Loading npm security reports…
@leejungkiin/awkit: Malware – 26 npm versions blocked | LPM Firewall
Blocked by malware advisory
OpenSSF/OSV malware advisory MAL-2026-13427 identifies this version as malicious and supplies the Firewall block. LPM AI assessed this version as suspicious; the assessments disagree.
@leejungkiin/awkit Antigravity Workflow Unified AI agent orchestration system
This report shows the evidence for @leejungkiin/awkit@3.5.7 . 26 of 27 known versions are blocked or flagged. The newest version, 3.6.2, is blocked. See all versions .
imported 3mo ago · by OpenSSF/OSV OpenSSF/OSV advisory MAL-2026-13427 confirms this npm version as malicious.
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @leejungkiin/awkit (npm)
Details
The package ships scripts/dependency-manager.js which, when run as part of the install lifecycle, invokes execSync('curl -fsSL https://raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.sh...') to fetch and execute an installer script from the rtk-ai/rtk repository on a mutable master branch. The fetched shell script is not pinned to a commit or hash and is controlled by a third-party GitHub account whose relationship to the @leejungkiin scope is not established. The same script also contacts https://www.rtk-ai.app and reads platform/home-directory information (os.homedir(), process.platform) during its operation. Because npm executes lifecycle scripts on install, this results in remote code execution from an unpinned, third-party-controlled source on the installer's machine, and the fetched code has full shell privileges to modify the environment, install further binaries, or exfiltrate host data. Additional bundled code (bin/awk.js, scripts/model-manager.js) combines child_process usage with hardcoded HTTP POST/fetch endpoints in a minified bundle.
Suspicious Independent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
No install-time npm hook or passive credential-exfiltration chain was confirmed. However, the explicit installer has a concrete unverified remote payload path that mutates broad AI-agent control surfaces.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User runs `awkit install` or an npm script that invokes it.
Impact
A server-side payload change can alter later AI-agent behavior or introduce executable extension content.
Mechanism
Remote ZIP payload download followed by broad AI-agent extension and MCP configuration writes.
AI rationale
No install-time npm hook or passive credential-exfiltration chain was confirmed. However, the explicit installer has a concrete unverified remote payload path that mutates broad AI-agent control surfaces.
Evidence
package.json bin/awk.js ~/.agents/skills ~/.agents/workflows ~/.codex/config.json ~/.claude/mcp_servers.json
Network endpoints2
ai.kkvn.net /v1/awkit/manifestai.kkvn.net /v1/awkit/download?package=core
public snapshot AI called this Suspicious at 96.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for AI warning decision
bin/awk.js downloads ZIP payloads from ai.kkvn.net during `awkit install` without integrity verification. Downloaded core, skills, workflows and scripts are copied into global AI-agent directories. `awkit install` unconditionally adds MCP servers to Codex and Claude configuration files. The downloader embeds a bearer credential and invokes curl/unzip on server-selected archives. Evidence against
package.json has no preinstall, install, postinstall, or prepare lifecycle hook. The configuration and payload installation paths require an explicit `awkit install` command. Startup update checks only query manifests and notify; they do not download payloads. Behavioral surface
Source ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem Network Shell WebSocket
Supply chain HighEntropyStrings
32 flagged · loading source symphony/multica-ref/server/pkg/redact/redact_test.go View file 10 patternName = aws_access_key
severity = critical
line = 10
matchedText = input :=...fig"
Critical Critical Secret
Package contains a critical-looking secret pattern.
symphony/multica-ref/server/pkg/redact/redact_test.go View on unpkg · L10 10 patternName = aws_access_key
severity = critical
line = 10
matchedText = input :=...fig"
Critical Secret Pattern
AWS access key ID in symphony/multica-ref/server/pkg/redact/redact_test.go
symphony/multica-ref/server/pkg/redact/redact_test.go View on unpkg · L10 12 patternName = aws_access_key
severity = critical
line = 12
matchedText = if strin...") {
Critical Secret Pattern
AWS access key ID in symphony/multica-ref/server/pkg/redact/redact_test.go
symphony/multica-ref/server/pkg/redact/redact_test.go View on unpkg · L12 24 Critical 5 High 7 Medium 5 Low
Critical Critical Secret symphony/multica-ref/server/pkg/redact/redact_test.go
Critical Same File Env Network Execution bin/awk.js
Critical Credential Exfiltration bin/awk.js
Critical Command Output Exfiltration bin/awk.js
Critical Download Execute bin/awk.js
Critical Trigger Reachable Dangerous Capability bin/awk.js
Critical Previous Version Dangerous Delta bin/awk.js
Critical Secret Pattern symphony/multica-ref/server/pkg/redact/redact_test.go
Critical Secret Pattern symphony/multica-ref/server/pkg/redact/redact_test.go
Critical Secret Pattern symphony/multica-ref/server/pkg/redact/redact_test.go
Critical Secret Pattern
Affected versions and remediation This report applies to @leejungkiin/awkit@3.5.7 .
