registry / @botiverse/kimi-code-sdk / 0.26.0

@botiverse/kimi-code-sdk@0.26.0

Botiverse repackage of @moonshot-ai/kimi-code-sdk (from kimi-code @moonshot-ai/kimi-code@0.26.0) — built node-sdk bundle for Slock. Mirror of MoonshotAI/kimi-code.

AI Security Review

scanned 8h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

A host application creates a Kimi session/harness or explicitly invokes hook/config/MCP APIs.

Impact

A consuming application can grant the embedded agent command execution and user-level Kimi configuration changes.

Mechanism

Runtime shell-hook execution and Kimi configuration/MCP persistence.

Rationale

This is not concrete malware, but the published SDK contains a real dual-use agent-control surface beyond a narrow API client. Warn rather than block because execution and persistence are runtime, package-aligned APIs rather than unconsented install-time behavior.

Evidence

package.jsondist/index.mjs

Network endpoints2

api.moonshot.ai/v1models.dev/api.json

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

@botiverse/kimi-code-sdk@0.26.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code