Loading npm security reports…

termdock@1.4.249: Malicious npm security report (Block) | LPM Firewall

registry / termdock / 1.4.249

termdock@1.4.249

A complete web-based terminal application with modern UI

AI Security Review

scanned 21d ago · by lpm-firewall-ai

Installing the package invokes a lifecycle hook that can alter the host through package managers and sudo. Starting its server also reads stored agent credentials and sends them to provider usage APIs.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation activates postinstall; starting the Termdock server activates quota polling.

Impact

An install can prompt for elevated privileges and install software without an explicit setup command; runtime accesses credentials from other tools.

Mechanism

Automatic system-package installation and credential-backed quota polling.

Attack narrative

A normal npm install runs postinstall, which detects a missing tmux binary and invokes Homebrew, MacPorts, Nix, or Linux package-manager commands. On Linux it attempts sudo before retrying without it. When the application server starts, its quota manager discovers credentials from agent configuration and environment sources, then automatically makes authenticated provider API requests on a timer. These effects occur without a dedicated user setup command or consent prompt.

AI rationale

This package combines an automatic installation lifecycle hook with unconsented host package-manager and sudo attempts. It also harvests credentials from unrelated agent configuration for automatic network use, so the package should be blocked.

Evidence

package.jsonscripts/postinstall.mjsdist/server/quota/tokenDiscovery.jsdist/server/quota/QuotaManager.jsdist/server/quota/providers/codex.jsnode-pty/prebuilds

Source & flagged code

30 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/server/utils/kicadBoardInspection.jsView file

1import { execFile } from 'child_process'; L2: const KICAD_INSPECTION_SCRIPT = String.raw `

High

Child Process

Package source references child process execution.

dist/server/utils/kicadBoardInspection.jsView on unpkg · L1

dist/server/utils/bootCheck.jsView file

51const r = spawnSync(cmd, [], { L52: shell: true, L53: timeout: timeoutMs,

High

Shell

Package source references shell execution.

dist/server/utils/bootCheck.jsView on unpkg · L51

•matchType = normalized_sha256 matchedPackage = termdock@1.4.247 matchedPath = dist/server/utils/bootCheck.js matchedIdentity = npm:dGVybWRvY2s:1.4.247 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/utils/bootCheck.jsView on unpkg

dist/server/routes/terminal.jsView file

16Trigger-reachable persistence chain: manifest.exports -> dist/server/entry.js -> dist/server/routes/terminal.js L16: import QRCode from 'qrcode'; L17: import { execFile, spawn } from 'child_process'; L18: import { createHash, randomBytes, randomUUID } from 'crypto'; ... L69: const execFileAsync = promisify(execFile); L70: const TERMDOCK_DIR = `${os.homedir()}/.termdock`; L71: const automationStore = new AutomationStore(`${TERMDOCK_DIR}/automations.json`); ... L85: const raw = await fs.promises.readFile(filePath, 'utf-8'); L86: return JSON.parse(raw); L87: } ... L117: const require_ = createRequire(import.meta.url); L118: // dist/server/routes/terminal.js → ../../../package.json L119: const pkg = require_(path.join(__dirname || '', '..', '..', '..', 'package.json'));

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/server/routes/terminal.jsView on unpkg · L16

16import QRCode from 'qrcode'; L17: import { execFile, spawn } from 'child_process'; L18: import { createHash, randomBytes, randomUUID } from 'crypto'; ... L69: const execFileAsync = promisify(execFile); L70: const TERMDOCK_DIR = `${os.homedir()}/.termdock`; L71: const automationStore = new AutomationStore(`${TERMDOCK_DIR}/automations.json`); ... L85: const raw = await fs.promises.readFile(filePath, 'utf-8'); L86: return JSON.parse(raw); L87: } ... L117: const require_ = createRequire(import.meta.url); L118: // dist/server/routes/terminal.js → ../../../package.json L119: const pkg = require_(path.join(__dirname || '', '..', '..', '..', 'package.json'));

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/server/routes/terminal.jsView on unpkg · L16

dist/server/ptyhost/manager.jsView file

264// must not die with (or be reaped by) this server. L265: const child = spawn(command, args, { L266: detached: true, L267: stdio: 'ignore', L268: env: process.env, L269: }); ... L274: return new Promise((resolvePromise, rejectPromise) => { L275: const conn = net.createConnection(ptyHostSocketPath()); L276: const timer = setTimeout(() => {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/server/ptyhost/manager.jsView on unpkg · L264