The versions list below shows the verdict for each recorded version.
Avoid installing @leejungkiin/awkit@3.5.7. Remove it from direct dependencies and check your lockfile for transitive copies. Choose an independently verified alternative or release. This report does not establish that other versions are safe. If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment. Evidence last updated: 2026-08-06 15:30:10.811Z (UTC) .
Source advisory published: 2026-08-06 14:22:52.000Z (UTC) .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced .
Versions 27 known versions External advisory Advisory
Package metadata npm Author Kien Le
Maintainers leejungkiin
Version 3.5.7
Latest on npm 3.6.2
Published Jul 20, 2026
License MIT
Dependencies 5
Integrity verified
Package size 20.7 MB
Files 1,408
Keywords awkit
Runtime surface package.json Entrypoints main → bin/awk.js bin → ag, awkit
Runtime node >=18.0.0
Artifact 27.3 MB · 1,408 files 1 signature(s)
Install lifecycle No install hooks · other: harvest, harvest-dry, install-global, lint +5
Behavioral surface ChildProcess Crypto DynamicRequire EnvironmentVars
UrlStrings
Manifest WildcardDependency
scanned 571 file(s), 3.05 MB of source, external domains: 10.0.0.5, 10.255.255.255, 127.0.0.1, 172.15.0.1, 172.16.0.1, 172.31.255.255, 172.32.0.1, 192.168.0.1, 192.168.1.131, 192.168.50.59, 192.169.1.1, 8.8.8.8, accounts.google.com, ai.kkvn.net, aistudio.google.com, antigravity.google, api.example.test, api.github.com, api.lucylab.io, api.telegram.org, api.trello.com, app.multica, codeload.github.com, evil.com, example.com, fonts.googleapis.com, fonts.gstatic.com, git.example.com, github.com, multica.ai, openrouter.ai, raw.githubusercontent.com, schema.org, trello.com, www.multica.ai, www.rtk-ai.app, www.skills.sh, x.com
22 patternName = aws_secret_key
severity = critical
line = 22
matchedText = input :=...KEY"
Critical Secret Pattern
AWS secret access key in symphony/multica-ref/server/pkg/redact/redact_test.go
symphony/multica-ref/server/pkg/redact/redact_test.go View on unpkg · L22 31 patternName = private_key_rsa
severity = critical
line = 31
matchedText = input :=...ne."
Critical Secret Pattern
RSA private key in symphony/multica-ref/server/pkg/redact/redact_test.go
symphony/multica-ref/server/pkg/redact/redact_test.go View on unpkg · L31 43 patternName = github_pat
severity = critical
line = 43
matchedText = input :=...lmn"
Critical Secret Pattern
GitHub personal access token in symphony/multica-ref/server/pkg/redact/redact_test.go
symphony/multica-ref/server/pkg/redact/redact_test.go View on unpkg · L43 208 patternName = github_pat
severity = critical
line = 208
matchedText = input :=...lmn"
Critical Secret Pattern
GitHub personal access token in symphony/multica-ref/server/pkg/redact/redact_test.go
symphony/multica-ref/server/pkg/redact/redact_test.go View on unpkg · L208 208 patternName = aws_access_key
severity = critical
line = 208
matchedText = input :=...lmn"
Critical Secret Pattern
AWS access key ID in symphony/multica-ref/server/pkg/redact/redact_test.go
symphony/multica-ref/server/pkg/redact/redact_test.go View on unpkg · L208 210 patternName = aws_access_key
severity = critical
line = 210
matchedText = if strin...") {
Critical Secret Pattern
AWS access key ID in symphony/multica-ref/server/pkg/redact/redact_test.go
symphony/multica-ref/server/pkg/redact/redact_test.go View on unpkg · L210 26 const path = require('path');
L27: const https = require('https');
L28: const { execSync, spawnSync } = require('child_process');
L29: const os = require('os');
...
L33: const AWK_ROOT = path.join(__dirname, '..');
L34: const HOME = process.env.HOME || process.env.USERPROFILE;
L35:
Critical Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
bin/awk.js View on unpkg · L26 26 const path = require('path');
L27: const https = require('https');
L28: const { execSync, spawnSync } = require('child_process');
L29: const os = require('os');
L30:
L31: const packageJson = require(path.join(__dirname, '..', 'package.json'));
L32: const AWK_VERSION = packageJson.version;
L33: const AWK_ROOT = path.join(__dirname, '..');
L34: const HOME = process.env.HOME || process.env.USERPROFILE;
L35:
...
L229: input: process.stdin,
L230: output: process.stdout
Critical Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
bin/awk.js View on unpkg · L26 26 const path = require('path');
L27: const https = require('https');
L28: const { execSync, spawnSync } = require('child_process');
L29: const os = require('os');
L30:
L31: const packageJson = require(path.join(__dirname, '..', 'package.json'));
L32: const AWK_VERSION = packageJson.version;
L33: const AWK_ROOT = path.join(__dirname, '..');
L34: const HOME = process.env.HOME || process.env.USERPROFILE;
L35:
...
L229: input: process.stdin,
L230: output: process.stdout
Critical Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
bin/awk.js View on unpkg · L26 26 const path = require('path');
L27: const https = require('https');
L28: const { execSync, spawnSync } = require('child_process');
L29: const os = require('os');
L30:
L31: const packageJson = require(path.join(__dirname, '..', 'package.json'));
L32: const AWK_VERSION = packageJson.version;
L33: const AWK_ROOT = path.join(__dirname, '..');
L34: const HOME = process.env.HOME || process.env.USERPROFILE;
L35:
...
L229: input: process.stdin,
L230: output: process.stdout
Critical Download Execute
Source downloads or fetches remote code and executes it.
bin/awk.js View on unpkg · L26 26 Trigger-reachable chain: manifest.main -> bin/awk.js
L26: const path = require('path');
L27: const https = require('https');
L28: const { execSync, spawnSync } = require('child_process');
L29: const os = require('os');
L30:
L31: const packageJson = require(path.join(__dirname, '..', 'package.json'));
L32: const AWK_VERSION = packageJson.version;
L33: const AWK_ROOT = path.join(__dirname, '..');
L34: const HOME = process.env.HOME || process.env.USERPROFILE;
L35:
...
L229: input: process.stdin,
L230: output: process.stdout
Critical Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
bin/awk.js View on unpkg · L26 • matchType = previous_version_dangerous_delta
matchedPackage = @leejungkiin/awkit@3.3.4
matchedIdentity = npm:QGxlZWp1bmdraWluL2F3a2l0:3.3.4
similarity = 0.992
summary = stored previous version shares package body but lacks this dangerous source file
Critical Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/awk.js View on unpkg 27 const https = require('https');
L28: const { execSync, spawnSync } = require('child_process');
L29: const os = require('os');
213 const answer = execSync(
L214: `bash -c 'read -p "${question} [y/N]: " ans; echo $ans'`,
L215: { stdio: ['inherit', 'pipe', 'inherit'] }
26 const path = require('path');
L27: const https = require('https');
L28: const { execSync, spawnSync } = require('child_process');
L29: const os = require('os');
L30:
L31: const packageJson = require(path.join(__dirname, '..', 'package.json'));
L32: const AWK_VERSION = packageJson.version;
L33: const AWK_ROOT = path.join(__dirname, '..');
L34: const HOME = process.env.HOME || process.env.USERPROFILE;
L35:
...
L229: input: process.stdin,
L230: output: process.stdout
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
bin/awk.js View on unpkg · L26 897 try {
L898: execSync('which symphony', { stdio: 'ignore' });
L899: if (!silent) ok('Symphony CLI is installed');
...
