registry / terminal-commander / 0.3.3
terminal-commander@0.3.3
Terminal Commander: local MCP-operated terminal/file signal channel with native Linux, Windows, and macOS packages.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe postinstall hook automatically adds this package's own MCP integration to detected agent configurations, a guarded first-party extension setup that merits warning under policy. I found no separate concrete attack behavior in the inspected paths.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
An interactive, non-CI npm installation without either opt-out environment flag.
Impact
Agent configuration files may be changed and the agent may load this package's MCP server after restart; no broader control change or separate attack behavior was established.
Mechanism
The hook runs install-mode bootstrap, which detects supported harnesses and writes the terminal-commander server entry.
AI rationale
The postinstall hook automatically adds this package's own MCP integration to detected agent configurations, a guarded first-party extension setup that merits warning under policy. I found no separate concrete attack behavior in the inspected paths.
Evidence
agent configuration files for detected providers
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package runs scripts/postinstall.js automatically after installation.
- On interactive, non-CI installs without either opt-out flag, the hook invokes bootstrap in install mode.
- Install mode enables automatic harness configuration, which writes this package's MCP server entry to detected agent configurations.
- The configured provider set includes Cursor, Codex CLI, Claude Code, Claude Desktop, and OMP.
- The manual setup command uses CLI mode and refreshes the package's named entry.
Evidence against
- The hook skips when TC_SKIP_BOOTSTRAP or TC_NO_AUTO_SETUP is set, and skips CI or noninteractive installs.
- The setup writes concern this package's own MCP server entry, consistent with its stated integration purpose.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
16 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkglib/cli/setup_cursor_wsl.jsView file
119Install-time code directly mutates a foreign AI-agent control surface:
L350: const text = serializeCursorMcpConfig({
L351: mcpServers: { [SERVER_NAME]: stanza },
L352: });
Write operation from lib/daemon/autostart.js:
L119: const dir = path.dirname(filePath);
L120: fs.mkdirSync(dir, { recursive: true });
L121: const tmp = path.join(dir, `.${path.basename(filePath)}.tmp-${process.pid}`);
L122: fs.writeFileSync(tmp, content, { encoding: "utf8", mode: mode || 0o644 });
L123: fs.renameSync(tmp, filePath);
Foreign user/project scope from lib/daemon/autostart.js:
L119: const dir = path.dirname(filePath);
L120: fs.mkdirSync(dir, { recursive: true });
L121: const tmp = path.join(dir, `.${path.basename(filePath)}.tmp-${process.pid}`);
L122: fs.writeFileSync(tmp, content, { encoding: "utf8", mode: m
Findings
1 Critical14 High4 Medium4 Low
CriticalAi Agent Control Hijacklib/cli/setup_cursor_wsl.js
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitedbin/terminal-commanderd.js#virtual:normalized:round1
HighKnown Malware Source Similaritybin/terminal-commander.js
HighKnown Malware Source Similaritylib/cli/update_preflight.js
HighKnown Malware Source Similaritylib/daemon/autostart.js
HighKnown Malware Source Similaritybin/terminal-commander-mcp.js
HighKnown Malware Source Similaritylib/bootstrap/ensure_wsl_runtime.js
HighKnown Malware Source Similaritylib/cli/doctor_daemon.js
HighKnown Malware Source Similaritylib/cli/restart.js
Affected versions and remediation
This report applies to terminal-commander@0.3.3.
See all versions of terminal-commander for other recorded verdicts.
- Review the evidence and your use of terminal-commander@0.3.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.