registry / terminal-commander / 0.3.5
terminal-commander@0.3.5
Terminal Commander: local MCP-operated terminal/file signal channel with native Linux, Windows, and macOS packages.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe package has an automatic postinstall path that modifies detected coding-agent configuration to add its own MCP server. Its scope and guards support a lifecycle setup warning, while inspected source does not establish an unconsented broad control-surface attack.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
An eligible interactive npm install that does not set an opt-out flag.
Impact
The configured coding agents can launch terminal-commander's MCP server. The automatic configuration change presents lifecycle risk, but the inspected code does not establish a broader control-surface attack.
Mechanism
The install bootstrap enumerates detected harnesses and writes this package's server configuration, including a per-harness session token.
AI rationale
The package has an automatic postinstall path that modifies detected coding-agent configuration to add its own MCP server. Its scope and guards support a lifecycle setup warning, while inspected source does not establish an unconsented broad control-surface attack.
Evidence
package.jsonscripts/postinstall.jslib/bootstrap/orchestrator.jslib/harness/write_all.js
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The npm postinstall hook runs the setup bootstrap during eligible interactive installs.
- The install bootstrap automatically configures detected harnesses and forces its configuration path.
- The writer adds this package's MCP server configuration to supported harness files.
- The hook skips when either opt-out is set and skips CI or noninteractive installs.
Evidence against
- Harness configuration is limited to detected providers, and the written entry launches this package's own MCP server.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
16 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkglib/cli/setup_cursor_wsl.jsView file
119Install-time code directly mutates a foreign AI-agent control surface:
L350: const text = serializeCursorMcpConfig({
L351: mcpServers: { [SERVER_NAME]: stanza },
L352: });
Write operation from lib/daemon/autostart.js:
L119: const dir = path.dirname(filePath);
L120: fs.mkdirSync(dir, { recursive: true });
L121: const tmp = path.join(dir, `.${path.basename(filePath)}.tmp-${process.pid}`);
L122: fs.writeFileSync(tmp, content, { encoding: "utf8", mode: mode || 0o644 });
L123: fs.renameSync(tmp, filePath);
Foreign user/project scope from lib/daemon/autostart.js:
L119: const dir = path.dirname(filePath);
L120: fs.mkdirSync(dir, { recursive: true });
L121: const tmp = path.join(dir, `.${path.basename(filePath)}.tmp-${process.pid}`);
L122: fs.writeFileSync(tmp, content, { encoding: "utf8", mode: m
Findings
1 Critical14 High4 Medium4 Low
CriticalAi Agent Control Hijacklib/cli/setup_cursor_wsl.js
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitedbin/terminal-commanderd.js#virtual:normalized:round1
HighKnown Malware Source Similaritybin/terminal-commander.js
HighKnown Malware Source Similaritylib/cli/update_preflight.js
HighKnown Malware Source Similaritylib/daemon/autostart.js
HighKnown Malware Source Similaritybin/terminal-commander-mcp.js
HighKnown Malware Source Similaritylib/bootstrap/ensure_wsl_runtime.js
HighKnown Malware Source Similaritylib/cli/doctor_daemon.js
HighKnown Malware Source Similaritylib/cli/restart.js
Affected versions and remediation
This report applies to terminal-commander@0.3.5.
See all versions of terminal-commander for other recorded verdicts.
- Review the evidence and your use of terminal-commander@0.3.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.