@kody-ade/kody-engine@0.4.562: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@kody-ade/kody-engine@0.4.562: Suspicious npm security report | LPM Firewall

Source & flagged code

11 flagged · loading source

dist/bin/kody.jsView file

11Source sends the broad process environment to a literal external destination. L11: L12: // package.json L13: var package_default; ... L76: type: "git", L77: url: "git+https://github.com/aharonyaircohen/kody-engine.git" L78: }, ... L99: const raw = fs.readFileSync(path.join(pkgDir, "package.json"), "utf8"); L100: const v = JSON.parse(raw)?.version; L101: return typeof v === "string" && v.length > 0 ? v : "unknown"; ... L112: let source = null; L113: for (const spec of candidateSpecs(process.platform, process.arch)) { L114: try {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/bin/kody.jsView on unpkg · L11

•matchType = previous_version_dangerous_delta matchedPackage = @kody-ade/kody-engine@0.4.558 matchedIdentity = npm:QGtvZHktYWRlL2tvZHktZW5naW5l:0.4.558 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin/kody.jsView on unpkg

1102// src/verify.ts L1103: import { spawn } from "child_process"; L1104: function buildVerifyEnv(source = process.env) {

High

Child Process

Package source references child process execution.

dist/bin/kody.jsView on unpkg · L1102

1127cwd, L1128: shell: true, L1129: env: buildVerifyEnv(),

High

Shell

Package source references shell execution.

dist/bin/kody.jsView on unpkg · L1127

3778// src/repoWorkspace.ts L3779: import { spawn as spawn2, spawnSync } from "child_process"; L3780: import * as fs10 from "fs"; L3781: import * as path11 from "path"; L3782: function buildCloneProcess(repo, token, baseEnv = process.env) { L3783: const url = `https://github.com/${repo}.git`; L3784: const env = { ...baseEnv };

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/kody.jsView on unpkg · L3778

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/bin/kody.js: const tmp = path.join(destDir, `.claude.${process.pid}.${Date.now()}.tmp`); const baseURL = optionalRuntimeString(record2, "baseURL"); if (baseURL) out.baseURL = baseURL; const cc = profile.claudeCode; fs4.mkdirSync(path5.join(root, ".claude-plugin"), { recursive: true }); fs4.writeFileSync(path5.join(dst, "hooks.json"), `${JSON.stringify(merged, null, 2)} fs4.writeFileSync(path5.join(root, ".claude-plugin", "plugin.json"), `${JSON.stringify(manifest, null, 2)} const names = profile.claudeCode.subagents;

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/bin/kody.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/bin/kody.js: url: "git+https://github.com/aharonyaircohen/kody-engine.git" homepage: "https://github.com/aharonyaircohen/kody-engine", bugs: "https://github.com/aharonyaircohen/kody-engine/issues" fs.copyFileSync(source, tmp); else if (ent.isFile()) fs4.copyFileSync(s, d); fs4.copyFileSync(resolvePart("commands", `${name}.md`), path5.join(dst, `${name}.md`)); fs4.writeFileSync(path5.join(dst, "hooks.json"), `${JSON.stringify(merged, null, 2)} fs4.writeFileSync(path5.join(root, ".claude-plugin", "plugin.json"), `${JSON.stringify(manifest, null, 2)}

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/bin/kody.jsView on unpkg

11L12: // package.json L13: var package_default; ... L76: type: "git", L77: url: "git+https://github.com/aharonyaircohen/kody-engine.git" L78: }, ... L99: const raw = fs.readFileSync(path.join(pkgDir, "package.json"), "utf8"); L100: const v = JSON.parse(raw)?.version; L101: return typeof v === "string" && v.length > 0 ? v : "unknown"; ... L112: let source = null; L113: for (const spec of candidateSpecs(process.platform, process.arch)) { L114: try {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin/kody.jsView on unpkg · L11

11L12: // package.json L13: var package_default; ... L76: type: "git", L77: url: "git+https://github.com/aharonyaircohen/kody-engine.git" L78: }, ... L99: const raw = fs.readFileSync(path.join(pkgDir, "package.json"), "utf8"); L100: const v = JSON.parse(raw)?.version; L101: return typeof v === "string" && v.length > 0 ? v : "unknown"; ... L112: let source = null; L113: for (const spec of candidateSpecs(process.platform, process.arch)) { L114: try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bin/kody.jsView on unpkg · L11

•matchType = token_shingles matchedPackage = @kody-ade/kody-engine@0.4.557 matchedPath = dist/bin/kody.js matchedIdentity = npm:QGtvZHktYWRlL2tvZHktZW5naW5l:0.4.557 similarity = 0.750 shingleOverlap = 36 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/kody.jsView on unpkg

dist/runtime-services/goal-scheduler/scheduler.shView file

•path = dist/runtime-services/goal-scheduler/scheduler.sh kind = build_helper sizeBytes = 31266 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/runtime-services/goal-scheduler/scheduler.shView on unpkg

