Loading npm security reports…

@kody-ade/kody-engine@0.4.647: Malicious npm security report | LPM Firewall

registry / @kody-ade/kody-engine / 0.4.647

@kody-ade/kody-engine@0.4.647

kody — autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

The runtime automatically migrates declared environment secrets to a fixed package-controlled dashboard endpoint when it runs with GitHub Actions identity. It also creates a repository workflow when the user invokes its init flow.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Running the configured Kody workflow in GitHub Actions with declared secrets available in the environment.

Impact

Exposes CI secret values to the external Kody service without a per-secret approval step.

Mechanism

Uploads fallback environment secrets to the Kody API with an OIDC bearer token.

Attack narrative

After a user enables its generated workflow, the engine resolves declared secrets. If a secret comes from the GitHub Actions environment, it gathers the name and value and automatically sends the resulting map to the Kody API. The API resolver defaults to a fixed external dashboard host, and the request carries a GitHub OIDC bearer token. This is credential transfer to a package-controlled service, not merely local model configuration.

Rationale

The package contains a concrete automatic secret-upload path to a fixed external endpoint during CI runtime. Lack of an npm install hook reduces the trigger scope but does not neutralize the credential-exfiltration behavior.

Evidence

dist/bin/kody.jskody.config.json.github/workflows/kody.yml

Network endpoints1

kody-dashboard-khaki.vercel.app/api/kody/engine/secret

Source & flagged code

10 flagged · loading source

dist/bin/kody.jsView file

11Source sends the broad process environment to a literal external destination. L11: L12: // package.json L13: var package_default; ... L22: type: "git", L23: url: "git+https://github.com/aharonyaircohen/kody-engine.git" L24: }, ... L100: const raw = fs.readFileSync(path.join(pkgDir, "package.json"), "utf8"); L101: const v = JSON.parse(raw)?.version; L102: return typeof v === "string" && v.length > 0 ? v : "unknown"; ... L113: let source = null; L114: for (const spec of candidateSpecs(process.platform, process.arch)) { L115: try {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/bin/kody.jsView on unpkg · L11

1281// src/verify.ts L1282: import { spawn } from "child_process"; L1283: function buildVerifyEnv(source = process.env) {

High

Child Process

Package source references child process execution.

dist/bin/kody.jsView on unpkg · L1281

1314cwd, L1315: shell: true, L1316: env: buildVerifyEnv(),

High

Shell

Package source references shell execution.

dist/bin/kody.jsView on unpkg · L1314

4372// src/repoWorkspace.ts L4373: import { spawn as spawn2, spawnSync } from "child_process"; L4374: import * as fs11 from "fs"; L4375: import * as path13 from "path"; L4376: function buildCloneProcess(repo, token, baseEnv = process.env) { L4377: const url = `https://github.com/${repo}.git`; L4378: const env = { ...baseEnv };

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/kody.jsView on unpkg · L4372

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/bin/kody.js: const tmp = path.join(destDir, `.claude.${process.pid}.${Date.now()}.tmp`); const baseURL = optionalRuntimeString(record2, "baseURL"); if (baseURL) out.baseURL = baseURL; const baseURL = optionalRuntimeString(record2, "baseURL"); if (baseURL) model.baseURL = baseURL; fs4.writeFileSync(contract.path, JSON.stringify(value), { mode: 384 }); const cc = profile.claudeCode; fs5.mkdirSync(path7.join(root, ".claude-plugin"), { recursive: true });

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/bin/kody.jsView on unpkg

11L12: // package.json L13: var package_default; ... L22: type: "git", L23: url: "git+https://github.com/aharonyaircohen/kody-engine.git" L24: }, ... L100: const raw = fs.readFileSync(path.join(pkgDir, "package.json"), "utf8"); L101: const v = JSON.parse(raw)?.version; L102: return typeof v === "string" && v.length > 0 ? v : "unknown"; ... L113: let source = null; L114: for (const spec of candidateSpecs(process.platform, process.arch)) { L115: try {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin/kody.jsView on unpkg · L11

11L12: // package.json L13: var package_default; ... L22: type: "git", L23: url: "git+https://github.com/aharonyaircohen/kody-engine.git" L24: }, ... L100: const raw = fs.readFileSync(path.join(pkgDir, "package.json"), "utf8"); L101: const v = JSON.parse(raw)?.version; L102: return typeof v === "string" && v.length > 0 ? v : "unknown"; ... L113: let source = null; L114: for (const spec of candidateSpecs(process.platform, process.arch)) { L115: try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bin/kody.jsView on unpkg · L11

