@aicommander/agent — a declared remote-execution agent whose RAT-class capability (remote root shell-as-a-service) warrants a malware classification

@aicommander/agent is distributed on npm as the host-side agent for the commercial “AI Commander” service (aicommander.dev). Its own package description states its purpose plainly: it “lets Claude, Codex and other AI agents run shell commands and detached long-running jobs” on the host, with “no exposed SSH, open ports, or VPN.”

Installed on a developer or server machine, the agent dials out to the vendor's relay and executes commands delivered through that relay. Elevated execution is available through a bundled privileged helper reached over local IPC (127.0.0.1 / a unix socket), and the agent installs persistence so it keeps running across reboots.

codelake classifies @aicommander/agent as malicious on a capability basis. Independent of the vendor's intent, the package installs the exact capability set that defines a Remote Access Trojan:

(1) arbitrary remote shell-command execution on the host; (2) driven by a remote control plane; (3) able to run as root / LocalSystem through a privileged helper; (4) with installed persistence (systemd scope, macOS launch daemon, Windows scheduled task); and (5) a bundled native execution launcher.

Any compromise of the vendor's relay or account — or a single malicious update — converts every machine running the agent into a remotely-controlled, root-capable endpoint. A package that ships this capability to developer and production hosts is, in codelake's assessment, indistinguishable in risk from a RAT, and is treated as such.

In the interest of accuracy: codelake's code review found no covert malicious mechanism in any published version. There is no hidden reverse shell (a child process's stdio is never bound to a remote socket), no download-and-execute dropper (the native launcher is bundled in the package, not fetched at runtime), and no third-party data exfiltration (the only external host is the vendor's own aicommander.dev, which is host-locked in code; the relay is authenticated, and the tool even embeds prompt-injection defenses and destructive-command confirmations).

This classification is therefore a judgment about dangerous capability, not a finding of covert theft or a backdoor. Operators who deliberately adopt AI Commander as a remote-execution product should weigh that capability — unrestricted, elevated, persistent remote code execution on the host — accordingly.

All published versions are covered by this classification: 1.0.34 through 1.5.0. The remote-execution capability is present and materially identical across the range; the bundled native Windows launcher was added during the 1.4.x line. Later point releases changed only AI-guidance text and local job-lifecycle bookkeeping.