@kahitsan/plugin-sdk@0.8.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@kahitsan/plugin-sdk@0.8.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

10 flagged · loading source

bin/cli.mjsView file

11// so the launcher re-execs under Bun; install it from https://bun.sh. L12: import { spawn } from "node:child_process"; L13: import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

bin/cli.mjsView on unpkg · L11

•matchType = normalized_sha256 matchedPackage = @kahitsan/plugin-sdk@0.8.5 matchedPath = bin/cli.mjs matchedIdentity = npm:QGthaGl0c2FuL3BsdWdpbi1zZGs:0.8.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cli.mjsView on unpkg

dist/index.jsView file

1/*! [redacted]... L2: const _0xcc6027=_0x3573;(function(_0x3ff248,_0x17523b){const _0x6efb58=_0x3573,_0x3fb742=_0x3ff248();while(!![]){try{const _0x582385=parseInt(_0x6efb58(0x35b))/(-0x1a9d+0x1c78+0x1d...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L1

1/*! [redacted]... L2: const _0xcc6027=_0x3573;(function(_0x3ff248,_0x17523b){const _0x6efb58=_0x3573,_0x3fb742=_0x3ff248();while(!![]){try{const _0x582385=parseInt(_0x6efb58(0x35b))/(-0x1a9d+0x1c78+0x1d...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1

src/dev/serve.ts#virtual:normalized:round1View file

23const DEV_SECRET = "dev-stub-internal-secret"; L24: const BASE = Number(process.env.KSERP_DEV_BASE_PORT || "4500"); L25: ... L32: console.error( L33: "[toolkit] host-UI shell missing at ${SHELL_DIR}.\n In a source checkout run `npm run build:toolkit-shell`; in an installed package this\n means the published tarball didn\"t shi... L34: const kernelProc = spawn({

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/dev/serve.ts#virtual:normalized:round1View on unpkg · L23

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/dev/serve.ts#virtual:normalized:round1View on unpkg

shell/sw.js.gzView file

•path = shell/sw.js.gz kind = compressed_blob sizeBytes = 1440 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

shell/sw.js.gzView on unpkg

shell/_server/assets/app-DHSje8fl.css.gzView file

•path = shell/_server/assets/app-DHSje8fl.css.gz kind = high_entropy_blob sizeBytes = 18913 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

shell/_server/assets/app-DHSje8fl.css.gzView on unpkg

shell/_build/.vite/manifest.json.gzView file

•path = shell/_build/.vite/manifest.json.gz kind = payload_in_excluded_dir sizeBytes = 726 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

shell/_build/.vite/manifest.json.gzView on unpkg

src/dev/dev-host.tsView file

•matchType = normalized_sha256 matchedPackage = @kahitsan/plugin-sdk@0.8.5 matchedPath = src/dev/dev-host.ts matchedIdentity = npm:QGthaGl0c2FuL3BsdWdpbi1zZGs:0.8.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/dev/dev-host.tsView on unpkg

Source & flagged code

10 flagged

bin/cli.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2// @kahitsan/plugin-sdk CLI — the dev toolkit launcher (Vision §5.1, K3/K4).

3//

4// npx @kahitsan/plugin-sdk <pluginDir> [<pluginDir> …] ← headline form

5// npx @kahitsan/plugin-sdk toolkit <pluginDir> … ← alias (back-compat)

6//

7// Boots the dev-kernel mediator + each plugin on Bun (local SQLite + a synthetic

8// logged-in admin) entirely from the INSTALLED package — no kernel source required.

9// Pass several plugin dirs to exercise the CONTRACT between plugins (does B expose

10// the method A consumes?) locally — no kernel, no Postgres. The harness is Bun-only,

11// so the launcher re-execs under Bun; install it from https://bun.sh.

12import { spawn } from "node:child_process";

13import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

bin/cli.mjsView on unpkg · L11

14import { dirname, join } from "node:path";

15

16const here = dirname(fileURLToPath(import.meta.url));

17let args = process.argv.slice(2);

18// `toolkit` is an optional leading verb (kept for back-compat); the headline form

19// takes plugin dirs directly, so a global `npx @kahitsan/plugin-sdk ./a ./b` works.

