Loading npm security reports…

@gleapai/kai-bridge@0.6.0: AI-agent control-surface risk | LPM Firewall

registry / @gleapai/kai-bridge / 0.6.0

@gleapai/kai-bridge@0.6.0

Run Gleap Kai Code sessions on your own machine with your own Claude Code / Codex login — and preview your real dev servers from the dashboard or the phone.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies a third-party Claude ACP adapter. The change forwards agent prompt-suggestion data into this package's Kai metadata channel.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm install, including a noninteractive dependency installation.

Impact

An unconsented lifecycle hook changes a foreign AI-agent control surface and its message flow.

Mechanism

Postinstall source patching of a third-party AI-agent adapter.

Policy narrative

On installation, npm runs scripts/postinstall.mjs, which invokes ensureClaudeAcpPatched without requiring an interactive or global install. The patch resolver finds the installed @agentclientprotocol/claude-agent-acp adapter and rewrites its compiled acp-agent.js. The injected code forwards prompt suggestions through a Kai-specific metadata channel. This is an automatic modification of a foreign AI-agent component rather than package-local setup.

AI rationale

The automatic postinstall mutation of a third-party AI-agent adapter is a concrete unconsented control-surface change. Its narrow and readable implementation reduces ambiguity but does not remove the install-hook abuse.

Evidence

package.jsonscripts/postinstall.mjssrc/acp-patch.mjsrunner/tools/patch-claude-acp.mjsnode_modules/@agentclientprotocol/claude-agent-acp/dist/acp-agent.js

Decision evidence

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/kai-bridge.mjsView file

15L16: import { spawn } from "node:child_process"; L17: import { mkdtempSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/kai-bridge.mjsView on unpkg · L15

src/profiles.mjsView file

145if (process.platform === "win32") { L146: return spawn("cmd", ["/c", "start", "cmd", "/k", line.replace(/^([A-Z_]+)=('[^']*') /, "set $1=$2 && ")], { stdio: "ignore", detached: true, shell: true }); L147: }

High

Shell

Package source references shell execution.

src/profiles.mjsView on unpkg · L145

src/preview-login.mjsView file

44try { L45: const req = createRequire(join(runnerDir, "..", "node_modules", "@playwright", "mcp", "package.json")); L46: return req("playwright"); ... L62: /** Can this machine open a window? darwin/win32 always; linux needs a DISPLAY. */ L63: export function displayAvailable({ platform = process.platform, env = process.env } = {}) { L64: if (platform === "darwin" || platform === "win32") return true; ... L67: L68: /** `http://Localhost:3000/x?y` → `http://localhost:3000`; null for junk. */ L69: export function normalizeOrigin(url) { ... L203: return { L204: password: document.querySelectorAll('input[type="password"]').length, L205: otp: document.querySelectorAll('input[autocomplete="one-time-code"]').length,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/preview-login.mjsView on unpkg · L44

src/service.mjsView file

4Trigger-reachable persistence chain: manifest.bin -> bin/kai-bridge.mjs -> src/service.mjs L4: L5: import { execFileSync } from "node:child_process"; L6: import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs"; ... L11: L12: export function servicePaths(home = homedir()) { L13: return { ... L63: /** The desktop-session variables a headed browser needs (Linux only). */ L64: export function displayEnv(env = process.env) { L65: const out = {}; ... L114: try { L115: execFileSync("launchctl", ["unload", paths.launchdPlist], { stdio: "ignore" }); L116: } catch {

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/service.mjsView on unpkg · L4

4L5: import { execFileSync } from "node:child_process"; L6: import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs"; ... L11: L12: export function servicePaths(home = homedir()) { L13: return { ... L63: /** The desktop-session variables a headed browser needs (Linux only). */ L64: export function displayEnv(env = process.env) { L65: const out = {}; ... L114: try { L115: execFileSync("launchctl", ["unload", paths.launchdPlist], { stdio: "ignore" }); L116: } catch {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/service.mjsView on unpkg · L4

src/preview.mjs#virtual:normalized:round1View file

1// Preview tier A — run the app"s real dev servers next to the session.\n//\n// Each repo may commit a `.gleap/dev.yaml`:\n//\n// services:\n// api: { cwd: Server, run: \"n... L2: // may already own the declared one) — `PORT` is set and `${port:<name>}` ... L5: // already listening is adopted as "your running dev server" — but ONLY when L6: // the listener"s working directory is inside the repo (ports.mjs); anything\n// else on that port is `port_busy`, with pid / command / cwd for the card.\n//\n// Every failure is a... L7: * first on PATH. Under launchd the daemon"s PATH is frozen at install\n * time (service.mjs), so we run through a login shell to pick up\n * nvm/pnpm shims — but on macOS a login s...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/preview.mjs#virtual:normalized:round1View on unpkg · L1

src/daemon.mjsView file

1Install-time code directly mutates a foreign AI-agent control surface: L20: import { spawn } from "node:child_process"; L21: import { appendFileSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs"; L22: import { execFile } from "node:child_process"; ... L98: export function createLogger(kaiHome = KAI_HOME) { L99: mkdirSync(join(kaiHome, "logs"), { recursive: true }); L100: const file = join(kaiHome, "logs", "bridge.log"); ... L103: try { L104: appendFileSync(file, line + "\n"); L105: } catch { ... L392: for (const harness of MODEL_PROBE_HARNESSES) { L393: // The user's own ~/.claude / ~/.codex first, then any signed-in L394: // managed profile — the catalogue is per account, not per profile. Write operation from runner/tools/patch-claude-acp.mjs: L

