@gleapai/kai-bridge@0.2.1: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@gleapai/kai-bridge@0.2.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/service.mjsView file

4Trigger-reachable persistence chain: manifest.bin -> bin/kai-bridge.mjs -> src/service.mjs L4: L5: import { execFileSync } from "node:child_process"; L6: import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs"; ... L11: L12: export function servicePaths(home = homedir()) { L13: return { ... L94: const fullEnv = { L95: PATH: process.env.PATH || "/usr/local/bin:/usr/bin:/bin", L96: HOME: homedir(), ... L103: try { L104: execFileSync("launchctl", ["unload", paths.launchdPlist], { stdio: "ignore" }); L105: } catch {

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/service.mjsView on unpkg · L4

4L5: import { execFileSync } from "node:child_process"; L6: import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs"; ... L11: L12: export function servicePaths(home = homedir()) { L13: return { ... L94: const fullEnv = { L95: PATH: process.env.PATH || "/usr/local/bin:/usr/bin:/bin", L96: HOME: homedir(), ... L103: try { L104: execFileSync("launchctl", ["unload", paths.launchdPlist], { stdio: "ignore" }); L105: } catch {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/service.mjsView on unpkg · L4

src/daemon.mjsView file

1Install-time code directly mutates a foreign AI-agent control surface: L13: import { spawn } from "node:child_process"; L14: import { appendFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs"; L15: import { join, resolve as resolvePath } from "node:path"; ... L38: export function createLogger(kaiHome = KAI_HOME) { L39: mkdirSync(join(kaiHome, "logs"), { recursive: true }); L40: const file = join(kaiHome, "logs", "bridge.log"); ... L43: try { L44: appendFileSync(file, line + "\n"); L45: } catch { ... L231: acquireLock() { L232: mkdirSync(this.kaiHome, { recursive: true }); L233: // Same-process guard: the pid check below can't see a second daemon Write operation from src/config.mjs: L13: L14: import { chmodSync, existsSync, mkdirSync, readFileSync, writeFi

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

src/daemon.mjsView on unpkg · L1

Source & flagged code

5 flagged

package.jsonView file

Lines 3-43json

3 "version": "0.2.1",

4 "description": "Run Gleap Kai Code sessions on your own machine with your own Claude Code / Codex login — and preview your real dev servers from the dashboard or the phone.",

5 "type": "module",

6 "license": "MIT",

7 "bin": {

8 "kai-bridge": "bin/kai-bridge.mjs"

9 },

10 "files": [

11 "bin",

12 "src",

13 "runner",

14 "scripts/postinstall.mjs",

15 "README.md"

16 ],

17 "engines": {

18 "node": ">=20"

19 },

20 "scripts": {

21 "test": "node --test 'test/**/*.test.mjs'",

22 "sync-runner": "node scripts/sync-runner.mjs",

23 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L23

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L23

24 },

25 "dependencies": {

26 "@agentclientprotocol/claude-agent-acp": "0.70.0",

27 "@agentclientprotocol/codex-acp": "1.6.2",

28 "@agentclientprotocol/sdk": "1.4.0",

29 "@playwright/mcp": "^0.0.79",

30 "@sockudo/client": "^2.0.0",

31 "chokidar": "^4.0.1",

32 "yaml": "^2.9.0"

33 },

34 "overrides": {

35 "@anthropic-ai/claude-agent-sdk": "0.3.245"

36 },

37 "exports": {

38 ".": "./src/daemon.mjs",

39 "./src/*": "./src/*",

40 "./runner/*": "./runner/*"

41 },

42 "repository": {

43 "type": "git",

src/service.mjsView file

Lines 1-24javascript

1// Login-item service: launchd (macOS) / systemd --user (Linux) /

2// Task Scheduler (Windows). Runs `kai-bridge start` at login, restarts

3// on crash, logs under ~/.kai/logs. `kai-bridge install` / `uninstall`.

4

5import { execFileSync } from "node:child_process";

6import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";

7import { homedir, platform }

src/daemon.mjsView file

Lines 1-21javascript

1// The always-on part: one outbound realtime subscription for commands,

2// REST for everything the device reports. Idles at ~0 CPU; reconnects

3// with backoff; keeps the machine awake only while a turn runs.

4//

5// Commands arrive on `private-bridge-<deviceId>` (Sockudo / Pusher

6// protocol, the same channel family the dashboard uses):

7// bridge.turn.start { commandId, turnId, sessionId, profileId, repos:[{key, mode, base, carryUncommitted}], ...AgentRunOpts }

8// bridge.turn.cancel { turnId }

9// bridge.repo.clone { commandId, remote, name }

10// bridge.profile.login{ commandId, profileId }