@drdeeks/character-kit: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@drdeeks/character-kit: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node node/bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node node/bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

deploy/ack_watchdog.jsView file

18import { fileURLToPath } from "url"; L19: import { spawn, spawnSync } from "child_process"; L20:

High

Child Process

Package source references child process execution.

deploy/ack_watchdog.jsView on unpkg · L18

•matchType = normalized_sha256 matchedPackage = @drdeeks/character-kit@1.2.1 matchedPath = deploy/ack_watchdog.js matchedIdentity = npm:QGRyZGVla3MvY2hhcmFjdGVyLWtpdA:1.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

deploy/ack_watchdog.jsView on unpkg

node/bin/install.jsView file

264L265: // MOD-007: `spawn()` not throwing means the OS accepted the fork request, L266: // not that the process is still running or responding to RPC a moment ... L268: // through EnforcerClient (client.js), since that reads its token from L269: // process.env.ACK_AUTH_TOKEN globally, and mutating the installer's own L270: // process-wide env for a single liveness check is worse than a small ... L276: if (!fs.existsSync(sock)) { resolve({ error: "socket not found" }); return; } L277: const socket = net.createConnection(sock); L278: let data = "";

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

node/bin/install.jsView on unpkg · L264

65Install-time code directly mutates a foreign AI-agent control surface: L157: const lines = Object.entries(vars).map(([k, v]) => `${k}=${v}`); L158: fs.writeFileSync(envPath, lines.join("\n") + "\n"); L159: // Contains ACK_AUTH_TOKEN -- the hook command below sources this file to ... L178: export function claudeSettingsPath() { L179: return path.join(os.homedir(), ".claude", "settings.json"); L180: } ... L189: const candidates = [ L190: { harness: "claude", marker: path.join(home, ".claude", "settings.json") }, L191: { harness: "hermes", marker: path.join(home, ".hermes") }, ... L233: L234: fs.mkdirSync(path.dirname(p), { recursive: true }); L235: fs.writeFileSync(p, JSON.stringify(settings, null, 2) + "\n"); Write operation from node/bin/postinstall.js: L65: const write = (line) => { L66:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

node/bin/install.jsView on unpkg · L65

python/tests/ack_monitor_multi_agent_test.pyView file

•path = python/tests/ack_monitor_multi_agent_test.py kind = payload_in_excluded_dir sizeBytes = 5026 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

python/tests/ack_monitor_multi_agent_test.pyView on unpkg

•path = python/tests/ack_monitor_multi_agent_test.py kind = build_helper sizeBytes = 5026 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/tests/ack_monitor_multi_agent_test.pyView on unpkg

node/bin/ack.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @drdeeks/character-kit@1.5.0 matchedIdentity = npm:QGRyZGVla3MvY2hhcmFjdGVyLWtpdA:1.5.0 similarity = 0.871 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

node/bin/ack.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 1-35json

1{

2 "name": "@drdeeks/character-kit",

3 "version": "1.6.0",

4 "description": "Universal agent character enforcement, knowledge indexing, and memory with YAML frontmatter. True plugin: install once, reference as @character-kit in any harness config.",

5 "main": "node/src/index.js",

6 "bin": {

7 "ack": "node/bin/ack.js",

8 "character-kit": "node/bin/ack.js"

9 },

10 "type": "module",

11 "scripts": {

12 "test": "node --test node/tests/*.test.js",

13 "start": "node node/bin/ack.js",

14 "ack-install": "node node/bin/install.js",

15 "postinstall": "node node/bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L15

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L15

16 "preuninstall": "node node/bin/preuninstall.js"

17 },

18 "keywords": [

19 "agent",

20 "character",

21 "agent-character",

22 "enforcement",

23 "knowledge",

24 "memory",

25 "semantic-search",

26 "hooks",

27 "yaml",

28 "frontmatter",

29 "claude",

30 "cursor",

31 "gemini",

32 "hermes",

33 "opencode"

34 ],

35 "author": "drdeeks",

deploy/ack_watchdog.jsView file

Lines 1-38javascript

1#!/usr/bin/env node

2/**

3 * ACK monitor watchdog (self-healing companion, Node-native).

4 *

5 * Node port of ack_watchdog.py. Revives the acknowledgment monitor

6 * (ack_monitor.js) if it dies, and revives the enforcer daemon itself in

7 * root-mode installs. This is the self-healing layer: no single process in

8 * the daemon/monitor/watchdog trio is a point of failure on its own.

9 *

10 * Revival order: prefer `systemctl restart <unit>` (idempotent, re-reads the

node/bin/install.jsView file

Lines 45-85javascript

45// stays available only for a Python-based deployment; it is never required

46// just to get the self-healing trio running, only for the Hermes companion.

47const MONITOR = path.join(REPO, "deploy", "ack_monitor.js");

48const WATCHDOG = path.join

python/tests/ack_monitor_multi_agent_test.pyView file

•path = python/tests/ack_monitor_multi_agent_test.py kind = payload_in_excluded_dir sizeBytes = 5026 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

python/tests/ack_monitor_multi_agent_test.pyView on unpkg

•path = python/tests/ack_monitor_multi_agent_test.py kind = build_helper sizeBytes = 5026 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/tests/ack_monitor_multi_agent_test.pyView on unpkg

node/bin/ack.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @drdeeks/character-kit@1.5.0 matchedIdentity = npm:QGRyZGVla3MvY2hhcmFjdGVyLWtpdA:1.5.0 similarity = 0.871 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

node/bin/ack.jsView on unpkg

Lines 244-284javascript

244 for (const f of fs.readdirSync(src)) {

245 if (f.endsWith(".yaml") && !fs.existsSync(path.join(dst, f))) {

246 fs.copyFileSync(path.join(src, f), path.join(dst, f));

247 }

248 }

249 }

250}

251

252function writeConstitution(ws) {

253 const dst = path.join(ws, ".agent", "constitution.yaml");

254 if (!fs.existsSync(dst)) {

255 fs.writeFileSync(dst, [

256 "# Agent Character Kit — constitution (hard constraints).",

257 "# The daemon embeds safe defaults; this file OVERRIDES/extends them.",

258 "hard_constraints:",

259 " - no_credential_leak: block any tool call that would expose a secret",

260 " - no_destructive_without_confirm: block rm -rf /, mkfs, dd on disks, etc. unless confirmed",

261 ].join("\n") + "\n");

262 }

263}

264

265// MOD-007: `spawn()` not throwing means the OS accepted the fork request,

266// not that the process is still running or responding to RPC a moment

267// later. A minimal, self-contained status ping -- deliberately not routed

268// through EnforcerClient (client.js), since that reads its token from

269// process.env.ACK_AUTH_TOKEN globally, and mutating the installer's own

270// process-wide env for a single liveness check is worse than a small

271// self-contained call, matching the same self-containment reasoning

272// ack_monitor.js's own header comment gives for not importing the repo's

273// shared client.

274export function pingDaemonStatus(sock, token) {

275 return new Promise((resolve) => {

276 if (!fs.existsSync(sock)) { resolve({ error: "socket not found" }); return; }

277 const socket = net.createConnection(sock);

278 let data = "";

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

node/bin/install.jsView on unpkg · L264

279 const timeout = setTimeout(() => { socket.destroy(); resolve({ error: "timeout" }); }, 4000);

280 socket.on("connect", () => {

281 socket.write(JSON.stringify({ method: "status", params: {}, token }) + "\n");

282 });

283 socket.on("data", (chunk) => {

284 data += chunk.toString();