@kody-ade/kody-engine@0.4.528: Malicious npm security report | LPM Firewall

Loading npm security reports…

@kody-ade/kody-engine@0.4.528: Malicious npm security report | LPM Firewall

Source & flagged code

10 flagged · loading source

dist/bin/kody.jsView file

11Source sends the broad process environment to a literal external destination. L11: L12: // package.json L13: var package_default; ... L75: type: "git", L76: url: "git+https://github.com/aharonyaircohen/kody-engine.git" L77: }, ... L98: const raw = fs.readFileSync(path.join(pkgDir, "package.json"), "utf8"); L99: const v = JSON.parse(raw)?.version; L100: return typeof v === "string" && v.length > 0 ? v : "unknown"; ... L111: let source = null; L112: for (const spec of candidateSpecs(process.platform, process.arch)) { L113: try {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/bin/kody.jsView on unpkg · L11

11L12: // package.json L13: var package_default; ... L75: type: "git", L76: url: "git+https://github.com/aharonyaircohen/kody-engine.git" L77: }, ... L98: const raw = fs.readFileSync(path.join(pkgDir, "package.json"), "utf8"); L99: const v = JSON.parse(raw)?.version; L100: return typeof v === "string" && v.length > 0 ? v : "unknown"; ... L111: let source = null; L112: for (const spec of candidateSpecs(process.platform, process.arch)) { L113: try {

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/bin/kody.jsView on unpkg · L11

11Trigger-reachable chain: manifest.bin -> dist/bin/kody.js L11: L12: // package.json L13: var package_default; ... L75: type: "git", L76: url: "git+https://github.com/aharonyaircohen/kody-engine.git" L77: }, ... L98: const raw = fs.readFileSync(path.join(pkgDir, "package.json"), "utf8"); L99: const v = JSON.parse(raw)?.version; L100: return typeof v === "string" && v.length > 0 ? v : "unknown"; ... L111: let source = null; L112: for (const spec of candidateSpecs(process.platform, process.arch)) { L113: try {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/bin/kody.jsView on unpkg · L11

970// src/verify.ts L971: import { spawn } from "child_process"; L972: function buildVerifyEnv(source = process.env) {

High

Child Process

Package source references child process execution.

dist/bin/kody.jsView on unpkg · L970

995cwd, L996: shell: true, L997: env: buildVerifyEnv(),

High

Shell

Package source references shell execution.

dist/bin/kody.jsView on unpkg · L995

3508// src/repoWorkspace.ts L3509: import { spawn as spawn2, spawnSync } from "child_process"; L3510: import * as fs9 from "fs"; L3511: import * as path10 from "path"; L3512: function buildCloneProcess(repo, token, baseEnv = process.env) { L3513: const url = `https://github.com/${repo}.git`; L3514: const env = { ...baseEnv };

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/kody.jsView on unpkg · L3508

11L12: // package.json L13: var package_default; ... L75: type: "git", L76: url: "git+https://github.com/aharonyaircohen/kody-engine.git" L77: }, ... L98: const raw = fs.readFileSync(path.join(pkgDir, "package.json"), "utf8"); L99: const v = JSON.parse(raw)?.version; L100: return typeof v === "string" && v.length > 0 ? v : "unknown"; ... L111: let source = null; L112: for (const spec of candidateSpecs(process.platform, process.arch)) { L113: try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bin/kody.jsView on unpkg · L11

•matchType = normalized_sha256 matchedPackage = @kody-ade/kody-engine@0.4.536 matchedPath = dist/bin/kody.js matchedIdentity = npm:QGtvZHktYWRlL2tvZHktZW5naW5l:0.4.536 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/kody.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 98c915494b53bf9b signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @kody-ade/kody-engine@0.4.536 matchedPath = dist/bin/kody.js matchedIdentity = npm:QGtvZHktYWRlL2tvZHktZW5naW5l:0.4.536 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/bin/kody.jsView on unpkg

dist/runtime-services/goal-scheduler/scheduler.shView file

•path = dist/runtime-services/goal-scheduler/scheduler.sh kind = build_helper sizeBytes = 31266 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/runtime-services/goal-scheduler/scheduler.shView on unpkg

