registry / terminal-commander / 0.3.10
terminal-commander@0.3.10
Terminal Commander: local MCP-operated terminal/file signal channel with native Linux, Windows, and macOS packages.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe active postinstall path can configure a detected coding-agent harness without a separate setup command, so this merits a warning for first-party agent setup during installation. The inspected path writes this package's MCP entry, and the source shows CI/noninteractive and opt-out guards; it does not establish a broader control-surface attack.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
An npm install lifecycle runs outside CI or a noninteractive environment, without either opt-out flag.
Impact
The package may modify a user's agent configuration during installation; the inspected behavior supports a lifecycle setup warning, not a confirmed attack.
Mechanism
The postinstall starts bootstrap in install mode, which enables automatic configuration and invokes harness configuration writers.
AI rationale
The active postinstall path can configure a detected coding-agent harness without a separate setup command, so this merits a warning for first-party agent setup during installation. The inspected path writes this package's MCP entry, and the source shows CI/noninteractive and opt-out guards; it does not establish a broader control-surface attack.
Evidence
package.jsonscripts/postinstall.jslib/bootstrap/orchestrator.jslib/harness/write_all.jsDetected coding-agent harness configuration files
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package runs a postinstall script that starts bootstrap in install mode.
- Install mode enables automatic harness configuration.
- The setup code writes a Terminal Commander MCP entry into a detected harness configuration file.
Evidence against
- The postinstall returns when either opt-out flag is set or the environment is identified as CI or noninteractive.
- The inspected setup path configures this package's own MCP entry; no unrelated agent-control change or credential transfer was identified.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
16 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkglib/cli/setup_cursor_wsl.jsView file
119Install-time code directly mutates a foreign AI-agent control surface:
L350: const text = serializeCursorMcpConfig({
L351: mcpServers: { [SERVER_NAME]: stanza },
L352: });
Write operation from lib/daemon/autostart.js:
L119: const dir = path.dirname(filePath);
L120: fs.mkdirSync(dir, { recursive: true });
L121: const tmp = path.join(dir, `.${path.basename(filePath)}.tmp-${process.pid}`);
L122: fs.writeFileSync(tmp, content, { encoding: "utf8", mode: mode || 0o644 });
L123: fs.renameSync(tmp, filePath);
Foreign user/project scope from lib/daemon/autostart.js:
L119: const dir = path.dirname(filePath);
L120: fs.mkdirSync(dir, { recursive: true });
L121: const tmp = path.join(dir, `.${path.basename(filePath)}.tmp-${process.pid}`);
L122: fs.writeFileSync(tmp, content, { encoding: "utf8", mode: m
Findings
1 Critical14 High4 Medium4 Low
CriticalAi Agent Control Hijacklib/cli/setup_cursor_wsl.js
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitedbin/terminal-commanderd.js#virtual:normalized:round1
HighKnown Malware Source Similaritylib/cli/update_preflight.js
HighKnown Malware Source Similaritylib/daemon/autostart.js
HighKnown Malware Source Similaritybin/terminal-commander-mcp.js
HighKnown Malware Source Similaritylib/bootstrap/ensure_wsl_runtime.js
HighKnown Malware Source Similaritylib/cli/doctor_daemon.js
HighKnown Malware Source Similaritylib/cli/restart.js
HighKnown Malware Source Similaritylib/cli/setup_cursor_wsl.js
Affected versions and remediation
This report applies to terminal-commander@0.3.10.
See all versions of terminal-commander for other recorded verdicts.
- Review the evidence and your use of terminal-commander@0.3.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.