@kahitsan/plugin-sdk@0.8.4: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@kahitsan/plugin-sdk@0.8.4: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

bin/cli.mjsView file

11// so the launcher re-execs under Bun; install it from https://bun.sh. L12: import { spawn } from "node:child_process"; L13: import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

bin/cli.mjsView on unpkg · L11

dist/index.jsView file

1/*! [redacted]... L2: const _0x1f8500=_0x5178;(function(_0x3d7b7c,_0x432553){const _0x194dde=_0x5178,_0x1b2ada=_0x3d7b7c();while(!![]){try{const _0x3b1566=parseInt(_0x194dde(0x9e0))/(-0x15d4+0x1*0x1787+...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L1

1/*! [redacted]... L2: const _0x1f8500=_0x5178;(function(_0x3d7b7c,_0x432553){const _0x194dde=_0x5178,_0x1b2ada=_0x3d7b7c();while(!![]){try{const _0x3b1566=parseInt(_0x194dde(0x9e0))/(-0x15d4+0x1*0x1787+...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1

src/dev/serve.ts#virtual:normalized:round1View file

23const DEV_SECRET = "dev-stub-internal-secret"; L24: const BASE = Number(process.env.KSERP_DEV_BASE_PORT || "4500"); L25: ... L32: console.error( L33: "[toolkit] host-UI shell missing at ${SHELL_DIR}.\n In a source checkout run `npm run build:toolkit-shell`; in an installed package this\n means the published tarball didn\"t shi... L34: const kernelProc = spawn({

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/dev/serve.ts#virtual:normalized:round1View on unpkg · L23

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/dev/serve.ts#virtual:normalized:round1View on unpkg

shell/sw.js.gzView file

•path = shell/sw.js.gz kind = compressed_blob sizeBytes = 1440 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

shell/sw.js.gzView on unpkg

shell/_server/assets/app-DBwQ1Y_5.css.brView file

•path = shell/_server/assets/app-DBwQ1Y_5.css.br kind = high_entropy_blob sizeBytes = 15374 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

shell/_server/assets/app-DBwQ1Y_5.css.brView on unpkg

shell/_build/.vite/manifest.json.gzView file

•path = shell/_build/.vite/manifest.json.gz kind = payload_in_excluded_dir sizeBytes = 724 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

shell/_build/.vite/manifest.json.gzView on unpkg

Source & flagged code

8 flagged

bin/cli.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2// @kahitsan/plugin-sdk CLI — the dev toolkit launcher (Vision §5.1, K3/K4).

3//

4// npx @kahitsan/plugin-sdk <pluginDir> [<pluginDir> …] ← headline form

5// npx @kahitsan/plugin-sdk toolkit <pluginDir> … ← alias (back-compat)

6//

7// Boots the dev-kernel mediator + each plugin on Bun (local SQLite + a synthetic

8// logged-in admin) entirely from the INSTALLED package — no kernel source required.

9// Pass several plugin dirs to exercise the CONTRACT between plugins (does B expose

10// the method A consumes?) locally — no kernel, no Postgres. The harness is Bun-only,

11// so the launcher re-execs under Bun; install it from https://bun.sh.

12import { spawn } from "node:child_process";

13import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

bin/cli.mjsView on unpkg · L11

14import { dirname, join } from "node:path";

15

16const here = dirname(fileURLToPath(import.meta.url));

17let args = process.argv.slice(2);

18// `toolkit` is an optional leading verb (kept for back-compat); the headline form

19// takes plugin dirs directly, so a global `npx @kahitsan/plugin-sdk ./a ./b` works.