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

src/daemon.mjsView on unpkg · L1

runner/acp-runner.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

runner/acp-runner.mjs#virtual:normalized:round1View on unpkg

src/preview.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @gleapai/kai-bridge@0.9.0 matchedIdentity = npm:QGdsZWFwYWkva2FpLWJyaWRnZQ:0.9.0 similarity = 0.576 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/preview.mjsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 3-43json

3 "version": "0.6.0",

4 "description": "Run Gleap Kai Code sessions on your own machine with your own Claude Code / Codex login — and preview your real dev servers from the dashboard or the phone.",

5 "type": "module",

6 "license": "MIT",

7 "bin": {

8 "kai-bridge": "bin/kai-bridge.mjs"

9 },

10 "files": [

11 "bin",

12 "src",

13 "runner",

14 "scripts/postinstall.mjs",

15 "README.md"

16 ],

17 "engines": {

18 "node": ">=20"

19 },

20 "scripts": {

21 "test": "node --test 'test/**/*.test.mjs'",

22 "sync-runner": "node scripts/sync-runner.mjs",

23 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L23

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L23

24 },

25 "dependencies": {

26 "@agentclientprotocol/claude-agent-acp": "0.73.0",

27 "@agentclientprotocol/codex-acp": "1.10.0",

28 "@agentclientprotocol/sdk": "1.4.0",

29 "@playwright/mcp": "^0.0.79",

30 "@sockudo/client": "^2.0.0",

31 "chokidar": "^4.0.1",

32 "yaml": "^2.9.0"

33 },

34 "overrides": {

35 "@anthropic-ai/claude-agent-sdk": "0.3.258"

36 },

37 "exports": {

38 ".": "./src/daemon.mjs",

39 "./src/*": "./src/*",

40 "./runner/*": "./runner/*"

41 },

42 "repository": {

43 "type": "git",

bin/kai-bridge.mjsView file

Lines 1-35javascript

1#!/usr/bin/env node

2// kai-bridge — run Gleap Kai Code on this machine.

3//

4// kai-bridge setup guided onboarding: pair · background service · harness sign-ins

5// (a bare `kai-bridge` on an unpaired machine runs it too)

6// kai-bridge login | logout pair this device with your Gleap account / disconnect it

7// kai-bridge install | uninstall run at login (launchd / systemd / Task Scheduler)

8// kai-bridge start run in the foreground (what the service runs)

9// kai-bridge status device, service, profiles, repos

10

src/profiles.mjsView file

Lines 125-165javascript

125 * spawned process or null when no terminal could be opened.

126 */

127export function openLoginTerminal(harness, configDir) {

128 const c =

src/preview-login.mjsView file

Lines 24-64javascript

24import { createRequire } from "node:module";

25import { join } from "node:path";

26

27import { resolvePreviewBrowser } from "./preview.mjs";

28

29/** Cookie domains the Server accepts — anything else is not the preview's. */

src/service.mjsView file

Lines 1-24javascript

1// Login-item service: launchd (macOS) / systemd --user (Linux) /

2// Task Scheduler (Windows). Runs `kai-bridge start` at login, restarts

3// on crash, logs under ~/.kai/logs. `kai-bridge install` / `uninstall`.

4

5import { execFileSync } from "node:child_process";

6import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";

7import { homedir, platform }

src/preview.mjs#virtual:normalized:round1View file

1// Preview tier A — run the app"s real dev servers next to the session.\n//\n// Each repo may commit a `.gleap/dev.yaml`:\n//\n// services:\n// api: { cwd: Server, run: \"n... L2: // may already own the declared one) — `PORT` is set and `${port:<name>}` ... L5: // already listening is adopted as "your running dev server" — but ONLY when L6: // the listener"s working directory is inside the repo (ports.mjs); anything\n// else on that port is `port_busy`, with pid / command / cwd for the card.\n//\n// Every failure is a... L7: * first on PATH. Under launchd the daemon"s PATH is frozen at install\n * time (service.mjs), so we run through a login shell to pick up\n * nvm/pnpm shims — but on macOS a login s...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/preview.mjs#virtual:normalized:round1View on unpkg · L1

src/daemon.mjsView file

Lines 1-21javascript

1// The always-on part: one outbound realtime subscription for commands,

2// REST for everything the device reports. Idles at ~0 CPU; reconnects

3// with backoff; keeps the machine awake only while a turn runs.

4//

5// Commands arrive on `private-bridge-<deviceId>` (Sockudo / Pusher

6// protocol, the same channel family the dashboard uses):

7// bridge.turn.start { commandId, turnId, sessionId, profileId, repos:[{key, mode, base, carryUncommitted}], ...AgentRunOpts }

8// bridge.turn.cancel { turnId }

9// bridge.turn.steer { turnId, steer: { id, text } } — inject into the running turn;

10

runner/acp-runner.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

runner/acp-runner.mjs#virtual:normalized:round1View on unpkg

src/preview.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @gleapai/kai-bridge@0.9.0 matchedIdentity = npm:QGdsZWFwYWkva2FpLWJyaWRnZQ:0.9.0 similarity = 0.576 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/preview.mjsView on unpkg