L902: if (!silent) warn('Symphony CLI not found. Please install it manually:');
L903: if (!silent) dim(' npm install -g @leejungkiin/awkit-symphony');
L904: return false;
High Runtime Package Install
Package source invokes a package manager install command at runtime.
bin/awk.js View on unpkg · L897 26 const path = require('path');
L27: const https = require('https');
L28: const { execSync, spawnSync } = require('child_process');
L29: const os = require('os');
L30:
L31: const packageJson = require(path.join(__dirname, '..', 'package.json'));
L32: const AWK_VERSION = packageJson.version;
L33: const AWK_ROOT = path.join(__dirname, '..');
L34: const HOME = process.env.HOME || process.env.USERPROFILE;
L35:
...
L229: input: process.stdin,
L230: output: process.stdout
Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
bin/awk.js View on unpkg · L26 1 const { generateGreeting, getGreetingHistory, getGreetingStats } = require('./index');
L2: const fs = require('fs');
Medium Dynamic Require
Package source references dynamic require/import behavior.
core/GreetingEngine/test.js View on unpkg · L1 symphony/multica-ref/docker/entrypoint.sh View file • path = symphony/multica-ref/docker/entrypoint.sh
kind = build_helper
sizeBytes = 110
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
symphony/multica-ref/docker/entrypoint.sh View on unpkg symphony/multica-ref/apps/desktop/build/icon.icns View file • path = symphony/multica-ref/apps/desktop/build/icon.icns
kind = high_entropy_blob
sizeBytes = 1170743
magicHex = [redacted]
High Ships High Entropy Blob
Package ships high-entropy non-source blobs.
symphony/multica-ref/apps/desktop/build/icon.icns View on unpkg symphony/multica-ref/packages/views/issues/utils/redact.test.ts View file 6 patternName = aws_access_key
severity = critical
line = 6
matchedText = const re...E");
Critical Secret Pattern
AWS access key ID in symphony/multica-ref/packages/views/issues/utils/redact.test.ts
symphony/multica-ref/packages/views/issues/utils/redact.test.ts View on unpkg · L6 7 patternName = aws_access_key
severity = critical
line = 7
matchedText = expect(r...E");
Critical Secret Pattern
AWS access key ID in symphony/multica-ref/packages/views/issues/utils/redact.test.ts
symphony/multica-ref/packages/views/issues/utils/redact.test.ts View on unpkg · L7 12 patternName = aws_secret_key
severity = critical
line = 12
matchedText = const re...Y");
Critical Secret Pattern
AWS secret access key in symphony/multica-ref/packages/views/issues/utils/redact.test.ts
symphony/multica-ref/packages/views/issues/utils/redact.test.ts View on unpkg · L12 17 patternName = private_key_rsa
severity = critical
line = 17
matchedText = const in...--";
Critical Secret Pattern
RSA private key in symphony/multica-ref/packages/views/issues/utils/redact.test.ts
symphony/multica-ref/packages/views/issues/utils/redact.test.ts View on unpkg · L17 24 patternName = github_pat
severity = critical
line = 24
matchedText = const re...n");
Critical Secret Pattern
GitHub personal access token in symphony/multica-ref/packages/views/issues/utils/redact.test.ts
symphony/multica-ref/packages/views/issues/utils/redact.test.ts View on unpkg · L24 71 patternName = github_pat
severity = critical
line = 71
matchedText = const re...n");
Critical Secret Pattern
GitHub personal access token in symphony/multica-ref/packages/views/issues/utils/redact.test.ts
symphony/multica-ref/packages/views/issues/utils/redact.test.ts View on unpkg · L71 71 patternName = aws_access_key
severity = critical
line = 71
matchedText = const re...n");
Critical Secret Pattern
AWS access key ID in symphony/multica-ref/packages/views/issues/utils/redact.test.ts
symphony/multica-ref/packages/views/issues/utils/redact.test.ts View on unpkg · L71 72 patternName = aws_access_key
severity = critical
line = 72
matchedText = expect(r...E");
Critical Secret Pattern
AWS access key ID in symphony/multica-ref/packages/views/issues/utils/redact.test.ts