Source & flagged code

11 flagged

dist/bin/kody.jsView file

11Source sends the broad process environment to a literal external destination. L11: L12: // package.json L13: var package_default; ... L76: type: "git", L77: url: "git+https://github.com/aharonyaircohen/kody-engine.git" L78: }, ... L99: const raw = fs.readFileSync(path.join(pkgDir, "package.json"), "utf8"); L100: const v = JSON.parse(raw)?.version; L101: return typeof v === "string" && v.length > 0 ? v : "unknown"; ... L112: let source = null; L113: for (const spec of candidateSpecs(process.platform, process.arch)) { L114: try {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/bin/kody.jsView on unpkg · L11

•matchType = previous_version_dangerous_delta matchedPackage = @kody-ade/kody-engine@0.4.558 matchedIdentity = npm:QGtvZHktYWRlL2tvZHktZW5naW5l:0.4.558 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin/kody.jsView on unpkg

1102// src/verify.ts L1103: import { spawn } from "child_process"; L1104: function buildVerifyEnv(source = process.env) {

High

Child Process

Package source references child process execution.

dist/bin/kody.jsView on unpkg · L1102

1127cwd, L1128: shell: true, L1129: env: buildVerifyEnv(),

High

Shell

Package source references shell execution.

dist/bin/kody.jsView on unpkg · L1127

3778// src/repoWorkspace.ts L3779: import { spawn as spawn2, spawnSync } from "child_process"; L3780: import * as fs10 from "fs"; L3781: import * as path11 from "path"; L3782: function buildCloneProcess(repo, token, baseEnv = process.env) { L3783: const url = `https://github.com/${repo}.git`; L3784: const env = { ...baseEnv };

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/kody.jsView on unpkg · L3778

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/bin/kody.js: const tmp = path.join(destDir, `.claude.${process.pid}.${Date.now()}.tmp`); const baseURL = optionalRuntimeString(record2, "baseURL"); if (baseURL) out.baseURL = baseURL; const cc = profile.claudeCode; fs4.mkdirSync(path5.join(root, ".claude-plugin"), { recursive: true }); fs4.writeFileSync(path5.join(dst, "hooks.json"), `${JSON.stringify(merged, null, 2)} fs4.writeFileSync(path5.join(root, ".claude-plugin", "plugin.json"), `${JSON.stringify(manifest, null, 2)} const names = profile.claudeCode.subagents;

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/bin/kody.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/bin/kody.js: url: "git+https://github.com/aharonyaircohen/kody-engine.git" homepage: "https://github.com/aharonyaircohen/kody-engine", bugs: "https://github.com/aharonyaircohen/kody-engine/issues" fs.copyFileSync(source, tmp); else if (ent.isFile()) fs4.copyFileSync(s, d); fs4.copyFileSync(resolvePart("commands", `${name}.md`), path5.join(dst, `${name}.md`)); fs4.writeFileSync(path5.join(dst, "hooks.json"), `${JSON.stringify(merged, null, 2)} fs4.writeFileSync(path5.join(root, ".claude-plugin", "plugin.json"), `${JSON.stringify(manifest, null, 2)}

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/bin/kody.jsView on unpkg

11L12: // package.json L13: var package_default; ... L76: type: "git", L77: url: "git+https://github.com/aharonyaircohen/kody-engine.git" L78: }, ... L99: const raw = fs.readFileSync(path.join(pkgDir, "package.json"), "utf8"); L100: const v = JSON.parse(raw)?.version; L101: return typeof v === "string" && v.length > 0 ? v : "unknown"; ... L112: let source = null; L113: for (const spec of candidateSpecs(process.platform, process.arch)) { L114: try {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin/kody.jsView on unpkg · L11

11L12: // package.json L13: var package_default; ... L76: type: "git", L77: url: "git+https://github.com/aharonyaircohen/kody-engine.git" L78: }, ... L99: const raw = fs.readFileSync(path.join(pkgDir, "package.json"), "utf8"); L100: const v = JSON.parse(raw)?.version; L101: return typeof v === "string" && v.length > 0 ? v : "unknown"; ... L112: let source = null; L113: for (const spec of candidateSpecs(process.platform, process.arch)) { L114: try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bin/kody.jsView on unpkg · L11

•matchType = token_shingles matchedPackage = @kody-ade/kody-engine@0.4.557 matchedPath = dist/bin/kody.js matchedIdentity = npm:QGtvZHktYWRlL2tvZHktZW5naW5l:0.4.557 similarity = 0.750 shingleOverlap = 36 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/kody.jsView on unpkg

dist/runtime-services/goal-scheduler/scheduler.shView file

•path = dist/runtime-services/goal-scheduler/scheduler.sh kind = build_helper sizeBytes = 31266 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/runtime-services/goal-scheduler/scheduler.shView on unpkg