•matchType = normalized_sha256 matchedPackage = termdock@1.4.247 matchedPath = dist/server/ptyhost/manager.js matchedIdentity = npm:dGVybWRvY2s:1.4.247 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/ptyhost/manager.jsView on unpkg

dist/client/assets/app-DhyrRqRS.jsView file

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/passwordBootstrap-kiljsfOw.js","assets/react-XDCjal2T.js","assets/dnd-BCFAPC0L.js","assets/terminal-C7X98Amf.js","a... L2: import{r as _c,a as Rm,g as If}from"./react-XDCjal2T.js";import{b as O,R as We,r as Oc}from"./dnd-BCFAPC0L.js";import{L as Tm,l as Pm}from"./terminal-C7X98Amf.js";(function(){const... L3: ]))+`;ut.KANJI=new RegExp(n,"g"),ut.BYTE_KANJI=new RegExp("[^A-Z0-9 $%*+\\-./:]+","g"),ut.BYTE=new RegExp(r,"g"),ut.NUMERIC=new RegExp(t,"g"),ut.ALPHANUMERIC=new RegExp(e,"g");cons... ... L8: `);const B=y(T,S,A),C=t.getSymbolSize(T),E=new r(C);return h(E,T),g(E),m(E,T),w(E,S,0),T>=7&&b(E,T),R(E,B),isNaN(v)&&(v=i.getBestMask(E,w.bind(null,E,S))),i.applyMask(v,E),w(E,S,v)... L9: `;return typeof a=="function"&&a(null,b)

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/client/assets/app-DhyrRqRS.jsView on unpkg · L1

.desktop-dist/main.jsView file

6import { app, BrowserWindow, clipboard, dialog, ipcMain, Menu, net, nativeImage, Notification, powerMonitor, screen, session, shell, Tray, } from 'electron'; L7: import { execFile, spawn } from 'node:child_process'; L8: import crypto from 'node:crypto'; ... L10: import fs from 'node:fs'; L11: import http from 'node:http'; L12: import https from 'node:https'; ... L29: const projectRoot = path.resolve(currentDir, '..'); L30: const termdockDir = path.join(os.homedir(), '.termdock'); L31: const desktopConfigPath = path.join(termdockDir, 'desktop.json'); ... L56: function triggerLocalNetworkPermission() { L57: if (process.platform !== 'darwin') L58: return;

Critical

Download Execute

Source downloads or fetches remote code and executes it.

.desktop-dist/main.jsView on unpkg · L6

6Trigger-reachable chain: manifest.main -> .desktop-dist/main.js L6: import { app, BrowserWindow, clipboard, dialog, ipcMain, Menu, net, nativeImage, Notification, powerMonitor, screen, session, shell, Tray, } from 'electron'; L7: import { execFile, spawn } from 'node:child_process'; L8: import crypto from 'node:crypto'; ... L10: import fs from 'node:fs'; L11: import http from 'node:http'; L12: import https from 'node:https'; ... L29: const projectRoot = path.resolve(currentDir, '..'); L30: const termdockDir = path.join(os.homedir(), '.termdock'); L31: const desktopConfigPath = path.join(termdockDir, 'desktop.json'); ... L56: function triggerLocalNetworkPermission() { L57: if (process.platform !== 'darwin') L58: return;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

.desktop-dist/main.jsView on unpkg · L6

scripts/postinstall.mjsView file

10L11: import { execSync, spawnSync } from 'child_process'; L12: import { createRequire } from 'module'; ... L31: const r = spawnSync(cmd, [], { shell: true, timeout: timeoutMs, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }); L32: return { ok: r.status === 0, stdout: r.stdout, stderr: r.stderr }; L33: } catch { ... L51: const { ensureNodePty } = require_('./ensure-node-pty.cjs'); L52: const PTY_PATH = require_.resolve('node-pty/package.json', { paths: [pkgRoot] }).replace('/package.json', ''); L53: ... L83: const pty = require_(PTY_PATH); L84: const proc = pty.spawn(process.env.SHELL || '/bin/bash', [], { name: 'xterm', cols: 80, rows: 24 }); L85: proc.kill();

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.mjsView on unpkg · L10

•matchType = normalized_sha256 matchedPackage = termdock@1.4.247 matchedPath = scripts/postinstall.mjs matchedIdentity = npm:dGVybWRvY2s:1.4.247 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.mjsView on unpkg

dist/server/agent/installers.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import fs from 'node:fs'; import os from 'node:os'; import path from 'node:path'; import { execfile, spawn } from 'node:child_process'; import { agentbyslug, ispluginagent } from './registry.js'; import { loadplugins, resolvehooktarget } from './plugins.js'; export const hook_agents = ['claude', 'codex', 'copilot', 'opencode', 'pi', 'grok', 'kimi']; const display_names = { claude: 'claude code', codex: 'codex', copilot: 'copilot cli', opencode: 'opencode', pi: 'pi', grok: 'grok build', kimi: 'kimi code', };

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/server/agent/installers.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = termdock@1.4.247 matchedPath = dist/server/agent/installers.js matchedIdentity = npm:dGVybWRvY2s:1.4.247 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/agent/installers.jsView on unpkg

dist/server/cli.jsView file

4Detached bundled service listener: dist/server/cli.js spawns dist/server/entry.js; helper exposes a broad-bound HTTP listener. L4: // 设置（同步 fs 不占线程池，所以放在文件体顶部仍然足够早）。 L5: process.env.UV_THREADPOOL_SIZE ||= '16'; L6: import { config as loadDotenv } from 'dotenv'; ... L10: // dotenv 不会覆盖已存在的环境变量，因此系统环境变量和命令行参数优先级最高 L11: loadDotenv({ path: resolve(os.homedir(), '.termdock', '.env'), quiet: true }); L12: loadDotenv({ path: resolve(process.cwd(), '.env'), quiet: true }); ... L23: import { getMissingCertificateNames } from './utils/certificateNames.js'; L24: import http from 'http'; L25: import https from 'https'; ... L28: import { createHash, randomUUID } from 'crypto'; L29: import { spawn, spawnSync, execFile } from 'child_process'; L30: import { promisify } from 'util';

