registry / terminal-commander / 0.1.85

terminal-commander@0.1.85

Terminal Commander: local MCP-operated terminal/file signal channel with native Linux, Windows, and macOS packages.

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 17 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 52 file(s), 297 KB of source, external domains: github.com, registry.npmjs.org

Source & flagged code

10 flagged

package.jsonView file

Lines 25-58json

25 "bin": {

26 "terminal-commanderd": "bin/terminal-commanderd.js",

27 "terminal-commander-mcp": "bin/terminal-commander-mcp.js",

28 "terminal-commander": "bin/terminal-commander.js"

29 },

30 "files": [

31 "bin/",

32 "lib/",

33 "scripts/",

34 "README.md",

35 "LICENSE"

36 ],

37 "optionalDependencies": {

38 "@terminal-commander/linux-x64": "0.1.85",

39 "@terminal-commander/linux-arm64": "0.1.85",

40 "@terminal-commander/windows-x64": "0.1.85",

41 "@terminal-commander/mac-x64": "0.1.85",

42 "@terminal-commander/mac-arm64": "0.1.85"

43 },

44 "scripts": {

45 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L45

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L45

46 "test": "node scripts/run-tests.js"

47 },

48 "engines": {

49 "node": ">=18",

50 "npm": ">=8"

51 },

52 "os": [

53 "linux",

54 "win32",

55 "darwin"

56 ]

57}

bin/terminal-commanderd.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2// SPDX-License-Identifier: PolyForm-Noncommercial-1.0.0

4//

5// NPM03 shim for `terminal-commanderd`, extended at WWS02 to add a

6// bridge-required branch for Windows hosts.

7//

8// Bounded behavior:

9//

10// - Reads only `process.platform` and `process.arch`.

11// - On Linux + supported arch + platform package installed:

lib/daemon/autostart.jsView file

Lines 1-31javascript

1// SPDX-License-Identifier: PolyForm-Noncommercial-1.0.0

3//

4// Install idempotent daemon autostart for Linux / WSL: systemd user

5// unit when available, otherwise a profile hook + background start.

7"use strict";

9const fs = require(

lib/wsl/native-mcp.jsView file

Lines 17-57javascript

18function findNativeLinuxMcp() {

19 const r = spawnSync("bash", ["-lc", `${LINUX_PATH_PREFIX}command -v terminal-commander-mcp`], {

20 encoding: "utf8",

bin/terminal-commander.jsView file

•matchType = normalized_sha256 matchedPackage = terminal-commander@0.1.76 matchedPath = bin/terminal-commander.js matchedIdentity = npm:dGVybWluYWwtY29tbWFuZGVy:0.1.76 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/terminal-commander.jsView on unpkg

lib/cli/update_preflight.jsView file

•matchType = normalized_sha256 matchedPackage = terminal-commander@0.1.76 matchedPath = lib/cli/update_preflight.js matchedIdentity = npm:dGVybWluYWwtY29tbWFuZGVy:0.1.76 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/cli/update_preflight.jsView on unpkg

bin/terminal-commander-mcp.jsView file

•matchType = normalized_sha256 matchedPackage = terminal-commander@0.1.76 matchedPath = bin/terminal-commander-mcp.js matchedIdentity = npm:dGVybWluYWwtY29tbWFuZGVy:0.1.76 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/terminal-commander-mcp.jsView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code