@kahitsan/plugin-sdk@0.8.3: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@kahitsan/plugin-sdk@0.8.3: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

bin/cli.mjsView file

11// so the launcher re-execs under Bun; install it from https://bun.sh. L12: import { spawn } from "node:child_process"; L13: import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

bin/cli.mjsView on unpkg · L11

dist/index.jsView file

1/*! [redacted]... L2: const _0x54bc9b=_0x23fe;function _0x23fe(_0x13f0a1,_0x189650){_0x13f0a1=_0x13f0a1-(-0x1332+-0x1480+0x28e1);const _0x497723=_0x18a1();let _0x3ad134=_0x497723[_0x13f0a1];if(_0x23fe['...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L1

1/*! [redacted]... L2: const _0x54bc9b=_0x23fe;function _0x23fe(_0x13f0a1,_0x189650){_0x13f0a1=_0x13f0a1-(-0x1332+-0x1480+0x28e1);const _0x497723=_0x18a1();let _0x3ad134=_0x497723[_0x13f0a1];if(_0x23fe['...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1

src/dev/serve.ts#virtual:normalized:round1View file

23const DEV_SECRET = "dev-stub-internal-secret"; L24: const BASE = Number(process.env.KSERP_DEV_BASE_PORT || "4500"); L25: ... L32: console.error( L33: "[toolkit] host-UI shell missing at ${SHELL_DIR}.\n In a source checkout run `npm run build:toolkit-shell`; in an installed package this\n means the published tarball didn\"t shi... L34: const kernelProc = spawn({

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/dev/serve.ts#virtual:normalized:round1View on unpkg · L23

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/dev/serve.ts#virtual:normalized:round1View on unpkg

shell/sw.js.gzView file

•path = shell/sw.js.gz kind = compressed_blob sizeBytes = 1440 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

shell/sw.js.gzView on unpkg

shell/_server/assets/app-Db8qYQT6.css.brView file

•path = shell/_server/assets/app-Db8qYQT6.css.br kind = high_entropy_blob sizeBytes = 15339 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

shell/_server/assets/app-Db8qYQT6.css.brView on unpkg

shell/_build/.vite/manifest.json.gzView file

•path = shell/_build/.vite/manifest.json.gz kind = payload_in_excluded_dir sizeBytes = 725 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

shell/_build/.vite/manifest.json.gzView on unpkg

Source & flagged code

8 flagged

bin/cli.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2// @kahitsan/plugin-sdk CLI — the dev toolkit launcher (Vision §5.1, K3/K4).

3//

4// npx @kahitsan/plugin-sdk <pluginDir> [<pluginDir> …] ← headline form

5// npx @kahitsan/plugin-sdk toolkit <pluginDir> … ← alias (back-compat)

6//

7// Boots the dev-kernel mediator + each plugin on Bun (local SQLite + a synthetic

8// logged-in admin) entirely from the INSTALLED package — no kernel source required.

9// Pass several plugin dirs to exercise the CONTRACT between plugins (does B expose

10// the method A consumes?) locally — no kernel, no Postgres. The harness is Bun-only,

11// so the launcher re-execs under Bun; install it from https://bun.sh.

12import { spawn } from "node:child_process";

13import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

bin/cli.mjsView on unpkg · L11

14import { dirname, join } from "node:path";

15

16const here = dirname(fileURLToPath(import.meta.url));

17let args = process.argv.slice(2);

18// `toolkit` is an optional leading verb (kept for back-compat); the headline form

19// takes plugin dirs directly, so a global `npx @kahitsan/plugin-sdk ./a ./b` works.