symphony/multica-ref/packages/views/issues/utils/redact.test.ts View on unpkg · L72 docs/research/reverse-skills-study/fausto-ai-mobile-re/ai-mobile-reverse-skills/tools/scripts/sign_rebuilder.py View file 719 patternName = private_key_rsa
severity = critical
line = 719
matchedText = "key": "...--",
Critical Secret Pattern
RSA private key in docs/research/reverse-skills-study/fausto-ai-mobile-re/ai-mobile-reverse-skills/tools/scripts/sign_rebuilder.py
docs/research/reverse-skills-study/fausto-ai-mobile-re/ai-mobile-reverse-skills/tools/scripts/sign_rebuilder.py View on unpkg · L719 symphony/multica-ref/server/pkg/redact/redact_test.go
Critical Secret Pattern symphony/multica-ref/server/pkg/redact/redact_test.go
Critical Secret Pattern symphony/multica-ref/server/pkg/redact/redact_test.go
Critical Secret Pattern symphony/multica-ref/server/pkg/redact/redact_test.go
Critical Secret Pattern symphony/multica-ref/server/pkg/redact/redact_test.go
Critical Secret Pattern symphony/multica-ref/packages/views/issues/utils/redact.test.ts
Critical Secret Pattern symphony/multica-ref/packages/views/issues/utils/redact.test.ts
Critical Secret Pattern symphony/multica-ref/packages/views/issues/utils/redact.test.ts
Critical Secret Pattern symphony/multica-ref/packages/views/issues/utils/redact.test.ts
Critical Secret Pattern symphony/multica-ref/packages/views/issues/utils/redact.test.ts
Critical Secret Pattern symphony/multica-ref/packages/views/issues/utils/redact.test.ts
Critical Secret Pattern symphony/multica-ref/packages/views/issues/utils/redact.test.ts
Critical Secret Pattern symphony/multica-ref/packages/views/issues/utils/redact.test.ts
Critical Secret Pattern docs/research/reverse-skills-study/fausto-ai-mobile-re/ai-mobile-reverse-skills/tools/scripts/sign_rebuilder.py
High Child Process bin/awk.js
High Sandbox Evasion Gated Capability bin/awk.js
High Runtime Package Install bin/awk.js
High Ships High Entropy Blob symphony/multica-ref/apps/desktop/build/icon.icns
Medium Dynamic Require core/GreetingEngine/test.js
Medium Install Persistence bin/awk.js
Medium Ships Build Helper symphony/multica-ref/docker/entrypoint.sh
Medium Structural Risk Force Deep Review
Medium Wildcard Dependency
3.5.9
Malicious
Malware
Block
Published
Jul 20, 2026, 2:40 PM
Eval
Filesystem
Network
Shell
WebSocket
HighEntropyStrings
UrlStrings
WildcardDependency
32 flagged symphony/multica-ref/server/pkg/redact/redact_test.go View file Lines 1-30 text
8 func TestRedactAWSAccessKey(t *testing.T) {
10 input := "Found key AKIAIOSFODNN7EXAMPLE in config"
Critical Critical Secret
Package contains a critical-looking secret pattern.
symphony/multica-ref/server/pkg/redact/redact_test.go View on unpkg · L10 12 if strings.Contains(got, "AKIAIOSFODNN7EXAMPLE") {
13 t.Fatalf("AWS key not redacted: %s", got)
15 if !strings.Contains(got, "[REDACTED AWS KEY]") {
16 t.Fatalf("expected [REDACTED AWS KEY] placeholder, got: %s", got)
20 func TestRedactAWSSecretKey(t *testing.T) {
22 input := "aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
24 if strings.Contains(got, "wJalrXUtnFEMI") {
25 t.Fatalf("AWS secret not redacted: %s", got)
29 func TestRedactPrivateKey(t *testing.T) {
10 patternName = aws_access_key
severity = critical
line = 10
matchedText = input :=...fig"
Critical Secret Pattern
AWS access key ID in symphony/multica-ref/server/pkg/redact/redact_test.go
symphony/multica-ref/server/pkg/redact/redact_test.go View on unpkg · L10 12 patternName = aws_access_key
severity = critical
line = 12
matchedText = if strin...") {
Critical Secret Pattern
AWS access key ID in symphony/multica-ref/server/pkg/redact/redact_test.go
symphony/multica-ref/server/pkg/redact/redact_test.go View on unpkg · L12 22 patternName = aws_secret_key
severity = critical
line = 22
matchedText = input :=...KEY"
Critical Secret Pattern
AWS secret access key in symphony/multica-ref/server/pkg/redact/redact_test.go
symphony/multica-ref/server/pkg/redact/redact_test.go View on unpkg · L22 31 patternName = private_key_rsa
severity = critical
line = 31
matchedText = input :=...ne."