20if (args[0] === "toolkit") args = args.slice(1);

21const wantsHelp = args.includes("-h") || args.includes("--help");

22const dirs = args.filter((a) => !a.startsWith("-"));

23

24if (dirs.length === 0 || wantsHelp) {

25 const out = wantsHelp ? console.log : console.error;

26 out("usage: npx @kahitsan/plugin-sdk <pluginDir> [<pluginDir> …]");

27 out("");

28 out(" Boots the local dev toolkit — a dev-kernel mediator + each plugin on SQLite");

29 out(" + a synthetic logged-in admin, all from this installed package (no kernel");

30 out(" source). Load several plugins at once to exercise their cross-plugin calls:");

31 out("");

•matchType = normalized_sha256 matchedPackage = @kahitsan/plugin-sdk@0.8.5 matchedPath = bin/cli.mjs matchedIdentity = npm:QGthaGl0c2FuL3BsdWdpbi1zZGs:0.8.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cli.mjsView on unpkg

dist/index.jsView file

Lines 1-2javascript

1/*! QGthaGl0c2FuL3BsdWdpbi1zZGsg4oCUIFBST1BSSUVUQVJZICYgQ09ORklERU5USUFMLiBDb3B5cmlnaHQgKGMpIEthaGl0U2FuIENvcnAuIEFsbCByaWdodHMgcmVzZXJ2ZWQuIExpY2Vuc2VkLCBub3Qgc29sZC4gVGhpcyBmaWxlIGlzIGludGVudGlvbmFsbHkgT0JGVVNDQVRFRCB0byBwcm90ZWN0IHRyYWRlIHNlY3JldHMuIERlLW9iZnVzY2F0aW5nLCBkZWNvbXBpbGluZywgcmV2ZXJzZS1lbmdpbmVlcmluZywgYmVhdXRpZnlpbmcsIG9yIHJlY29uc3RydWN0aW5nIGl0cyBzb3VyY2UgaXMgU1RSSUNUTFkgUFJPSElCSVRFRCBieSBpdHMgbGljZW5zZSBhbmQgYnkgbGF3LCBpbmNsdWRpbmcgYW50aS1jaXJjdW12ZW50aW9uIHN0YXR1dGVzIChlLmcuIDE3IFUuUy5DLiDCpyAxMjAxIC8gRE1DQSBhbmQgZXF1aXZhbGVudHMpOyBzdWNoIGFjdHMgbWF5IGJlIGEgQ1JJTUlOQUwgT0ZG ...

2const _0xcc6027=_0x3573;(function(_0x3ff248,_0x17523b){const _0x6efb58=_0x3573,_0x3fb742=_0x3ff248();while(!![]){try{const _0x582385=parseInt(_0x6efb58(0x35b))/(-0x1a9d+0x1c78+0x1da*-0x1)*(parseInt(_0x6efb58(0x204))/(0xd*0x150+0x78c+-0x189a))+-parseInt(_0x6efb58(0x468))/(0x1*0x2665+-0x8b0*-0x2+0x7a*-0x75)+-parseInt(_0x6efb58(0x559))/(0x2a5*-0xd+-0x9cd+-0x1619*-0x2)*(-parseInt(_0x6efb58(0x914))/(-0x6d*-0x48+-0x852+0x1651*-0x1))+-parseInt(_0x6efb58(0x31c))/(0x6b*0x55+-0x1681+-0x100*0xd)+-parseInt(_0x6efb58(0x52a))/(0x1d76+-0xaed*0x1+-0x1282)*(-parseInt(_0x6efb58(0x4eb))/(-0xb7*0x27+-0x40*-0x30+0 ...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L1

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1

src/dev/serve.ts#virtual:normalized:round1View file

23const DEV_SECRET = "dev-stub-internal-secret"; L24: const BASE = Number(process.env.KSERP_DEV_BASE_PORT || "4500"); L25: ... L32: console.error( L33: "[toolkit] host-UI shell missing at ${SHELL_DIR}.\n In a source checkout run `npm run build:toolkit-shell`; in an installed package this\n means the published tarball didn\"t shi... L34: const kernelProc = spawn({

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/dev/serve.ts#virtual:normalized:round1View on unpkg · L23

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/dev/serve.ts#virtual:normalized:round1View on unpkg

shell/sw.js.gzView file

•path = shell/sw.js.gz kind = compressed_blob sizeBytes = 1440 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

shell/sw.js.gzView on unpkg

shell/_server/assets/app-DHSje8fl.css.gzView file

•path = shell/_server/assets/app-DHSje8fl.css.gz kind = high_entropy_blob sizeBytes = 18913 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

shell/_server/assets/app-DHSje8fl.css.gzView on unpkg

shell/_build/.vite/manifest.json.gzView file

•path = shell/_build/.vite/manifest.json.gz kind = payload_in_excluded_dir sizeBytes = 726 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

shell/_build/.vite/manifest.json.gzView on unpkg

src/dev/dev-host.tsView file

•matchType = normalized_sha256 matchedPackage = @kahitsan/plugin-sdk@0.8.5 matchedPath = src/dev/dev-host.ts matchedIdentity = npm:QGthaGl0c2FuL3BsdWdpbi1zZGs:0.8.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/dev/dev-host.tsView on unpkg