20if (args[0] === "toolkit") args = args.slice(1);

21const wantsHelp = args.includes("-h") || args.includes("--help");

22const dirs = args.filter((a) => !a.startsWith("-"));

23

24if (dirs.length === 0 || wantsHelp) {

25 const out = wantsHelp ? console.log : console.error;

26 out("usage: npx @kahitsan/plugin-sdk <pluginDir> [<pluginDir> …]");

27 out("");

28 out(" Boots the local dev toolkit — a dev-kernel mediator + each plugin on SQLite");

29 out(" + a synthetic logged-in admin, all from this installed package (no kernel");

30 out(" source). Load several plugins at once to exercise their cross-plugin calls:");

31 out("");

dist/index.jsView file

Lines 1-2javascript

1/*! QGthaGl0c2FuL3BsdWdpbi1zZGsg4oCUIFBST1BSSUVUQVJZICYgQ09ORklERU5USUFMLiBDb3B5cmlnaHQgKGMpIEthaGl0U2FuIENvcnAuIEFsbCByaWdodHMgcmVzZXJ2ZWQuIExpY2Vuc2VkLCBub3Qgc29sZC4gVGhpcyBmaWxlIGlzIGludGVudGlvbmFsbHkgT0JGVVNDQVRFRCB0byBwcm90ZWN0IHRyYWRlIHNlY3JldHMuIERlLW9iZnVzY2F0aW5nLCBkZWNvbXBpbGluZywgcmV2ZXJzZS1lbmdpbmVlcmluZywgYmVhdXRpZnlpbmcsIG9yIHJlY29uc3RydWN0aW5nIGl0cyBzb3VyY2UgaXMgU1RSSUNUTFkgUFJPSElCSVRFRCBieSBpdHMgbGljZW5zZSBhbmQgYnkgbGF3LCBpbmNsdWRpbmcgYW50aS1jaXJjdW12ZW50aW9uIHN0YXR1dGVzIChlLmcuIDE3IFUuUy5DLiDCpyAxMjAxIC8gRE1DQSBhbmQgZXF1aXZhbGVudHMpOyBzdWNoIGFjdHMgbWF5IGJlIGEgQ1JJTUlOQUwgT0ZG ...

2const _0x1f8500=_0x5178;(function(_0x3d7b7c,_0x432553){const _0x194dde=_0x5178,_0x1b2ada=_0x3d7b7c();while(!![]){try{const _0x3b1566=parseInt(_0x194dde(0x9e0))/(-0x15d4+0x1*0x1787+-0x1b2)+-parseInt(_0x194dde(0x582))/(0x1c*-0x1a+0x1*0x22e5+-0x200b)*(parseInt(_0x194dde(0x5b8))/(-0x1cdb+-0x59a+0x2278*0x1))+-parseInt(_0x194dde(0x44a))/(-0x14*0xde+0x87b+-0x1*-0x8e1)*(-parseInt(_0x194dde(0x7d7))/(0x2*-0x1367+0x2*-0x1f6+-0x1*-0x2abf))+parseInt(_0x194dde(0x600))/(0x12b+-0x22f0+0xd3*0x29)*(parseInt(_0x194dde(0x2ec))/(0x75b+0x1*0x2ab+-0x9ff))+parseInt(_0x194dde(0x27e))/(0x3*-0xaf6+-0x83*-0x1+-0x7*-0x4a1 ...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L1

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1

src/dev/serve.ts#virtual:normalized:round1View file

23const DEV_SECRET = "dev-stub-internal-secret"; L24: const BASE = Number(process.env.KSERP_DEV_BASE_PORT || "4500"); L25: ... L32: console.error( L33: "[toolkit] host-UI shell missing at ${SHELL_DIR}.\n In a source checkout run `npm run build:toolkit-shell`; in an installed package this\n means the published tarball didn\"t shi... L34: const kernelProc = spawn({

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/dev/serve.ts#virtual:normalized:round1View on unpkg · L23

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/dev/serve.ts#virtual:normalized:round1View on unpkg

shell/sw.js.gzView file

•path = shell/sw.js.gz kind = compressed_blob sizeBytes = 1440 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

shell/sw.js.gzView on unpkg

shell/_server/assets/app-DBwQ1Y_5.css.brView file

•path = shell/_server/assets/app-DBwQ1Y_5.css.br kind = high_entropy_blob sizeBytes = 15374 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

shell/_server/assets/app-DBwQ1Y_5.css.brView on unpkg

shell/_build/.vite/manifest.json.gzView file

•path = shell/_build/.vite/manifest.json.gz kind = payload_in_excluded_dir sizeBytes = 724 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

shell/_build/.vite/manifest.json.gzView on unpkg