Critical Secret Pattern
RSA private key in symphony/multica-ref/server/pkg/redact/redact_test.go
symphony/multica-ref/server/pkg/redact/redact_test.go View on unpkg · L31 43 patternName = github_pat
severity = critical
line = 43
matchedText = input :=...lmn"
Critical Secret Pattern
GitHub personal access token in symphony/multica-ref/server/pkg/redact/redact_test.go
symphony/multica-ref/server/pkg/redact/redact_test.go View on unpkg · L43 208 patternName = github_pat
severity = critical
line = 208
matchedText = input :=...lmn"
Critical Secret Pattern
GitHub personal access token in symphony/multica-ref/server/pkg/redact/redact_test.go
symphony/multica-ref/server/pkg/redact/redact_test.go View on unpkg · L208 208 patternName = aws_access_key
severity = critical
line = 208
matchedText = input :=...lmn"
Critical Secret Pattern
AWS access key ID in symphony/multica-ref/server/pkg/redact/redact_test.go
symphony/multica-ref/server/pkg/redact/redact_test.go View on unpkg · L208 210 patternName = aws_access_key
severity = critical
line = 210
matchedText = if strin...") {
Critical Secret Pattern
AWS access key ID in symphony/multica-ref/server/pkg/redact/redact_test.go
symphony/multica-ref/server/pkg/redact/redact_test.go View on unpkg · L210 Lines 6-47 javascript
8 * awkit install Install AWK into the active platform runtime
9 * awkit install -- all Install AWK into every supported platform
10 * awkit uninstall Remove
Lines 1-21 javascript
1 const { generateGreeting , getGreetingHistory , getGreetingStats } = require ( './index' );
2 const fs = require ( 'fs' );
Medium Dynamic Require
Package source references dynamic require/import behavior.
symphony/multica-ref/docker/entrypoint.sh View file • path = symphony/multica-ref/docker/entrypoint.sh
kind = build_helper
sizeBytes = 110
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
symphony/multica-ref/docker/entrypoint.sh View on unpkg symphony/multica-ref/apps/desktop/build/icon.icns View file • path = symphony/multica-ref/apps/desktop/build/icon.icns
kind = high_entropy_blob
sizeBytes = 1170743
magicHex = [redacted]
High Ships High Entropy Blob
Package ships high-entropy non-source blobs.
symphony/multica-ref/apps/desktop/build/icon.icns View on unpkg symphony/multica-ref/packages/views/issues/utils/redact.test.ts View file 6 patternName = aws_access_key
severity = critical
line = 6
matchedText = const re...E");
Critical Secret Pattern
AWS access key ID in symphony/multica-ref/packages/views/issues/utils/redact.test.ts
symphony/multica-ref/packages/views/issues/utils/redact.test.ts View on unpkg · L6 7 patternName = aws_access_key
severity = critical
line = 7
matchedText = expect(r...E");
Critical Secret Pattern
AWS access key ID in symphony/multica-ref/packages/views/issues/utils/redact.test.ts
symphony/multica-ref/packages/views/issues/utils/redact.test.ts View on unpkg · L7 12 patternName = aws_secret_key
severity = critical
line = 12
matchedText = const re...Y");
Critical Secret Pattern
AWS secret access key in symphony/multica-ref/packages/views/issues/utils/redact.test.ts
symphony/multica-ref/packages/views/issues/utils/redact.test.ts View on unpkg · L12
docs/research/reverse-skills-study/fausto-ai-mobile-re/ai-mobile-reverse-skills/tools/scripts/sign_rebuilder.py View file 719 patternName = private_key_rsa
severity = critical
line = 719
matchedText = "key": "...--",
Critical Secret Pattern
RSA private key in docs/research/reverse-skills-study/fausto-ai-mobile-re/ai-mobile-reverse-skills/tools/scripts/sign_rebuilder.py
docs/research/reverse-skills-study/fausto-ai-mobile-re/ai-mobile-reverse-skills/tools/scripts/sign_rebuilder.py View on unpkg · L719 AWK
from system
11 * awkit update Update to latest version
12 * awkit init Init a new mobile project with Firebase setup
13 * awkit sync Sync repo to runtime (harvest is disabled)
14 * awkit status Compare repo vs installed files (diff view)