Source & flagged code

10 flagged

dist/bin/kody.jsView file

11Source sends the broad process environment to a literal external destination. L11: L12: // package.json L13: var package_default; ... L75: type: "git", L76: url: "git+https://github.com/aharonyaircohen/kody-engine.git" L77: }, ... L98: const raw = fs.readFileSync(path.join(pkgDir, "package.json"), "utf8"); L99: const v = JSON.parse(raw)?.version; L100: return typeof v === "string" && v.length > 0 ? v : "unknown"; ... L111: let source = null; L112: for (const spec of candidateSpecs(process.platform, process.arch)) { L113: try {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/bin/kody.jsView on unpkg · L11

11L12: // package.json L13: var package_default; ... L75: type: "git", L76: url: "git+https://github.com/aharonyaircohen/kody-engine.git" L77: }, ... L98: const raw = fs.readFileSync(path.join(pkgDir, "package.json"), "utf8"); L99: const v = JSON.parse(raw)?.version; L100: return typeof v === "string" && v.length > 0 ? v : "unknown"; ... L111: let source = null; L112: for (const spec of candidateSpecs(process.platform, process.arch)) { L113: try {

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/bin/kody.jsView on unpkg · L11

11Trigger-reachable chain: manifest.bin -> dist/bin/kody.js L11: L12: // package.json L13: var package_default; ... L75: type: "git", L76: url: "git+https://github.com/aharonyaircohen/kody-engine.git" L77: }, ... L98: const raw = fs.readFileSync(path.join(pkgDir, "package.json"), "utf8"); L99: const v = JSON.parse(raw)?.version; L100: return typeof v === "string" && v.length > 0 ? v : "unknown"; ... L111: let source = null; L112: for (const spec of candidateSpecs(process.platform, process.arch)) { L113: try {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/bin/kody.jsView on unpkg · L11

970// src/verify.ts L971: import { spawn } from "child_process"; L972: function buildVerifyEnv(source = process.env) {

High

Child Process

Package source references child process execution.

dist/bin/kody.jsView on unpkg · L970

995cwd, L996: shell: true, L997: env: buildVerifyEnv(),

High

Shell

Package source references shell execution.

dist/bin/kody.jsView on unpkg · L995

3508// src/repoWorkspace.ts L3509: import { spawn as spawn2, spawnSync } from "child_process"; L3510: import * as fs9 from "fs"; L3511: import * as path10 from "path"; L3512: function buildCloneProcess(repo, token, baseEnv = process.env) { L3513: const url = `https://github.com/${repo}.git`; L3514: const env = { ...baseEnv };

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/kody.jsView on unpkg · L3508

11L12: // package.json L13: var package_default; ... L75: type: "git", L76: url: "git+https://github.com/aharonyaircohen/kody-engine.git" L77: }, ... L98: const raw = fs.readFileSync(path.join(pkgDir, "package.json"), "utf8"); L99: const v = JSON.parse(raw)?.version; L100: return typeof v === "string" && v.length > 0 ? v : "unknown"; ... L111: let source = null; L112: for (const spec of candidateSpecs(process.platform, process.arch)) { L113: try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bin/kody.jsView on unpkg · L11

•matchType = normalized_sha256 matchedPackage = @kody-ade/kody-engine@0.4.536 matchedPath = dist/bin/kody.js matchedIdentity = npm:QGtvZHktYWRlL2tvZHktZW5naW5l:0.4.536 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/kody.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 98c915494b53bf9b signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @kody-ade/kody-engine@0.4.536 matchedPath = dist/bin/kody.js matchedIdentity = npm:QGtvZHktYWRlL2tvZHktZW5naW5l:0.4.536 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/bin/kody.jsView on unpkg

dist/runtime-services/goal-scheduler/scheduler.shView file

•path = dist/runtime-services/goal-scheduler/scheduler.sh kind = build_helper sizeBytes = 31266 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/runtime-services/goal-scheduler/scheduler.shView on unpkg