@gleapai/kai-bridge@0.9.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@gleapai/kai-bridge@0.9.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/kai-bridge.mjsView file

15L16: import { spawn } from "node:child_process"; L17: import { mkdtempSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/kai-bridge.mjsView on unpkg · L15

src/profiles.mjsView file

149const windowsLine = [c.cmd, ...c.args].map(value => `"${String(value).replace(/"/g, '""')}"`).join(' '); L150: return spawn("cmd", ["/c", "start", '""', "cmd", "/k", windowsLine], { env: { ...c.env, ...(harness === 'claude' ? { DISABLE_AUTOUPDATER: '1' } : {}) }, stdio: "ignore", detached: ... L151: }

High

Shell

Package source references shell execution.

src/profiles.mjsView on unpkg · L149

src/preview-login.mjsView file

44try { L45: const req = createRequire(join(runnerDir, "..", "node_modules", "@playwright", "mcp", "package.json")); L46: return req("playwright"); ... L62: /** Can this machine open a window? darwin/win32 always; linux needs a DISPLAY. */ L63: export function displayAvailable({ platform = process.platform, env = process.env } = {}) { L64: if (platform === "darwin" || platform === "win32") return true; ... L67: L68: /** `http://Localhost:3000/x?y` → `http://localhost:3000`; null for junk. */ L69: export function normalizeOrigin(url) { ... L203: return { L204: password: document.querySelectorAll('input[type="password"]').length, L205: otp: document.querySelectorAll('input[autocomplete="one-time-code"]').length,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/preview-login.mjsView on unpkg · L44

src/service.mjsView file

4Trigger-reachable persistence chain: manifest.bin -> bin/kai-bridge.mjs -> src/service.mjs L4: L5: import { execFileSync } from "node:child_process"; L6: import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs"; ... L11: L12: export function servicePaths(home = homedir()) { L13: return { ... L63: /** The desktop-session variables a headed browser needs (Linux only). */ L64: export function displayEnv(env = process.env) { L65: const out = {}; ... L114: try { L115: execFileSync("launchctl", ["unload", paths.launchdPlist], { stdio: "ignore" }); L116: } catch {

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/service.mjsView on unpkg · L4

4L5: import { execFileSync } from "node:child_process"; L6: import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs"; ... L11: L12: export function servicePaths(home = homedir()) { L13: return { ... L63: /** The desktop-session variables a headed browser needs (Linux only). */ L64: export function displayEnv(env = process.env) { L65: const out = {}; ... L114: try { L115: execFileSync("launchctl", ["unload", paths.launchdPlist], { stdio: "ignore" }); L116: } catch {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/service.mjsView on unpkg · L4

src/preview.mjs#virtual:normalized:round1View file

1import { previewPorts } from "./preview-ports.mjs"; L2: // Preview tier A — run the app"s real dev servers next to the session.\n//\n// Each repo may commit a `.gleap/dev.yaml`:\n//\n// services:\n// api: { cwd: Server, run: \"n... L3: // may already own the declared one) — `PORT` is set and `${port:<name>}` ... L6: // already listening is adopted as "your running dev server" — but ONLY when L7: // the listener"s working directory is inside the repo (ports.mjs); anything\n// else on that port is `port_busy`, with pid / command / cwd for the card.\n//\n// Every failure is a... L8: * first on PATH. Under launchd the daemon"s PATH is frozen at install\n * time (service.mjs), so we run through a login shell to pick up\n * nvm/pnpm shims — but on macOS a login s...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/preview.mjs#virtual:normalized:round1View on unpkg · L1

src/daemon.mjsView file

1Install-time code directly mutates a foreign AI-agent control surface: L21: import { spawn } from "node:child_process"; L22: import { appendFileSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs"; L23: import { execFile } from "node:child_process"; ... L99: export function createLogger(kaiHome = KAI_HOME) { L100: mkdirSync(join(kaiHome, "logs"), { recursive: true }); L101: const file = join(kaiHome, "logs", "bridge.log"); ... L104: try { L105: appendFileSync(file, line + "\n"); L106: } catch { ... L393: for (const harness of MODEL_PROBE_HARNESSES) { L394: // The user's own ~/.claude / ~/.codex first, then any signed-in L395: // managed profile — the catalogue is per account, not per profile. Write operation from runner/tools/patch-claude-acp.mjs:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

src/daemon.mjsView on unpkg · L1

runner/acp-runner.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

runner/acp-runner.mjs#virtual:normalized:round1View on unpkg

src/preview.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @gleapai/kai-bridge@0.2.9 matchedIdentity = npm:QGdsZWFwYWkva2FpLWJyaWRnZQ:0.2.9 similarity = 0.423 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/preview.mjsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 5-45json

5 "type": "module",

6 "license": "MIT",

7 "bin": {

8 "kai-bridge": "bin/kai-bridge.mjs"

9 },

10 "files": [

11 "bin",

12 "src",

13 "runner",

14 "scripts/postinstall.mjs",

15 "README.md",

16 "scripts/runtime-smoke.mjs",

17 "npm-shrinkwrap.json"

18 ],

19 "engines": {

20 "node": ">=20"

21 },

22 "scripts": {

23 "test": "node --test 'test/**/*.test.mjs'",

24 "sync-runner": "node scripts/sync-runner.mjs",

25 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L25

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L25

26 "runtime:check": "node scripts/runtime-smoke.mjs",

27 "prepack": "node scripts/prepare-release.mjs",

28 "postpack": "node scripts/prepare-release.mjs --clean"

29 },

30 "dependencies": {

31 "@agentclientprotocol/claude-agent-acp": "0.75.1",

32 "@agentclientprotocol/codex-acp": "1.10.0",

33 "@agentclientprotocol/sdk": "1.4.0",

34 "@playwright/mcp": "^0.0.79",

35 "@sockudo/client": "^2.0.0",

36 "chokidar": "^4.0.1",

37 "ws": "^8.21.3",

38 "yaml": "^2.9.0",

39 "@openai/codex": "0.153.4",

40 "@anthropic-ai/claude-agent-sdk": "0.3.266"

41 },

42 "overrides": {

43 "@anthropic-ai/claude-agent-sdk": "$@anthropic-ai/claude-agent-sdk"

44 },

45 "exports": {

bin/kai-bridge.mjsView file

Lines 1-35javascript

1#!/usr/bin/env node

2// kai-bridge — run Gleap Kai Code on this machine.

3//

4// kai-bridge setup guided onboarding: pair · background service · harness sign-ins

5// (a bare `kai-bridge` on an unpaired machine runs it too)

6// kai-bridge login | logout pair this device with your Gleap account / disconnect it

7// kai-bridge install | uninstall run at login (launchd / systemd / Task Scheduler)

8// kai-bridge start run in the foreground (what the service runs)

9// kai-bridge status device, service, profiles, repos

10

src/profiles.mjsView file

Lines 129-169javascript

129 const c = loginCommand(harness, configDir, kaiHome);

130 if (!c) return null;

131 // Ambient claude must log in with the env untouched so credentials land

132 // in the keychain, where the (equally untouched) probe and turns look.

src/preview-login.mjsView file

Lines 24-64javascript

24import { createRequire } from "node:module";

25import { join } from "node:path";

26

27import { resolvePreviewBrowser } from "./preview.mjs";

28

29/** Cookie domains the Server accepts — anything else is not the preview's. */

src/service.mjsView file

Lines 1-24javascript

1// Login-item service: launchd (macOS) / systemd --user (Linux) /

2// Task Scheduler (Windows). Runs `kai-bridge start` at login, restarts

3// on crash, logs under ~/.kai/logs. `kai-bridge install` / `uninstall`.

4

5import { execFileSync } from "node:child_process";

6import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";

7import { homedir, platform }

src/preview.mjs#virtual:normalized:round1View file

1import { previewPorts } from "./preview-ports.mjs"; L2: // Preview tier A — run the app"s real dev servers next to the session.\n//\n// Each repo may commit a `.gleap/dev.yaml`:\n//\n// services:\n// api: { cwd: Server, run: \"n... L3: // may already own the declared one) — `PORT` is set and `${port:<name>}` ... L6: // already listening is adopted as "your running dev server" — but ONLY when L7: // the listener"s working directory is inside the repo (ports.mjs); anything\n// else on that port is `port_busy`, with pid / command / cwd for the card.\n//\n// Every failure is a... L8: * first on PATH. Under launchd the daemon"s PATH is frozen at install\n * time (service.mjs), so we run through a login shell to pick up\n * nvm/pnpm shims — but on macOS a login s...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/preview.mjs#virtual:normalized:round1View on unpkg · L1

src/daemon.mjsView file

Lines 1-21javascript

1import { cloneRepository, locateRepository } from './repository-setup.mjs';

2// The always-on part: one outbound realtime subscription for commands,

3// REST for everything the device reports. Idles at ~0 CPU; reconnects

4// with backoff; keeps the machine awake only while a turn runs.

5//

6// Commands arrive on `private-bridge-<deviceId>` (Sockudo / Pusher

7// protocol, the same channel family the dashboard uses):

8// bridge.turn.start { commandId, turnId, sessionId, profileId, repos:[{key, mode, base, carryUncommitted}], ...AgentRunOpts }

runner/acp-runner.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

runner/acp-runner.mjs#virtual:normalized:round1View on unpkg

src/preview.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @gleapai/kai-bridge@0.2.9 matchedIdentity = npm:QGdsZWFwYWkva2FpLWJyaWRnZQ:0.2.9 similarity = 0.423 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/preview.mjsView on unpkg