Loading npm security reports…

terminal-commander@0.1.87: AI-agent control-surface risk | LPM Firewall

registry / terminal-commander / 0.1.87

terminal-commander@0.1.87

Terminal Commander: local MCP-operated terminal/file signal channel with native Linux, Windows, and macOS packages.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On interactive npm install, the package detects installed AI-agent harnesses and forcibly registers its MCP executable in their user-level configurations. It can also create persistent daemon autostart through systemd or shell profiles.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall during an interactive, non-CI installation without skip flags

Impact

Unconsented registration of a package-controlled executable as a tool server for Codex, Cursor, and Claude agents, with persistent background daemon startup.

Mechanism

automatic foreign AI-agent MCP configuration plus daemon persistence

Policy narrative

Installing the package invokes postinstall, which runs bootstrap in install mode. Bootstrap detects third-party AI-agent installations and calls writers with force enabled, inserting a Terminal Commander MCP server into their configurations. On Linux/WSL it also installs and starts a persistent daemon through a systemd user unit or profile hooks. These changes occur without an explicit setup command.

Rationale

This is a concrete postinstall mutation of broad, foreign AI-agent control surfaces, compounded by automatic persistence. Safeguards and lack of observed exfiltration do not establish consent for these install-time changes.

Evidence

package.jsonscripts/postinstall.jslib/bootstrap/orchestrator.jslib/harness/detect.jslib/harness/write_all.jslib/daemon/autostart.js~/.cursor/mcp.json

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/daemon/autostart.jsView file

11Trigger-reachable persistence chain: scripts.postinstall -> scripts/postinstall.js -> lib/bootstrap/orchestrator.js -> lib/daemon/autostart.js L11: const os = require("node:os"); L12: const { spawnSync } = require("node:child_process"); L13: const { applyManagedBlock, hasManagedBlock } = require("./managed_block.js"); ... L34: function shouldInstallDaemonAutostart(env) { L35: const e = env || process.env; L36: if (e.TC_SKIP_DAEMON_AUTOSTART === "1") return false; ... L44: set -eu L45: TC_DATA="\${TC_DATA:-$HOME/.local/share/terminal-commanderd}" L46: SOCK="\$TC_DATA/terminal-commanderd.sock" ... L68: Description=Terminal Commander daemon (user) L69: Documentation=https://github.com/special-place-ai-heaven/terminal-commander L70: After=default.target

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

lib/daemon/autostart.jsView on unpkg · L11

•matchType = normalized_sha256 matchedPackage = terminal-commander@0.1.76 matchedPath = lib/daemon/autostart.js matchedIdentity = npm:dGVybWluYWwtY29tbWFuZGVy:0.1.76 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/daemon/autostart.jsView on unpkg

11const os = require("node:os"); L12: const { spawnSync } = require("node:child_process"); L13: const { applyManagedBlock, hasManagedBlock } = require("./managed_block.js"); ... L34: function shouldInstallDaemonAutostart(env) { L35: const e = env || process.env; L36: if (e.TC_SKIP_DAEMON_AUTOSTART === "1") return false; ... L44: set -eu L45: TC_DATA="\${TC_DATA:-$HOME/.local/share/terminal-commanderd}" L46: SOCK="\$TC_DATA/terminal-commanderd.sock" ... L68: Description=Terminal Commander daemon (user) L69: Documentation=https://github.com/special-place-ai-heaven/terminal-commander L70: After=default.target

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

lib/daemon/autostart.jsView on unpkg · L11

lib/cli/setup_cursor_wsl.jsView file

119Install-time code directly mutates a foreign AI-agent control surface: L350: const text = serializeCursorMcpConfig({ L351: mcpServers: { [SERVER_NAME]: stanza }, L352: }); Write operation from lib/daemon/autostart.js: L119: const dir = path.dirname(filePath); L120: fs.mkdirSync(dir, { recursive: true }); L121: const tmp = path.join(dir, `.${path.basename(filePath)}.tmp-${process.pid}`); L122: fs.writeFileSync(tmp, content, { encoding: "utf8", mode: mode || 0o644 }); L123: fs.renameSync(tmp, filePath); Foreign user/project scope from lib/daemon/autostart.js: L119: const dir = path.dirname(filePath); L120: fs.mkdirSync(dir, { recursive: true }); L121: const tmp = path.join(dir, `.${path.basename(filePath)}.tmp-${process.pid}`); L122: fs.writeFileSync(tmp, content, { encoding: "utf8", mode: m