15 * awkit harvest [Disabled] Pull from ~/ .gemini / antigravity / into repo
16 * awkit doctor Check installation health
17 * awkit tg setup Setup Telegram Bot API credentials
18 * awkit tg send Send a message via Telegram Bot API
19 * awkit build Run project build command securely based on configuration
20 * awkit version Show current version
25 const fs = require ( 'fs' );
26 const path = require ( 'path' );
27 const https = require ( 'https' );
28 const { execSync , spawnSync } = require ( 'child_process' );
29 const os = require ( 'os' );
31 const packageJson = require (path. join (__dirname, '..' , 'package.json' ));
32 const AWK_VERSION = packageJson.version;
33 const AWK_ROOT = path. join (__dirname, '..' );
34 const HOME = process.env. HOME || process.env. USERPROFILE ;
35
Critical Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
bin/awk.js View on unpkg · L26 Critical Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
bin/awk.js View on unpkg · L26 Critical Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
bin/awk.js View on unpkg · L26 Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
bin/awk.js View on unpkg · L26 36 const { generateClineRules , generateClineWorkflows , generateClineSkills } = require ( './cline-generators' );
37 const { generateCodexAgentsMd , generateCodexSkills , generateCodexAgents } = require ( './codex-generators' );
38 const { generateClaudeRules , generateClaudeSkills } = require ( './claude-generators' );
39 const { generateCursorRules , generateCursorSkills , generateCursorWorkflows } = require ( './cursor-generators' );
40 const { cmdGate } = require ( '../scripts/automation-gate' );
41 const { cmdObsidian } = require ( '../scripts/obsidian-sync' );
42 const { cmdModel } = require ( '../scripts/model-manager' );
43 const { cmdI18n } = require ( '../scripts/i18n-helper' );
44 const { cmdStorage } = require ( '../scripts/artifact-storage' );
45 const { cmdPipeline } = require ( '../scripts/multi-model-pipeline' );
46 const depManager = require ( '../scripts/dependency-manager' );
47 const isNonInteractive = process.argv. includes ( '--yes' ) || process.argv. includes ( '-y' ) || process.argv. includes ( '--non-interactive' ) || ! process.stdin.isTTY;
Lines 193-233 javascript
200 function log ( msg ) { console. log (msg); }
201 function ok ( msg ) { log ( `${ C . green }✅ ${ msg }${ C . reset }` ); }
202 function warn ( msg ) { log ( `${ C . yellow }⚠️ ${ msg }${ C . reset }` ); }
203 function err ( msg ) { log ( `${ C . red }❌ ${ msg }${ C . reset }` ); }
204 function info ( msg ) { log ( `${ C . cyan }ℹ️ ${ msg }${ C . reset }` ); }
205 function dim ( msg ) { log ( `${ C . gray } ${ msg }${ C . reset }` ); }
208 * Prompt user for Y/N input synchronously (macOS/Linux only).
209 * Returns true if user answers 'y' or 'yes'.
211 function promptYN ( question ) {
213 const answer = execSync (
214 `bash -c 'read -p "${ question } [y/N]: " ans; echo $ans'` ,
215 { stdio: [ 'inherit' , 'pipe' , 'inherit' ] }
216 ). toString (). trim (). toLowerCase ();
217 return answer === 'y' || answer === 'yes' ;
224 * Interactive TUI confirmation (Yes/No) using readline.
226 function promptTuiConfirm ( question , defaultVal = true ) {
227 const readline = require ( 'readline' );
228 const rl = readline. createInterface ({
229 input: process.stdin,
230 output: process.stdout
232 const suffix = defaultVal ? ' (Y/n): ' : ' (y/N): ' ;
233 return new Promise (( resolve ) => {
26 const path = require('path');
L27: const https = require('https');
L28: const { execSync, spawnSync } = require('child_process');
L29: const os = require('os');
L30:
L31: const packageJson = require(path.join(__dirname, '..', 'package.json'));
L32: const AWK_VERSION = packageJson.version;
L33: const AWK_ROOT = path.join(__dirname, '..');
L34: const HOME = process.env.HOME || process.env.USERPROFILE;
L35:
...
