registry / termdock / 1.4.282

termdock@1.4.282

A complete web-based terminal application with modern UI

AI Security Review

scanned 25d ago · by lpm-firewall-ai

The package is a terminal app whose postinstall only prepares node-pty and tmux, but its server can write command hooks into several foreign AI-agent user configs. That setup is user-routed and limited to this package's emitter, so it is a guarded first-party agent-extension capability rather than an unconsented install-time hijack.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

The termdock server process loads dist/server/routes/terminal.js, and a client calls POST /agent-hooks/:agent/install, or an existing hook file is already outdated. npm install also runs the postinstall script.

Impact

Agents that already have or later receive these hooks will run this package's hook emitter on their hook events. A new install does not silently attach hooks to every agent. Postinstall can change the machine by installing tmux or rebuilding a native module.

Mechanism

installHooks writes a quoted node command for agentHook.js into the selected agent settings or hooks file. refreshStaleHooksAtLaunch repeats that write only when hooksState is outdated. postinstall uses the host package manager for tmux and node-gyp for node-pty.

AI rationale

Evidence

dist/server/agent/installers.jsdist/server/routes/terminal.jspackage.jsonscripts/postinstall.mjs~/.claude/settings.json~/.codex/hooks.json~/.copilot/hooks/termdock.json~/.config/opencode/plugins/termdock.js~/.pi/agent/extensions/termdock/index.ts~/.grok/hooks/termdock.json~/.kimi-code/config.toml~/.termdock/.boot-check-ok

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Installer targets user-level Claude, Codex, Copilot, OpenCode, Pi, Grok, and Kimi hook files and writes a node command that runs this package's agentHook.js.
POST /agent-hooks/:agent/install calls installHooksForSlug while the server is running.
Loading terminal routes calls refreshStaleHooksAtLaunch, which rewrites hook files already marked outdated.
npm postinstall runs scripts/postinstall.mjs, which tries to install tmux through the host package manager when tmux is missing and rebuilds node-pty. It does not write agent hook files.

Evidence against

Hook install is an explicit server route, not a preinstall, install, or postinstall step.
Launch refresh skips agents whose hook state is not outdated.
Codex install still asks the user to approve new hooks inside Codex.
Auto-update, when the CLI server starts, installs termdock from registry.npmjs.org and then the configured registry, which is the same package rather than a foreign payload host.

Behavioral surface

Source

ChildProcessCrypto

Source & flagged code

33 flagged

package.jsonView file

Lines 24-64json

24 "dev:client": "vite",

25 "dev:server": "cross-env PORT=9835 tsx watch src/server/entry.ts",

26 "build": "npm run clean && npm run build:client && npm run build:server && npm run build:runtime-manifest",

27 "build:desktop": "node scripts/prepare-desktop-tokens.mjs && tsc -p tsconfig.desktop.json && esbuild desktop/preload.cts --bundle --platform=node --format=cjs --external:electron --outfile=.desktop-dist/preload.cjs && esbuild desktop/renderer/services.tsx --bundle --platform=browser --format=iife --minify --outfile=desktop/renderer/services.js",

28 "desktop:dev": "npm run build && npm run build:desktop && electron-forge start",

29 "desktop:prepare": "npm run build && npm run build:desktop && node scripts/prepare-desktop-runtime.mjs",

30 "desktop:make": "node scripts/ensure-macos-appdmg.mjs && npm run desktop:prepare && electron-forge make",

31 "build:client": "vite build && node scripts/precompress-client.mjs",

32 "build:server": "tsc -p tsconfig.server.json && node -e \"require('fs').chmodSync('dist/server/cli.js', 0o755)\"",

