@kanonak-protocol/cli@5.11.0: Suspicious npm security report

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 550 KB of source, external domains: ollama.com, www.w3.org

Source & flagged code

2 flagged

dist/index.jsView file

661See what you have: kanonak models`);let r=By();EO(TO(r),{recursive:!0}),NO(r,t+` L662: `),du(`kanonak ask now defaults to ${t}.`),Be("override per run with --model <tag>; switch mid-conversation with /model <tag>")}function Hy(e){let t=e.command("models").description... L663: (command exited ${o}; stderr: ${s.trim()})`:l.length===0&&(l=`(no output; stderr: ${s.trim()})`),t(l)}),r.on("error",o=>{clearTimeout(i),t(`error: failed to run kanonak: ${o.messag...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L661

647L648: `),n.length===0)process.stdout.write(` (none installed yet) L649: `);else for(let l of n){let c=l.tools?Ry("tools"):Ly("no tools");process.stdout.write(` ${o.green("\u2713")} ${o.bold(l.name)} ${o.dim(`${l.sizeGb.toFixed(1)} GB \xB7 ${l.family}... ... L657: `),process.stdout.write(` ${o.dim(l.why)} L658: `)}i(s.tag)||Be(`get the recommended model: kanonak models pull ${s.tag}`),Be('use one: kanonak ask --model <tag> "..." (or /model <tag> inside kanonak ask)')}async function DO... L659: `))>=0;){let f=s.slice(0,p).trim();if(s=s.slice(p+1),!f)continue;let m;try{m=JSON.parse(f)}catch{continue}if(m.error)throw i&&process.stderr.write("\r\x1B[K"),new Error(`ollama pul... ... L661: See what you have: kanonak models`);let r=By();EO(TO(r),{recursive:!0}),NO(r,t+` L662: `),du(`kanonak ask now defaults to ${t}.`),Be("override per run with --model <tag>; switch mid-conversation with /model <tag>")}function Hy(e){let t=e.command("models").description... L663: (command exited ${o}; stderr: ${s.trim()})`:l.length===0&&(l=`(no output; stderr: ${s.trim()})`),t(l)}),r.on("error",o=>{clearTimeout(i),t(`error: failed to run kanonak: ${o.messag...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L647

Source & flagged code

2 flagged · loading source

dist/index.jsView file

661See what you have: kanonak models`);let r=By();EO(TO(r),{recursive:!0}),NO(r,t+` L662: `),du(`kanonak ask now defaults to ${t}.`),Be("override per run with --model <tag>; switch mid-conversation with /model <tag>")}function Hy(e){let t=e.command("models").description... L663: (command exited ${o}; stderr: ${s.trim()})`:l.length===0&&(l=`(no output; stderr: ${s.trim()})`),t(l)}),r.on("error",o=>{clearTimeout(i),t(`error: failed to run kanonak: ${o.messag...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L661

647L648: `),n.length===0)process.stdout.write(` (none installed yet) L649: `);else for(let l of n){let c=l.tools?Ry("tools"):Ly("no tools");process.stdout.write(` ${o.green("\u2713")} ${o.bold(l.name)} ${o.dim(`${l.sizeGb.toFixed(1)} GB \xB7 ${l.family}... ... L657: `),process.stdout.write(` ${o.dim(l.why)} L658: `)}i(s.tag)||Be(`get the recommended model: kanonak models pull ${s.tag}`),Be('use one: kanonak ask --model <tag> "..." (or /model <tag> inside kanonak ask)')}async function DO... L659: `))>=0;){let f=s.slice(0,p).trim();if(s=s.slice(p+1),!f)continue;let m;try{m=JSON.parse(f)}catch{continue}if(m.error)throw i&&process.stderr.write("\r\x1B[K"),new Error(`ollama pul... ... L661: See what you have: kanonak models`);let r=By();EO(TO(r),{recursive:!0}),NO(r,t+` L662: `),du(`kanonak ask now defaults to ${t}.`),Be("override per run with --model <tag>; switch mid-conversation with /model <tag>")}function Hy(e){let t=e.command("models").description... L663: (command exited ${o}; stderr: ${s.trim()})`:l.length===0&&(l=`(no output; stderr: ${s.trim()})`),t(l)}),r.on("error",o=>{clearTimeout(i),t(`error: failed to run kanonak: ${o.messag...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L647

Findings

2 High3 Medium5 Low

HighChild Processdist/index.js

HighCommand Output Exfiltrationdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings