Loading npm security reports…

@gleapai/kai-bridge@0.10.2: Suspicious npm security report (Warn) | LPM Firewall

registry / @gleapai/kai-bridge / 0.10.2

@gleapai/kai-bridge@0.10.2

Kai Code Bridge runs Kai Code on your computer or server with your own coding subscriptions and local previews.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The npm postinstall hook changes installed agent-adapter and browser-automation dependency source without an explicit user command. A running daemon can later reinstall newer package releases, which reruns that lifecycle hook. No confirmed credential theft or external control-surface takeover was identified.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing the package runs postinstall; an enabled daemon update installs a newer global release.

Impact

Installed agent-related dependency behavior can change automatically. The inspected code confines the changes to package-resolved dependencies, so no confirmed broader attack surface was established.

Mechanism

The hook calls routines that modify resolved ACP and Playwright dependency files. The updater invokes npm global install for a selected newer version.

AI rationale

Automatic postinstall rewriting of agent-adjacent dependencies, combined with automatic self-updates, is a guarded extension lifecycle risk. The inspected scope does not establish malware or a block-worthy broad control-surface mutation.

Evidence

package.jsonscripts/postinstall.mjssrc/acp-patch.mjssrc/playwright-patch.mjssrc/daemon.mjssrc/selfupdate.mjs

Decision evidence

public snapshot

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/kai-bridge.mjsView file

16L17: import { spawn } from "node:child_process"; L18: import { mkdtempSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/kai-bridge.mjsView on unpkg · L16

src/profiles.mjsView file

149const windowsLine = [c.cmd, ...c.args].map(value => `"${String(value).replace(/"/g, '""')}"`).join(' '); L150: return spawn("cmd", ["/c", "start", '""', "cmd", "/k", windowsLine], { env: { ...c.env, ...(harness === 'claude' ? { DISABLE_AUTOUPDATER: '1' } : {}) }, stdio: "ignore", detached: ... L151: }

High

Shell

Package source references shell execution.

src/profiles.mjsView on unpkg · L149

src/preview.mjsView file

8// reload: restart, requires: [{ name: mongodb, port: 27017 }] } L9: // web: { cwd: Frontend, run: "npm start", port: 3000, env: { API_URL: "http://localhost:9000" }, protocol: http } L10: // preview: web ... L32: L33: import { spawn } from "node:child_process"; L34: import { createHash } from "node:crypto"; ... L62: const DEFAULT_SETTLE_MS = Symbol("default"); L63: const defaultSettleMs = () => Math.max(0, Number(process.env.KAI_PREVIEW_SETTLE_MS ?? 3_000) || 0); L64: const KNOWN_TOP_KEYS = new Set(["services", "preview", "companions", "external", "reverseCompanions"]); ... L80: try { L81: const req = createRequire(join(runnerDir, "..", "node_modules", "@playwright", "mcp", "package.json")); L82: return req("playwright");

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/preview.mjsView on unpkg · L8

src/service.mjsView file

4Trigger-reachable persistence chain: manifest.bin -> bin/kai-bridge.mjs -> src/service.mjs L4: L5: import { execFileSync } from "node:child_process"; L6: import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs"; ... L11: L12: export function servicePaths(home = homedir()) { L13: return { ... L94: const fullEnv = { L95: PATH: process.env.PATH || "/usr/local/bin:/usr/bin:/bin", L96: HOME: homedir(), ... L103: try { L104: execFileSync("launchctl", ["unload", paths.launchdPlist], { stdio: "ignore" }); L105: } catch {

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/service.mjsView on unpkg · L4

4L5: import { execFileSync } from "node:child_process"; L6: import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs"; ... L11: L12: export function servicePaths(home = homedir()) { L13: return { ... L94: const fullEnv = { L95: PATH: process.env.PATH || "/usr/local/bin:/usr/bin:/bin", L96: HOME: homedir(), ... L103: try { L104: execFileSync("launchctl", ["unload", paths.launchdPlist], { stdio: "ignore" }); L105: } catch {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/service.mjsView on unpkg · L4

src/preview.mjs#virtual:normalized:round1View file

1import { previewPorts } from "./preview-ports.mjs"; L2: // Preview tier A — run the app"s real dev servers next to the session.\n//\n// Each repo may commit a `.gleap/dev.yaml`:\n//\n// services:\n// api: { cwd: Server, run: \"n... L3: // may already own the declared one) — `PORT` is set and `${port:<name>}` ... L6: // already listening is adopted as "your running dev server" — but ONLY when L7: // the listener"s working directory is inside the repo (ports.mjs); anything\n// else on that port is `port_busy`, with pid / command / cwd for the card.\n//\n// Every failure is a... L8: export function preferredStablePort(repoKey, serviceName) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/preview.mjs#virtual:normalized:round1View on unpkg · L1

src/daemon.mjsView file

1Install-time code directly mutates a foreign AI-agent control surface: L20: import { spawn } from "node:child_process"; L21: import { appendFileSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs"; L22: import { join } from "node:path"; ... L74: export function createLogger(kaiHome = KAI_HOME) { L75: mkdirSync(join(kaiHome, "logs"), { recursive: true }); L76: const file = join(kaiHome, "logs", "bridge.log"); ... L79: try { L80: appendFileSync(file, line + "\n"); L81: } catch { ... L386: for (const harness of MODEL_PROBE_HARNESSES) { L387: // The user's own ~/.claude / ~/.codex first, then any signed-in L388: // managed profile — the catalogue is per account, not per profile. Write operation from runner/tools/patch-claude-acp.mjs: L27: L28: import

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

src/daemon.mjsView on unpkg · L1

•matchType = previous_version_dangerous_delta matchedPackage = @gleapai/kai-bridge@0.12.3 matchedIdentity = npm:QGdsZWFwYWkva2FpLWJyaWRnZQ:0.12.3 similarity = 0.683 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/daemon.mjsView on unpkg

runner/acp-runner.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

runner/acp-runner.mjs#virtual:normalized:round1View on unpkg

src/models.mjsView file

•matchType = normalized_sha256 matchedPackage = @gleapai/kai-bridge@0.6.0 matchedPath = src/models.mjs matchedIdentity = npm:QGdsZWFwYWkva2FpLWJyaWRnZQ:0.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/models.mjsView on unpkg

src/selfupdate.mjsView file

•matchType = normalized_sha256 matchedPackage = @gleapai/kai-bridge@0.6.0 matchedPath = src/selfupdate.mjs matchedIdentity = npm:QGdsZWFwYWkva2FpLWJyaWRnZQ:0.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/selfupdate.mjsView on unpkg

src/setup.mjsView file

•matchType = normalized_sha256 matchedPackage = @gleapai/kai-bridge@0.6.0 matchedPath = src/setup.mjs matchedIdentity = npm:QGdsZWFwYWkva2FpLWJyaWRnZQ:0.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/setup.mjsView on unpkg

runner/tools/patch-claude-acp.mjsView file

•matchType = normalized_sha256 matchedPackage = @gleapai/kai-bridge@0.6.0 matchedPath = runner/tools/patch-claude-acp.mjs matchedIdentity = npm:QGdsZWFwYWkva2FpLWJyaWRnZQ:0.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runner/tools/patch-claude-acp.mjsView on unpkg

src/companions.mjsView file

•matchType = normalized_sha256 matchedPackage = @gleapai/kai-bridge@0.6.0 matchedPath = src/companions.mjs matchedIdentity = npm:QGdsZWFwYWkva2FpLWJyaWRnZQ:0.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/companions.mjsView on unpkg