33 "build:runtime-manifest": "node scripts/generate-runtime-manifest.mjs",

34 "generate:pwa-assets": "pwa-assets-generator --config pwa-assets.config.ts",

35 "preview": "vite preview",

36 "start": "node dist/server/cli.js",

37 "lint": "tsc --noEmit",

38 "trace:diff": "node scripts/inspect-diff-trace.mjs",

39 "trace:fsio": "node scripts/inspect-fs-io.mjs",

40 "release:classify": "node scripts/classify-release.mjs",

41 "test": "vitest --passWithNoTests",

42 "test:ui": "vitest --ui",

43 "prepublishOnly": "npm run build",

44 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L44

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L44

45 },

46 "dependencies": {

47 "@chainsafe/libp2p-noise": "17.0.0",

48 "@dnd-kit/core": "^6.3.1",

49 "@dnd-kit/sortable": "^10.0.0",

50 "@dnd-kit/utilities": "^3.2.2",

51 "@ffmpeg/core": "^0.12.10",

52 "@ffmpeg/ffmpeg": "^0.12.15",

53 "@ffmpeg/util": "^0.12.2",

54 "@hello-pangea/dnd": "^18.0.1",

55 "@libp2p/crypto": "5.1.9",

56 "@libp2p/interface": "3.1.0",

57 "@libp2p/peer-id": "6.0.0",

58 "@libp2p/utils": "7.0.7",

59 "@noble/hashes": "2.4.0",

60 "@serenity-kit/opaque": "1.1.0",

61 "@types/cookie-parser": "^1.4.10",

62 "@types/csurf": "^1.11.5",

63 "@types/refractor": "^2.8.0",

64 "@use-gesture/react": "^10.3.1",

dist/server/supervisor.jsView file

Lines 3-43javascript

3 * termdock supervisor — 盯住服务子进程，挂了就重启，并把原因记下来。

4 *

5 * 它解决的是两件今天无人负责的事：

6 * 1. 自动更新后新进程没起来（旧实现是发射后不管的 `node -e` bridge，不验证、不重试）；

7 * 2. 运行中崩溃（全仓没有 uncaughtException 处理，server.log 连时间戳都没有）。

dist/server/utils/bootCheck.jsView file

Lines 31-71javascript

31 }

32 catch { /* not in PATH */ }

33 // macOS non-interactive SSH 的 PATH 不包含 Homebrew 路径，手动检查

34 const extraPaths = [

35 '/opt/homebrew/bin',

36 '/usr/local/bin'

dist/client/assets/diffWorker-BP4IBsm9.jsView file

Lines 1-38javascript

1(function(){"use strict";"global"in globalThis||(globalThis.global=globalThis);var we=typeof globalThis<"u"?globalThis:typeof window<"u"?window:typeof global<"u"?

dist/server/utils/version.jsView file

Lines 1-34javascript

1import path from 'node:path';

2import { createRequire } from 'node:module';

3import { fileURLToPath } from 'node:url';

4const currentDir = path.

dist/server/routes/terminal.jsView file

Lines 1-37javascript

1import { androidRecordings } from '../android/recording.js';

2import { assertPeerRegistrationAuthority } from '../agent/collaborationPeerTransport.js';

3import { progressRoutes } from '../notifications/progressRoutes.js';

4import { ensureNodePty } from '../utils/ensureNodePty.js'

dist/server/ptyhost/manager.jsView file

Lines 244-284javascript

244 catch { /* already gone */ }

245 deadline = Date.now() + 1_000;

246 while (alive() && Date.now() < deadline) {

.desktop-dist/main.jsView file

6import { app, BrowserWindow, clipboard, dialog, ipcMain, Menu, net, nativeImage, Notification, powerMonitor, screen, session, shell, Tray, } from 'electron'; L7: import { execFile, spawn } from 'node:child_process'; L8: import crypto from 'node:crypto'; ... L10: import fs from 'node:fs'; L11: import http from 'node:http'; L12: import https from 'node:https'; ... L29: const projectRoot = path.resolve(currentDir, '..'); L30: const termdockDir = path.join(os.homedir(), '.termdock'); L31: const desktopConfigPath = path.join(termdockDir, 'desktop.json'); ... L56: function triggerLocalNetworkPermission() { L57: if (process.platform !== 'darwin') L58: return;

Critical

Download Execute

Source downloads or fetches remote code and executes it.

