist/client/sw-encrypted-background.js.br
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to termdock@1.4.239.
See all versions of termdock for other recorded verdicts.
- Review the evidence and your use of termdock@1.4.239 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.