registry / terminal-commander / 0.3.6
terminal-commander@0.3.6
Terminal Commander: local MCP-operated terminal/file signal channel with native Linux, Windows, and macOS packages.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe active postinstall performs first-party agent setup and can enable daemon autostart, so it merits a warning. The inspected source supports agent_extension_lifecycle_risk, not a publish block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
An npm postinstall on an interactive, non-CI install without the package opt-out flags.
Impact
Agent configuration and startup behavior may be changed without a separate setup command; no concrete malicious action was identified in the inspected behavior.
Mechanism
The postinstall hook invokes install-mode bootstrap, which enables automatic harness configuration and may install daemon autostart.
AI rationale
The active postinstall performs first-party agent setup and can enable daemon autostart, so it merits a warning. The inspected source supports agent_extension_lifecycle_risk, not a publish block.
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json runs scripts/postinstall.js during installation.
- The hook skips opted-out and CI/noninteractive installs, then invokes install-mode bootstrap.
- Install and lazy bootstrap modes enable automatic harness configuration.
- The harness writer targets all detected providers by default.
- Linux bootstrap may install daemon autostart during the install flow.
Evidence against
- This is package-owned MCP setup for the package’s own server; the inspected code does not establish unrelated agent-control mutation or a concrete malicious payload.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
16 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkglib/cli/setup_cursor_wsl.jsView file
119Install-time code directly mutates a foreign AI-agent control surface:
L350: const text = serializeCursorMcpConfig({
L351: mcpServers: { [SERVER_NAME]: stanza },
L352: });
Write operation from lib/daemon/autostart.js:
L119: const dir = path.dirname(filePath);
L120: fs.mkdirSync(dir, { recursive: true });
L121: const tmp = path.join(dir, `.${path.basename(filePath)}.tmp-${process.pid}`);
L122: fs.writeFileSync(tmp, content, { encoding: "utf8", mode: mode || 0o644 });
L123: fs.renameSync(tmp, filePath);
Foreign user/project scope from lib/daemon/autostart.js:
L119: const dir = path.dirname(filePath);
L120: fs.mkdirSync(dir, { recursive: true });
L121: const tmp = path.join(dir, `.${path.basename(filePath)}.tmp-${process.pid}`);
L122: fs.writeFileSync(tmp, content, { encoding: "utf8", mode: m
Findings
1 Critical14 High4 Medium4 Low
CriticalAi Agent Control Hijacklib/cli/setup_cursor_wsl.js
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitedbin/terminal-commanderd.js#virtual:normalized:round1
HighKnown Malware Source Similaritybin/terminal-commander.js
HighKnown Malware Source Similaritylib/cli/update_preflight.js
HighKnown Malware Source Similaritylib/daemon/autostart.js
HighKnown Malware Source Similaritybin/terminal-commander-mcp.js
HighKnown Malware Source Similaritylib/bootstrap/ensure_wsl_runtime.js
HighKnown Malware Source Similaritylib/cli/doctor_daemon.js
HighKnown Malware Source Similaritylib/cli/restart.js
Affected versions and remediation
This report applies to terminal-commander@0.3.6.
See all versions of terminal-commander for other recorded verdicts.
- Review the evidence and your use of terminal-commander@0.3.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.