.desktop-dist/main.jsView on unpkg · L6

6Trigger-reachable chain: manifest.main -> .desktop-dist/main.js L6: import { app, BrowserWindow, clipboard, dialog, ipcMain, Menu, net, nativeImage, Notification, powerMonitor, screen, session, shell, Tray, } from 'electron'; L7: import { execFile, spawn } from 'node:child_process'; L8: import crypto from 'node:crypto'; ... L10: import fs from 'node:fs'; L11: import http from 'node:http'; L12: import https from 'node:https'; ... L29: const projectRoot = path.resolve(currentDir, '..'); L30: const termdockDir = path.join(os.homedir(), '.termdock'); L31: const desktopConfigPath = path.join(termdockDir, 'desktop.json'); ... L56: function triggerLocalNetworkPermission() { L57: if (process.platform !== 'darwin') L58: return;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

.desktop-dist/main.jsView on unpkg · L6

scripts/postinstall.mjsView file

10L11: import { execSync, spawnSync } from 'child_process'; L12: import { createRequire } from 'module'; ... L31: const r = spawnSync(cmd, [], { shell: true, timeout: timeoutMs, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }); L32: return { ok: r.status === 0, stdout: r.stdout, stderr: r.stderr }; L33: } catch { ... L51: const { ensureNodePty } = require_('./ensure-node-pty.cjs'); L52: const PTY_PATH = require_.resolve('node-pty/package.json', { paths: [pkgRoot] }).replace('/package.json', ''); L53: ... L83: const pty = require_(PTY_PATH); L84: const proc = pty.spawn(process.env.SHELL || '/bin/bash', [], { name: 'xterm', cols: 80, rows: 24 }); L85: proc.kill();

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.mjsView on unpkg · L10

•matchType = normalized_sha256 matchedPackage = termdock@1.4.268 matchedPath = scripts/postinstall.mjs matchedIdentity = npm:dGVybWRvY2s:1.4.268 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.mjsView on unpkg

dist/server/agent/installers.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import fs from 'node:fs'; import os from 'node:os'; import path from 'node:path'; import { execfile, spawn } from 'node:child_process'; import { agentbyslug, ispluginagent } from './registry.js'; import { loadplugins, resolvehooktarget } from './plugins.js'; export const hook_agents = ['claude', 'codex', 'copilot', 'opencode', 'pi', 'grok', 'kimi']; const display_names = { claude: 'claude code', codex: 'codex', copilot: 'copilot cli', opencode: 'opencode', pi: 'pi', grok: 'grok build', kimi: 'kimi code', };

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/server/agent/installers.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = termdock@1.4.268 matchedPath = dist/server/agent/installers.js matchedIdentity = npm:dGVybWRvY2s:1.4.268 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/agent/installers.jsView on unpkg

dist/client/assets/terminal-C7X98Amf.jsView file

4contains invisible/control Unicode U+200E (left-to-right mark) `)})),this._register(this._bufferService.onResize(()=>this.queueSync())),this._register(this._bufferService.buffers.onBufferActivate(()=>{this._latestYDisp=void 0,this.queueSync()})),this._register(this._bufferService.onScroll(()=>this._syn

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/client/assets/terminal-C7X98Amf.jsView on unpkg · L4

dist/server/cli.jsView file

4Detached bundled service listener: dist/server/cli.js spawns dist/server/entry.js; helper exposes a broad-bound HTTP listener. L4: // 设置（同步 fs 不占线程池，所以放在文件体顶部仍然足够早）。 L5: process.env.UV_THREADPOOL_SIZE ||= '16'; L6: import { config as loadDotenv } from 'dotenv'; ... L10: // dotenv 不会覆盖已存在的环境变量，因此系统环境变量和命令行参数优先级最高 L11: loadDotenv({ path: resolve(os.homedir(), '.termdock', '.env'), quiet: true }); L12: loadDotenv({ path: resolve(process.cwd(), '.env'), quiet: true }); ... L23: import { getMissingCertificateNames } from './utils/certificateNames.js'; L24: import http from 'http'; L25: import https from 'https'; ... L28: import { createHash, randomUUID } from 'crypto'; L29: import { spawn, spawnSync, execFile } from 'child_process'; L30: import { promisify } from 'util';