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/server/cli.jsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = termdock@1.4.247 matchedPath = dist/server/cli.js matchedIdentity = npm:dGVybWRvY2s:1.4.247 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/cli.jsView on unpkg

scripts/ensure-node-pty.cjsView file

51console.log('Rebuilding node-pty with the Termdock macOS FD cleanup fix...'); L52: const result = spawnSync('npx', ['--yes', 'node-gyp', 'rebuild'], { L53: cwd: ptyRoot, stdio: 'inherit', timeout: 180_000,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/ensure-node-pty.cjsView on unpkg · L51

dist/client/shell-integration/termdock.bashView file

•path = dist/client/shell-integration/termdock.bash kind = build_helper sizeBytes = 3514 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/client/shell-integration/termdock.bashView on unpkg

dist/client/sw-encrypted-background.js.brView file

•path = dist/client/sw-encrypted-background.js.br kind = high_entropy_blob sizeBytes = 64690 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/sw-encrypted-background.js.brView on unpkg

•path = dist/client/sw-encrypted-background.js.br kind = compressed_blob sizeBytes = 64690 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/client/sw-encrypted-background.js.brView on unpkg

dist/client/assets/defaultLocale-CrowFXzY.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/client/assets/defaultLocale-CrowFXzY.js#virtual:normalized:round1View on unpkg

scripts/prepare-desktop-runtime.mjsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.247 matchedPath = scripts/prepare-desktop-runtime.mjs matchedIdentity = npm:dGVybWRvY2s:1.4.247 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/prepare-desktop-runtime.mjsView on unpkg

dist/server/agent/pluginPackages.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.247 matchedPath = [redacted].js matchedIdentity = npm:dGVybWRvY2s:1.4.247 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/agent/pluginPackages.jsView on unpkg

dist/server/utils/npmUpdate.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.247 matchedPath = dist/server/utils/npmUpdate.js matchedIdentity = npm:dGVybWRvY2s:1.4.247 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/utils/npmUpdate.jsView on unpkg

dist/client/assets/DiffViewer-zb8C5YLR.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.247 matchedPath = dist/client/assets/DiffViewer-DvP6iXpD.js matchedIdentity = npm:dGVybWRvY2s:1.4.247 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/DiffViewer-zb8C5YLR.jsView on unpkg

dist/server/agent/titleNamerCatalog.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.247 matchedPath = [redacted].js matchedIdentity = npm:dGVybWRvY2s:1.4.247 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/agent/titleNamerCatalog.jsView on unpkg

dist/client/assets/index-UqXCGE5m.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.247 matchedPath = dist/client/assets/index-UqXCGE5m.js matchedIdentity = npm:dGVybWRvY2s:1.4.247 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/index-UqXCGE5m.jsView on unpkg

Findings

3 Critical23 High7 Medium7 Low

CriticalCredential Exfiltrationdist/client/assets/app-DhyrRqRS.js

CriticalDownload Execute.desktop-dist/main.js

CriticalTrigger Reachable Dangerous Capability.desktop-dist/main.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/server/utils/kicadBoardInspection.js

HighShelldist/server/utils/bootCheck.js

HighSame File Env Network Executiondist/server/ptyhost/manager.js

HighSandbox Evasion Gated Capabilityscripts/postinstall.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/server/agent/installers.js

HighSpawned Bundled Service Listenerdist/server/cli.js

HighTrigger Reachable Persistencedist/server/routes/terminal.js

HighRuntime Package Installscripts/ensure-node-pty.cjs

HighShips High Entropy Blobdist/client/sw-encrypted-background.js.br

HighSemantic Analysis Limiteddist/client/assets/defaultLocale-CrowFXzY.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/server/cli.js

HighKnown Malware Source Similaritydist/server/utils/bootCheck.js

HighKnown Malware Source Similarityscripts/postinstall.mjs

HighKnown Malware Source Similarityscripts/prepare-desktop-runtime.mjs

HighKnown Malware Source Similarity.desktop-dist/main.js

HighKnown Malware Source Similaritydist/server/agent/pluginPackages.js

HighKnown Malware Source Similaritydist/server/utils/npmUpdate.js

HighKnown Malware Source Similaritydist/client/assets/DiffViewer-zb8C5YLR.js

HighKnown Malware Source Similaritydist/server/agent/installers.js

HighKnown Malware Source Similaritydist/server/agent/titleNamerCatalog.js

HighKnown Malware Source Similaritydist/server/ptyhost/manager.js

HighKnown Malware Source Similaritydist/client/assets/index-UqXCGE5m.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/server/routes/terminal.js

MediumShips Build Helperdist/client/shell-integration/termdock.bash

MediumShips Compressed Blobdist/client/sw-encrypted-background.js.br

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings