Loading npm security reports…

@ikie-dev/cli@9.8.7: Clean npm security report (Allow) | LPM Firewall

registry / @ikie-dev/cli / 9.8.7

@ikie-dev/cli@9.8.7

ikie — a coding agent CLI powered by ikie AI

AI Security Review

scanned 18d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established by source inspection. The install hook is limited to a compatibility patch inside an installed dependency, while agent/platform setup code is runtime or app-owned rather than unconsented foreign control-surface mutation.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm install runs postinstall; user runs ikie-cli for runtime agent features

Impact

No verified unauthorized persistence, exfiltration, destructive action, or AI-agent control hijack

Mechanism

dependency compatibility patch plus user-invoked CLI agent harness

Rationale

Static inspection found lifecycle code, but the consumer install hook is a narrow package dependency patch and not a foreign/broad AI-agent control-surface write. The remaining risky primitives are expected for an AI coding-agent CLI and appear user-invoked or package-owned, so the scanner hints are noisy rather than proof of malware.

Evidence

package.jsonscripts/patch-pi-ai-oauth.jssrc/entry.tssrc/resources/rtk-install.tssrc/extensions/setup.tsvendor/superpowers/tests/claude-code/test-subagent-driven-development.shsrc/core/export-html/vendor/highlight.min.jsnode_modules/@earendil-works/pi-ai-oauth/dist/oauth.js~/.config/ikie/harnessuserData/resources/rtk/rtk-mcp

Decision evidence

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/patch-pi-ai-oauth.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

tests/smoke/ferment-oneshot-exit.test.tsView file

1import { spawn } from "node:child_process" L2: import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs"

High

Child Process

Package source references child process execution.

tests/smoke/ferment-oneshot-exit.test.tsView on unpkg · L1

scripts/package-release-asset.jsView file

24execFileSync( L25: "powershell.exe", L26: [

High

Shell

Package source references shell execution.

scripts/package-release-asset.jsView on unpkg · L24

scripts/prepublish-npm.jsView file

17if (existsSync(copyResources)) { L18: await import(copyResources) L19: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/prepublish-npm.jsView on unpkg · L17

vendor/superpowers/skills/brainstorming/scripts/server.cjsView file

1const crypto = require('crypto'); L2: const http = require('http'); L3: const fs = require('fs'); ... L11: function computeAcceptKey(clientKey) { L12: return crypto.createHash('sha1').update(clientKey + WS_MAGIC).digest('base64'); L13: } ... L75: L76: const PORT = process.env.BRAINSTORM_PORT || (49152 + Math.floor(Math.random() * 16383)); L77: const HOST = process.env.BRAINSTORM_HOST || '127.0.0.1'; ... L100: L101: const frameTemplate = fs.readFileSync(path.join(__dirname, 'frame-template.html'), 'utf-8'); L102: const helperScript = fs.readFileSync(path.join(__dirname, 'helper.js'), 'utf-8');

Low

Weak Crypto

Package source references weak cryptographic algorithms.

vendor/superpowers/skills/brainstorming/scripts/server.cjsView on unpkg · L1

src/config/shell-profile.test.tsView file

21beforeEach(() => { L22: // macOS's per-process tmpdir resolves through /private — realpath now so L23: // the assertions about returned paths line up with what the writer sees ... L25: tmp = realpathSync(mkdtempSync(join(tmpdir(), "ikie-shell-test-"))) L26: prevHome = process.env.HOME L27: prevShell = process.env.SHELL ... L40: L41: it("appends export to .zshrc, preserving existing lines", () => { L42: process.env.SHELL = "/bin/zsh" ... L125: process.env.SHELL = "/bin/zsh" L126: writeFileSync(join(tmp, ".zshrc"), Buffer.from([0xff, 0xfe, 0x80, 0x81])) L127:

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/config/shell-profile.test.tsView on unpkg · L21

src/resources/rtk-install.tsView file

1import { execFileSync } from "node:child_process" L2: import { createHash } from "node:crypto" ... L21: L22: const LATEST_RELEASE_URL = "https://api.github.com/repos/rtk-ai/rtk/releases/latest" L23: const AUTO_INSTALL_INTERVAL_MS = 24 * 60 * 60 * 1000 ... L42: export function managedRtkPath(): string { L43: return join(rtkInstallDir(), process.platform === "win32" ? "rtk.exe" : "rtk") L44: } ... L51: const bin = globalBinDir() L52: const entries = (process.env.PATH ?? "").split(delimiter).filter(Boolean) L53: if (!entries.includes(bin)) process.env.PATH = [bin, ...entries].join(delimiter) ... L139: function rtkInstallDir(): string {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/resources/rtk-install.tsView on unpkg · L1

src/extensions/web-fetch/url-validator.tsView file

3* L4: * Validates URL format (http/https only) and blocks requests to private L5: * IP ranges, localhost, and cloud metadata endpoints. ... L127: if (v4MappedDecimal) { L128: const innerResult = validateURL(`http://${v4MappedDecimal[1]}/`) L129: if (!innerResult.valid) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/extensions/web-fetch/url-validator.tsView on unpkg · L3

vendor/superpowers/tests/brainstorm-server/server.test.jsView file

3Cross-file remote execution chain: [redacted]-server/server.test.js spawns [redacted].js; helper contains network access plus dynamic code execution. L3: * L4: * Tests the full server behavior: HTTP serving, WebSocket communication, L5: * file watching, and the brainstorming workflow. ... L10: L11: const { spawn } = require('child_process'); L12: const http = require('http'); ... L17: L18: const SERVER_PATH = path.join(__dirname, '../../[redacted].cjs'); L19: const TEST_PORT = 3334; ... L41: headers: res.headers, L42: body: data L43: }));

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

vendor/superpowers/tests/brainstorm-server/server.test.jsView on unpkg · L3

benchmark/manual/new-session.shView file

•path = benchmark/manual/new-session.sh kind = build_helper sizeBytes = 6823 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

benchmark/manual/new-session.shView on unpkg

vendor/superpowers/tests/claude-code/test-subagent-driven-development.shView file

•path = vendor/superpowers/tests/claude-code/test-subagent-driven-development.sh kind = payload_in_excluded_dir sizeBytes = 4553 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

vendor/superpowers/tests/claude-code/test-subagent-driven-development.shView on unpkg

src/core/export-html/vendor/highlight.min.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @ikie-dev/cli@9.8.6 matchedIdentity = npm:QGlraWUtZGV2L2NsaQ:9.8.6 similarity = 0.958 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/core/export-html/vendor/highlight.min.jsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 14-54json

14 "build:binary": "node scripts/build-binary.js",

15 "install:local": "node scripts/install-local.js",

16 "build:binary-linux-arm64": "node scripts/build-binary.js --target linux-arm64",

17 "build:binary-linux-x64": "node scripts/build-binary.js --target linux-x64",

18 "build:binary-windows-x64": "node scripts/build-binary.js --target windows-x64",

19 "dev": "make -C tools/proxy-helper/ copy-for-dev && bun run --preload ./src/set-package-dir.ts src/entry.ts",

20 "dev:overlay": "scripts/dev-overlay.sh",

21 "dev:setup": "bun run --preload ./src/set-package-dir.ts src/entry.ts setup",

22 "lint": "biome check src/ scripts/",

23 "lint:fix": "biome check --write src/ scripts/",

24 "typecheck": "tsc --noEmit",

25 "check": "pnpm run lint && pnpm run typecheck",

26 "test": "vitest run --dir src",

27 "test:smoke": "vitest run --config tests/smoke/vitest.config.ts",

28 "test:e2e:tui": "pnpm run build:binary && node scripts/run-tui-e2e.js",

29 "test:e2e:tui:debug": "pnpm run build:binary && node scripts/run-tui-e2e.js --debug",

30 "test:e2e:tui:trace": "pnpm run build:binary && node scripts/run-tui-e2e.js --trace",

31 "test:e2e:tui:trace:replay": "node scripts/run-tui-e2e.js replay",

32 "test:e2e:acp": "pnpm run build:binary && vitest run --config tests/e2e/acp/vitest.config.ts",

33 "prepublishOnly": "node scripts/prepublish-npm.js",

34 "postinstall": "node scripts/patch-pi-ai-oauth.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L34

35 "prepare": "husky",

36 "verify": "pnpm run check && pnpm run build:binary && pnpm run test && pnpm run test:smoke"

37 },

38 "piConfig": {

39 "name": "ikie",

40 "configDir": ".config/ikie/harness"

41 },

42 "dependencies": {

43 "@agentclientprotocol/sdk": "0.19.2",

44 "@clack/prompts": "^1.3.0",

45 "@earendil-works/pi-ai": "0.78.1",

46 "@earendil-works/pi-coding-agent": "0.78.1",

47 "@earendil-works/pi-tui": "0.78.1",

48 "@mixmark-io/domino": "^2.2.0",

49 "@modelcontextprotocol/ext-apps": "^1.7.1",

50 "@modelcontextprotocol/sdk": "^1.29.0",

51 "@shikijs/cli": "^4.0.2",

52 "@types/diff": "^8.0.0",

53 "@types/proper-lockfile": "^4.1.4",

54 "@types/ssh2": "^1.15.5",

tests/smoke/ferment-oneshot-exit.test.tsView file

Lines 1-21typescript

1import { spawn } from "node:child_process"

2import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs"

High

Child Process

Package source references child process execution.

tests/smoke/ferment-oneshot-exit.test.tsView on unpkg · L1

3import { tmpdir } from "node:os"

4import { join, resolve }

scripts/package-release-asset.jsView file

Lines 4-44javascript

4// node scripts/package-release-asset.js --os linux --arch amd64

5// node scripts/package-release-asset.js --os windows --arch amd64

6

7import { execFileSync } from "node:child_process"

8import { existsSync } from "node:fs"

9import { resolve } from "node:path"

10

scripts/prepublish-npm.jsView file

Lines 1-37javascript

1// Prepare the package for npm publication so it can run when installed globally.

2//

3// The published tarball needs:

4// - theme/dark.json, theme/light.json, theme/theme-schema.json

5// - src/modes/interactive/theme/<same theme files> (upstream pi-coding-agent looks there)

6// - src/core/export-html/<templates> (upstream pi-coding-agent looks there)

7// - package.json at the package root

8

9import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs"

vendor/superpowers/skills/brainstorming/scripts/server.cjsView file

Lines 1-21javascript

1const crypto = require('crypto');

2const http = require('http');

3const fs =

src/config/shell-profile.test.tsView file

Lines 1-41typescript

1import {

2 lstatSync,

3 mkdirSync,

4 mkdtempSync,

5 readFileSync,

6 realpathSync,

7 rmSync,

8 symlinkSync,

9 writeFileSync,

10} from "node:fs"

src/resources/rtk-install.tsView file

Lines 1-21typescript

1import { execFileSync } from "node:child_process"

2import { createHash } from "node:crypto"

3import {

4 copyFileSync,

5 existsSync,

6 mkdirSync,

7 mkdtempSync,

8 readFileSync,

src/extensions/web-fetch/url-validator.tsView file

Lines 1-23typescript

1/**

2 * URL validation and SSRF protection for the web_fetch tool.

3 *

4 * Validates URL format (http/https only) and blocks requests to private

5 * IP ranges, localhost, and cloud metadata endpoints.

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/extensions/web-fetch/url-validator.tsView on unpkg · L3

6 */

7

8/** Private IPv4 ranges that must be blocked. */

9

vendor/superpowers/tests/brainstorm-server/server.test.jsView file

3Cross-file remote execution chain: [redacted]-server/server.test.js spawns [redacted].js; helper contains network access plus dynamic code execution. L3: * L4: * Tests the full server behavior: HTTP serving, WebSocket communication, L5: * file watching, and the brainstorming workflow. ... L10: L11: const { spawn } = require('child_process'); L12: const http = require('http'); ... L17: L18: const SERVER_PATH = path.join(__dirname, '../../[redacted].cjs'); L19: const TEST_PORT = 3334; ... L41: headers: res.headers, L42: body: data L43: }));

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

vendor/superpowers/tests/brainstorm-server/server.test.jsView on unpkg · L3

benchmark/manual/new-session.shView file

•path = benchmark/manual/new-session.sh kind = build_helper sizeBytes = 6823 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

benchmark/manual/new-session.shView on unpkg

vendor/superpowers/tests/claude-code/test-subagent-driven-development.shView file

•path = vendor/superpowers/tests/claude-code/test-subagent-driven-development.sh kind = payload_in_excluded_dir sizeBytes = 4553 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

vendor/superpowers/tests/claude-code/test-subagent-driven-development.shView on unpkg

src/core/export-html/vendor/highlight.min.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @ikie-dev/cli@9.8.6 matchedIdentity = npm:QGlraWUtZGV2L2NsaQ:9.8.6 similarity = 0.958 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/core/export-html/vendor/highlight.min.jsView on unpkg