registry / terminal-commander / 0.3.1
terminal-commander@0.3.1
Terminal Commander: local MCP-operated terminal/file signal channel with native Linux, Windows, and macOS packages.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe postinstall hook performs first-party MCP harness setup, with opt-out and CI/non-interactive guards. This warrants a warning for lifecycle-driven agent configuration changes, but the inspected source does not establish a broader control-surface attack or other concrete malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
An interactive npm installation that does not set the package's opt-out flags.
Impact
Agent harness configuration may be changed during installation to add this package's MCP server.
Mechanism
The postinstall hook invokes bootstrap in install mode, which enables auto-configuration and writes the package's MCP entry into detected harness configuration.
AI rationale
The postinstall hook performs first-party MCP harness setup, with opt-out and CI/non-interactive guards. This warrants a warning for lifecycle-driven agent configuration changes, but the inspected source does not establish a broader control-surface attack or other concrete malicious behavior.
Evidence
package.jsonscripts/postinstall.jslib/bootstrap/orchestrator.jslib/harness/write_all.jslib/harness/io/json_mcp.js
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package runs scripts/postinstall.js after installation.
- On interactive installs without the opt-out flags, postinstall calls runBootstrap in install mode.
- Install mode enables automatic configuration and writes this package's MCP server entry to detected harness configuration.
- The JSON writer merges the named server entry while preserving other server entries.
Evidence against
- The postinstall path skips when opted out or when CI/non-interactive detection applies.
- The inspected behavior configures this package's own MCP integration; no unrelated credential transfer or dependency approval change was identified.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
16 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkglib/cli/setup_cursor_wsl.jsView file
119Install-time code directly mutates a foreign AI-agent control surface:
L350: const text = serializeCursorMcpConfig({
L351: mcpServers: { [SERVER_NAME]: stanza },
L352: });
Write operation from lib/daemon/autostart.js:
L119: const dir = path.dirname(filePath);
L120: fs.mkdirSync(dir, { recursive: true });
L121: const tmp = path.join(dir, `.${path.basename(filePath)}.tmp-${process.pid}`);
L122: fs.writeFileSync(tmp, content, { encoding: "utf8", mode: mode || 0o644 });
L123: fs.renameSync(tmp, filePath);
Foreign user/project scope from lib/daemon/autostart.js:
L119: const dir = path.dirname(filePath);
L120: fs.mkdirSync(dir, { recursive: true });
L121: const tmp = path.join(dir, `.${path.basename(filePath)}.tmp-${process.pid}`);
L122: fs.writeFileSync(tmp, content, { encoding: "utf8", mode: m
Findings
1 Critical14 High4 Medium4 Low
CriticalAi Agent Control Hijacklib/cli/setup_cursor_wsl.js
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitedbin/terminal-commanderd.js#virtual:normalized:round1
HighKnown Malware Source Similaritybin/terminal-commander.js
HighKnown Malware Source Similaritylib/cli/update_preflight.js
HighKnown Malware Source Similaritylib/daemon/autostart.js
HighKnown Malware Source Similaritybin/terminal-commander-mcp.js
HighKnown Malware Source Similaritylib/bootstrap/ensure_wsl_runtime.js
HighKnown Malware Source Similaritylib/cli/doctor_daemon.js
HighKnown Malware Source Similaritylib/cli/restart.js
Affected versions and remediation
This report applies to terminal-commander@0.3.1.
See all versions of terminal-commander for other recorded verdicts.
- Review the evidence and your use of terminal-commander@0.3.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.