•matchType = normalized_sha256 matchedPackage = @kody-ade/kody-engine@0.4.646 matchedPath = dist/bin/kody.js matchedIdentity = npm:QGtvZHktYWRlL2tvZHktZW5naW5l:0.4.646 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/kody.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 98b3a07b4eeabaa9 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @kody-ade/kody-engine@0.4.646 matchedPath = dist/bin/kody.js matchedIdentity = npm:QGtvZHktYWRlL2tvZHktZW5naW5l:0.4.646 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/bin/kody.jsView on unpkg

dist/runtime-services/goal-scheduler/scheduler.shView file

•path = dist/runtime-services/goal-scheduler/scheduler.sh kind = build_helper sizeBytes = 31266 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/runtime-services/goal-scheduler/scheduler.shView on unpkg

Source & flagged code

10 flagged

dist/bin/kody.jsView file

11Source sends the broad process environment to a literal external destination. L11: L12: // package.json L13: var package_default; ... L22: type: "git", L23: url: "git+https://github.com/aharonyaircohen/kody-engine.git" L24: }, ... L100: const raw = fs.readFileSync(path.join(pkgDir, "package.json"), "utf8"); L101: const v = JSON.parse(raw)?.version; L102: return typeof v === "string" && v.length > 0 ? v : "unknown"; ... L113: let source = null; L114: for (const spec of candidateSpecs(process.platform, process.arch)) { L115: try {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/bin/kody.jsView on unpkg · L11

1281// src/verify.ts L1282: import { spawn } from "child_process"; L1283: function buildVerifyEnv(source = process.env) {

High

Child Process

Package source references child process execution.

dist/bin/kody.jsView on unpkg · L1281

1314cwd, L1315: shell: true, L1316: env: buildVerifyEnv(),

High

Shell

Package source references shell execution.

dist/bin/kody.jsView on unpkg · L1314

4372// src/repoWorkspace.ts L4373: import { spawn as spawn2, spawnSync } from "child_process"; L4374: import * as fs11 from "fs"; L4375: import * as path13 from "path"; L4376: function buildCloneProcess(repo, token, baseEnv = process.env) { L4377: const url = `https://github.com/${repo}.git`; L4378: const env = { ...baseEnv };

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/kody.jsView on unpkg · L4372

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/bin/kody.js: const tmp = path.join(destDir, `.claude.${process.pid}.${Date.now()}.tmp`); const baseURL = optionalRuntimeString(record2, "baseURL"); if (baseURL) out.baseURL = baseURL; const baseURL = optionalRuntimeString(record2, "baseURL"); if (baseURL) model.baseURL = baseURL; fs4.writeFileSync(contract.path, JSON.stringify(value), { mode: 384 }); const cc = profile.claudeCode; fs5.mkdirSync(path7.join(root, ".claude-plugin"), { recursive: true });

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/bin/kody.jsView on unpkg

11L12: // package.json L13: var package_default; ... L22: type: "git", L23: url: "git+https://github.com/aharonyaircohen/kody-engine.git" L24: }, ... L100: const raw = fs.readFileSync(path.join(pkgDir, "package.json"), "utf8"); L101: const v = JSON.parse(raw)?.version; L102: return typeof v === "string" && v.length > 0 ? v : "unknown"; ... L113: let source = null; L114: for (const spec of candidateSpecs(process.platform, process.arch)) { L115: try {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin/kody.jsView on unpkg · L11

11L12: // package.json L13: var package_default; ... L22: type: "git", L23: url: "git+https://github.com/aharonyaircohen/kody-engine.git" L24: }, ... L100: const raw = fs.readFileSync(path.join(pkgDir, "package.json"), "utf8"); L101: const v = JSON.parse(raw)?.version; L102: return typeof v === "string" && v.length > 0 ? v : "unknown"; ... L113: let source = null; L114: for (const spec of candidateSpecs(process.platform, process.arch)) { L115: try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bin/kody.jsView on unpkg · L11

•matchType = normalized_sha256 matchedPackage = @kody-ade/kody-engine@0.4.646 matchedPath = dist/bin/kody.js matchedIdentity = npm:QGtvZHktYWRlL2tvZHktZW5naW5l:0.4.646 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/kody.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 98b3a07b4eeabaa9 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @kody-ade/kody-engine@0.4.646 matchedPath = dist/bin/kody.js matchedIdentity = npm:QGtvZHktYWRlL2tvZHktZW5naW5l:0.4.646 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/bin/kody.jsView on unpkg

dist/runtime-services/goal-scheduler/scheduler.shView file

•path = dist/runtime-services/goal-scheduler/scheduler.sh kind = build_helper sizeBytes = 31266 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/runtime-services/goal-scheduler/scheduler.shView on unpkg