registry / terminal-commander / 0.3.14
terminal-commander@0.3.14
Terminal Commander: local MCP-operated terminal/file signal channel with native Linux, Windows, and macOS packages.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe postinstall automatically writes first-party MCP configuration for detected coding agents, creating an agent extension lifecycle risk. The source shows opt-outs and CI/noninteractive guards, but no verified attack behavior that warrants blocking publication.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
An interactive, non-CI npm installation without either bootstrap opt-out variable.
Impact
The configured coding agents may start this package's MCP server in future sessions without a separate setup command.
Mechanism
The install bootstrap detects supported harnesses and writes MCP server configuration entries that launch this package's server.
AI rationale
The postinstall automatically writes first-party MCP configuration for detected coding agents, creating an agent extension lifecycle risk. The source shows opt-outs and CI/noninteractive guards, but no verified attack behavior that warrants blocking publication.
Evidence
package.jsonscripts/postinstall.jslib/bootstrap/orchestrator.jslib/harness/write_all.jslib/harness/paths.js
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package runs a postinstall script that starts bootstrap during package installation.
- Bootstrap configures detected harnesses in install mode and forces their configuration to refresh.
- The installer can write MCP server entries to detected coding-agent configuration files, including Codex configuration.
- The configuration entries launch this package's MCP server; this is first-party agent setup, but it occurs automatically during installation.
Evidence against
- The postinstall skips setup when either documented opt-out variable is set or the environment is detected as CI or noninteractive.
- Inspected source supports automatic first-party MCP setup; it does not establish a separate malicious action.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
11 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkglib/harness/paths.jsView file
49Install-time code directly mutates a foreign AI-agent control surface:
L49: const o = opts || {};
L50: return scopedPath(o, ".codex/config.toml", () => {
L51: const env = o.env || process.env;
L52: return env.CODEX_HOME ? path.join(env.CODEX_HOME, "config.toml") : expandHome("~/.codex/config.toml", o);
L53: });
...
L86: function claudeCodeSettingsPath(opts) {
L87: return expandHome("~/.claude/settings.json", opts);
L88: }
L89:
L90: /** User-scope MCP servers for Claude Code (official: ~/.claude.json). */
L91: function claudeCodeMcpConfigPath(opts) {
L92: return scopedPath(opts || {}, ".mcp.json", () => expandHome("~/.claude.json", opts));
Write operation from lib/daemon/autostart.js:
L187: const dir = path.dirname(filePath);
L188: fs.mkdirSync(dir, { recursive: true });
L189: const tmp =
Findings
1 Critical9 High4 Medium4 Low
CriticalAi Agent Control Hijacklib/harness/paths.js
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitedbin/terminal-commanderd.js#virtual:normalized:round1
HighKnown Malware Source Similaritybin/terminal-commander-mcp.js
HighKnown Malware Source Similaritylib/wsl/detect.js
HighKnown Malware Source Similaritybin/terminal-commanderd.js
HighKnown Malware Source Similaritylib/cli/setup_daemon_logon.js
HighKnown Malware Source Similaritylib/cli/run.js
HighKnown Malware Source Similaritylib/cli/setup_harness.js
HighPrevious Version Dangerous Deltabin/terminal-commander.js
Medium
Affected versions and remediation
This report applies to terminal-commander@0.3.14.
See all versions of terminal-commander for other recorded verdicts.
- Review the evidence and your use of terminal-commander@0.3.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.