registry / terminal-commander / 0.3.15
terminal-commander@0.3.15
Terminal Commander: local MCP-operated terminal/file signal channel with native Linux, Windows, and macOS packages.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe package’s postinstall can configure detected agent harnesses without an explicit setup command. This is first-party package-owned agent setup, which warrants a warning; the inspected source does not establish a concrete attack that supports blocking publication.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
npm runs the package’s postinstall hook outside CI or noninteractive environments, unless an environment opt-out is set.
Impact
Agent configuration is changed to register this package’s MCP server; the inspected evidence does not establish credential theft or an unrelated account action.
Mechanism
The hook invokes bootstrap in install mode, which enables automatic harness configuration for detected providers.
AI rationale
The package’s postinstall can configure detected agent harnesses without an explicit setup command. This is first-party package-owned agent setup, which warrants a warning; the inspected source does not establish a concrete attack that supports blocking publication.
Evidence
package.jsonscripts/postinstall.jslib/bootstrap/orchestrator.jslib/cli/setup_harness.jslib/harness/write_all.jsagent configuration files selected by detected providers
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package declares a postinstall script that runs scripts/postinstall.js.
- On eligible installs, the hook calls runBootstrap in install mode; CI and noninteractive installs and explicit opt-outs skip it.
- Install mode enables automatic harness configuration, and the setup command also requests activation and automatic configuration.
- The setup path writes configurations for detected providers, so the hook can register this package’s MCP server with detected coding agents.
Evidence against
- The inspected setup path concerns registering this package’s own MCP server; no unrelated account action or credential transfer was established.
- The hook includes CI/noninteractive and environment opt-outs, but otherwise runs without an explicit setup command.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
11 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkglib/harness/paths.jsView file
49Install-time code directly mutates a foreign AI-agent control surface:
L49: const o = opts || {};
L50: return scopedPath(o, ".codex/config.toml", () => {
L51: const env = o.env || process.env;
L52: return env.CODEX_HOME ? path.join(env.CODEX_HOME, "config.toml") : expandHome("~/.codex/config.toml", o);
L53: });
...
L86: function claudeCodeSettingsPath(opts) {
L87: return expandHome("~/.claude/settings.json", opts);
L88: }
L89:
L90: /** User-scope MCP servers for Claude Code (official: ~/.claude.json). */
L91: function claudeCodeMcpConfigPath(opts) {
L92: return scopedPath(opts || {}, ".mcp.json", () => expandHome("~/.claude.json", opts));
Write operation from lib/daemon/autostart.js:
L187: const dir = path.dirname(filePath);
L188: fs.mkdirSync(dir, { recursive: true });
L189: const tmp =
Findings
1 Critical9 High4 Medium4 Low
CriticalAi Agent Control Hijacklib/harness/paths.js
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitedbin/terminal-commanderd.js#virtual:normalized:round1
HighKnown Malware Source Similaritybin/terminal-commander-mcp.js
HighKnown Malware Source Similaritylib/wsl/detect.js
HighKnown Malware Source Similaritybin/terminal-commanderd.js
HighKnown Malware Source Similaritylib/cli/setup_daemon_logon.js
HighKnown Malware Source Similaritylib/cli/run.js
HighKnown Malware Source Similaritylib/cli/setup_harness.js
HighPrevious Version Dangerous Deltabin/terminal-commander.js
Medium
Affected versions and remediation
This report applies to terminal-commander@0.3.15.
See all versions of terminal-commander for other recorded verdicts.
- Review the evidence and your use of terminal-commander@0.3.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.