20if (args[0] === "toolkit") args = args.slice(1);

21const wantsHelp = args.includes("-h") || args.includes("--help");

22const dirs = args.filter((a) => !a.startsWith("-"));

23

24if (dirs.length === 0 || wantsHelp) {

25 const out = wantsHelp ? console.log : console.error;

26 out("usage: npx @kahitsan/plugin-sdk <pluginDir> [<pluginDir> …]");

27 out("");

28 out(" Boots the local dev toolkit — a dev-kernel mediator + each plugin on SQLite");

29 out(" + a synthetic logged-in admin, all from this installed package (no kernel");

30 out(" source). Load several plugins at once to exercise their cross-plugin calls:");

31 out("");

dist/index.jsView file

Lines 1-2javascript

1/*! QGthaGl0c2FuL3BsdWdpbi1zZGsg4oCUIFBST1BSSUVUQVJZICYgQ09ORklERU5USUFMLiBDb3B5cmlnaHQgKGMpIEthaGl0U2FuIENvcnAuIEFsbCByaWdodHMgcmVzZXJ2ZWQuIExpY2Vuc2VkLCBub3Qgc29sZC4gVGhpcyBmaWxlIGlzIGludGVudGlvbmFsbHkgT0JGVVNDQVRFRCB0byBwcm90ZWN0IHRyYWRlIHNlY3JldHMuIERlLW9iZnVzY2F0aW5nLCBkZWNvbXBpbGluZywgcmV2ZXJzZS1lbmdpbmVlcmluZywgYmVhdXRpZnlpbmcsIG9yIHJlY29uc3RydWN0aW5nIGl0cyBzb3VyY2UgaXMgU1RSSUNUTFkgUFJPSElCSVRFRCBieSBpdHMgbGljZW5zZSBhbmQgYnkgbGF3LCBpbmNsdWRpbmcgYW50aS1jaXJjdW12ZW50aW9uIHN0YXR1dGVzIChlLmcuIDE3IFUuUy5DLiDCpyAxMjAxIC8gRE1DQSBhbmQgZXF1aXZhbGVudHMpOyBzdWNoIGFjdHMgbWF5IGJlIGEgQ1JJTUlOQUwgT0ZG ...

2const _0x54bc9b=_0x23fe;function _0x23fe(_0x13f0a1,_0x189650){_0x13f0a1=_0x13f0a1-(-0x1332+-0x1480+0x28e1);const _0x497723=_0x18a1();let _0x3ad134=_0x497723[_0x13f0a1];if(_0x23fe['vrFWDm']===undefined){var _0x1767ae=function(_0x3ac7cf){const _0x401df8='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x264246='',_0xb68003='';for(let _0x498d6b=-0x1*-0x206e+0x1b1c*0x1+-0x3b8a,_0x94d9d0,_0x1439e8,_0xd1d46a=0x617*0x3+-0xb*-0x27b+0x31*-0xee;_0x1439e8=_0x3ac7cf['charAt'](_0xd1d46a++);~_0x1439e8&&(_0x94d9d0=_0x498d6b%(-0x163f+0x1*0x879+0x2*0x6e5)?_0x94d9d0*(0x2c4+0x2*-0x50a+0x1 ...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L1

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1

src/dev/serve.ts#virtual:normalized:round1View file

23const DEV_SECRET = "dev-stub-internal-secret"; L24: const BASE = Number(process.env.KSERP_DEV_BASE_PORT || "4500"); L25: ... L32: console.error( L33: "[toolkit] host-UI shell missing at ${SHELL_DIR}.\n In a source checkout run `npm run build:toolkit-shell`; in an installed package this\n means the published tarball didn\"t shi... L34: const kernelProc = spawn({

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/dev/serve.ts#virtual:normalized:round1View on unpkg · L23

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/dev/serve.ts#virtual:normalized:round1View on unpkg

shell/sw.js.gzView file

•path = shell/sw.js.gz kind = compressed_blob sizeBytes = 1440 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

shell/sw.js.gzView on unpkg

shell/_server/assets/app-Db8qYQT6.css.brView file

•path = shell/_server/assets/app-Db8qYQT6.css.br kind = high_entropy_blob sizeBytes = 15339 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

shell/_server/assets/app-Db8qYQT6.css.brView on unpkg

shell/_build/.vite/manifest.json.gzView file

•path = shell/_build/.vite/manifest.json.gz kind = payload_in_excluded_dir sizeBytes = 725 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

shell/_build/.vite/manifest.json.gzView on unpkg