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/server/cli.jsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = termdock@1.4.268 matchedPath = dist/server/cli.js matchedIdentity = npm:dGVybWRvY2s:1.4.268 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/cli.jsView on unpkg

scripts/ensure-node-pty.cjsView file

51console.log('Rebuilding node-pty with the Termdock macOS FD cleanup fix...'); L52: const result = spawnSync('npx', ['--yes', 'node-gyp', 'rebuild'], { L53: cwd: ptyRoot, stdio: 'inherit', timeout: 180_000,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/ensure-node-pty.cjsView on unpkg · L51

dist/client/shell-integration/termdock.bashView file

•path = dist/client/shell-integration/termdock.bash kind = build_helper sizeBytes = 3514 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/client/shell-integration/termdock.bashView on unpkg

dist/client/sw-encrypted-background.js.brView file

•path = dist/client/sw-encrypted-background.js.br kind = high_entropy_blob sizeBytes = 65011 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/sw-encrypted-background.js.brView on unpkg

•path = dist/client/sw-encrypted-background.js.br kind = compressed_blob sizeBytes = 65011 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/client/sw-encrypted-background.js.brView on unpkg

scripts/android-bitrate/bitrate.jarView file

•path = scripts/android-bitrate/bitrate.jar kind = nested_archive_needs_inspection sizeBytes = 2609 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

scripts/android-bitrate/bitrate.jarView on unpkg

dist/client/assets/chunk-TICWLB2K-DibS9hjO.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/client/assets/chunk-TICWLB2K-DibS9hjO.js#virtual:normalized:round1View on unpkg

scripts/prepare-desktop-runtime.mjsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.268 matchedPath = scripts/prepare-desktop-runtime.mjs matchedIdentity = npm:dGVybWRvY2s:1.4.268 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/prepare-desktop-runtime.mjsView on unpkg

dist/server/agent/pluginPackages.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.268 matchedPath = [redacted].js matchedIdentity = npm:dGVybWRvY2s:1.4.268 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/agent/pluginPackages.jsView on unpkg

dist/server/android/adb.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.268 matchedPath = dist/server/android/adb.js matchedIdentity = npm:dGVybWRvY2s:1.4.268 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/android/adb.jsView on unpkg

dist/server/android/scrcpy.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.268 matchedPath = dist/server/android/scrcpy.js matchedIdentity = npm:dGVybWRvY2s:1.4.268 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/android/scrcpy.jsView on unpkg

dist/server/utils/npmUpdate.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.268 matchedPath = dist/server/utils/npmUpdate.js matchedIdentity = npm:dGVybWRvY2s:1.4.268 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server/utils/npmUpdate.jsView on unpkg

dist/client/assets/DiffViewer-B5Fj1S7h.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.268 matchedPath = dist/client/assets/DiffViewer-CYEoT3NM.js matchedIdentity = npm:dGVybWRvY2s:1.4.268 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/DiffViewer-B5Fj1S7h.jsView on unpkg

Source & flagged code

33 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/server/supervisor.jsView file

23*/ L24: import { spawn } from 'node:child_process'; L25: import fs from 'node:fs';

High

Child Process

Package source references child process execution.

dist/server/supervisor.jsView on unpkg · L23

Findings

3 Critical24 High8 Medium7 Low

CriticalDownload Execute.desktop-dist/main.js

CriticalTrojan Source Unicodedist/client/assets/terminal-C7X98Amf.js

CriticalTrigger Reachable Dangerous Capability.desktop-dist/main.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/server/supervisor.js

HighShelldist/server/utils/bootCheck.js

HighEvaldist/client/assets/diffWorker-BP4IBsm9.js

HighSame File Env Network Executiondist/server/ptyhost/manager.js

HighSandbox Evasion Gated Capabilityscripts/postinstall.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/server/agent/installers.js

HighSpawned Bundled Service Listener

Affected versions and remediation

This report applies to termdock@1.4.282.

See all versions of termdock for other recorded verdicts.

Review the evidence and your use of termdock@1.4.282 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-27 20:42:11.944Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.