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

lib/cli/setup_cursor_wsl.jsView on unpkg · L119

bin/terminal-commander.jsView file

•matchType = normalized_sha256 matchedPackage = terminal-commander@0.1.76 matchedPath = bin/terminal-commander.js matchedIdentity = npm:dGVybWluYWwtY29tbWFuZGVy:0.1.76 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/terminal-commander.jsView on unpkg

lib/cli/update_preflight.jsView file

•matchType = normalized_sha256 matchedPackage = terminal-commander@0.1.76 matchedPath = lib/cli/update_preflight.js matchedIdentity = npm:dGVybWluYWwtY29tbWFuZGVy:0.1.76 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/cli/update_preflight.jsView on unpkg

bin/terminal-commander-mcp.jsView file

•matchType = normalized_sha256 matchedPackage = terminal-commander@0.1.76 matchedPath = bin/terminal-commander-mcp.js matchedIdentity = npm:dGVybWluYWwtY29tbWFuZGVy:0.1.76 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/terminal-commander-mcp.jsView on unpkg

lib/bootstrap/ensure_wsl_runtime.jsView file

•matchType = normalized_sha256 matchedPackage = terminal-commander@0.1.76 matchedPath = lib/bootstrap/ensure_wsl_runtime.js matchedIdentity = npm:dGVybWluYWwtY29tbWFuZGVy:0.1.76 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/bootstrap/ensure_wsl_runtime.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 25-58json

25 "bin": {

26 "terminal-commanderd": "bin/terminal-commanderd.js",

27 "terminal-commander-mcp": "bin/terminal-commander-mcp.js",

28 "terminal-commander": "bin/terminal-commander.js"

29 },

30 "files": [

31 "bin/",

32 "lib/",

33 "scripts/",

34 "README.md",

35 "LICENSE"

36 ],

37 "optionalDependencies": {

38 "@terminal-commander/linux-x64": "0.1.87",

39 "@terminal-commander/linux-arm64": "0.1.87",

40 "@terminal-commander/windows-x64": "0.1.87",

41 "@terminal-commander/mac-x64": "0.1.87",

42 "@terminal-commander/mac-arm64": "0.1.87"

43 },

44 "scripts": {

45 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L45

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L45

46 "test": "node scripts/run-tests.js"

47 },

48 "engines": {

49 "node": ">=18",

50 "npm": ">=8"

51 },

52 "os": [

53 "linux",

54 "win32",

55 "darwin"

56 ]

57}

58

lib/daemon/autostart.jsView file

Lines 1-31javascript

1// SPDX-License-Identifier: PolyForm-Noncommercial-1.0.0

2// Copyright 2026 The Terminal Commander Authors

3//

4// Install idempotent daemon autostart for Linux / WSL: systemd user

5// unit when available, otherwise a profile hook + background start.

6

7"use strict";

8

9const fs = require(

lib/cli/setup_cursor_wsl.jsView file

Lines 99-139javascript

99 if (env && env.TC_WSL_DISTRO) {

100 if (!isSafeDistroName(env.TC_WSL_DISTRO)) {

101 return { status: SETUP_STATUSES.UNSAFE_DISTRO_NAME, distro: env.TC_WSL_DISTRO };

bin/terminal-commander.jsView file

•matchType = normalized_sha256 matchedPackage = terminal-commander@0.1.76 matchedPath = bin/terminal-commander.js matchedIdentity = npm:dGVybWluYWwtY29tbWFuZGVy:0.1.76 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/terminal-commander.jsView on unpkg

lib/cli/update_preflight.jsView file

•matchType = normalized_sha256 matchedPackage = terminal-commander@0.1.76 matchedPath = lib/cli/update_preflight.js matchedIdentity = npm:dGVybWluYWwtY29tbWFuZGVy:0.1.76 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/cli/update_preflight.jsView on unpkg

bin/terminal-commander-mcp.jsView file

•matchType = normalized_sha256 matchedPackage = terminal-commander@0.1.76 matchedPath = bin/terminal-commander-mcp.js matchedIdentity = npm:dGVybWluYWwtY29tbWFuZGVy:0.1.76 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/terminal-commander-mcp.jsView on unpkg

lib/bootstrap/ensure_wsl_runtime.jsView file

•matchType = normalized_sha256 matchedPackage = terminal-commander@0.1.76 matchedPath = lib/bootstrap/ensure_wsl_runtime.js matchedIdentity = npm:dGVybWluYWwtY29tbWFuZGVy:0.1.76 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/bootstrap/ensure_wsl_runtime.jsView on unpkg