L229: input: process.stdin,
L230: output: process.stdout
Critical Download Execute
Source downloads or fetches remote code and executes it.
bin/awk.js View on unpkg · L26 26 Trigger-reachable chain: manifest.main -> bin/awk.js
L26: const path = require('path');
L27: const https = require('https');
L28: const { execSync, spawnSync } = require('child_process');
L29: const os = require('os');
L30:
L31: const packageJson = require(path.join(__dirname, '..', 'package.json'));
L32: const AWK_VERSION = packageJson.version;
L33: const AWK_ROOT = path.join(__dirname, '..');
L34: const HOME = process.env.HOME || process.env.USERPROFILE;
L35:
...
L229: input: process.stdin,
L230: output: process.stdout
Critical Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
bin/awk.js View on unpkg · L26 • matchType = previous_version_dangerous_delta
matchedPackage = @leejungkiin/awkit@3.3.4
matchedIdentity = npm:QGxlZWp1bmdraWluL2F3a2l0:3.3.4
similarity = 0.992
summary = stored previous version shares package body but lacks this dangerous source file
Critical Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/awk.js View on unpkg 26 const path = require('path');
L27: const https = require('https');
L28: const { execSync, spawnSync } = require('child_process');
L29: const os = require('os');
L30:
L31: const packageJson = require(path.join(__dirname, '..', 'package.json'));
L32: const AWK_VERSION = packageJson.version;
L33: const AWK_ROOT = path.join(__dirname, '..');
L34: const HOME = process.env.HOME || process.env.USERPROFILE;
L35:
...
L229: input: process.stdin,
L230: output: process.stdout
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
bin/awk.js View on unpkg · L26 897 try {
L898: execSync('which symphony', { stdio: 'ignore' });
L899: if (!silent) ok('Symphony CLI is installed');
...
L902: if (!silent) warn('Symphony CLI not found. Please install it manually:');
L903: if (!silent) dim(' npm install -g @leejungkiin/awkit-symphony');
L904: return false;
High Runtime Package Install
Package source invokes a package manager install command at runtime.
bin/awk.js View on unpkg · L897 core/GreetingEngine/test.js
5 console. log ( "🧪 Testing Qwen's Generated GreetingEngine..." );
8 const g1 = generateGreeting ({ name: "Alice" , lang: "en" });
9 console. log ( `✅ Greeting 1: "${ g1 . data . message }"` );
11 const g2 = generateGreeting ({ name: "Bình" , lang: "vi" });
12 console. log ( `✅ Greeting 2: "${ g2 . data . message }"` );
14 const g3 = generateGreeting ({ name: "Yamada" , lang: "ja" });
15 console. log ( `✅ Greeting 3: "${ g3 . data . message }"` );
17 // Language fallback test
18 const g4 = generateGreeting ({ name: "Charlie" , lang: "fr" }); // French not supported, should fallback to English
19 console. log ( `✅ Greeting 4 (Fallback): "${ g4 . data . message }" (Language: ${ g4 . data . lang })` );
17 patternName = private_key_rsa
severity = critical
line = 17
matchedText = const in...--";
Critical Secret Pattern
RSA private key in symphony/multica-ref/packages/views/issues/utils/redact.test.ts
symphony/multica-ref/packages/views/issues/utils/redact.test.ts View on unpkg · L17 24 patternName = github_pat
severity = critical
line = 24
matchedText = const re...n");
Critical Secret Pattern
GitHub personal access token in symphony/multica-ref/packages/views/issues/utils/redact.test.ts
symphony/multica-ref/packages/views/issues/utils/redact.test.ts View on unpkg · L24 71 patternName = github_pat
severity = critical
line = 71
matchedText = const re...n");
Critical Secret Pattern
GitHub personal access token in symphony/multica-ref/packages/views/issues/utils/redact.test.ts
symphony/multica-ref/packages/views/issues/utils/redact.test.ts View on unpkg · L71 71 patternName = aws_access_key
severity = critical
line = 71
matchedText = const re...n");
Critical Secret Pattern
AWS access key ID in symphony/multica-ref/packages/views/issues/utils/redact.test.ts
symphony/multica-ref/packages/views/issues/utils/redact.test.ts View on unpkg · L71 72 patternName = aws_access_key
severity = critical
line = 72
matchedText = expect(r...E");
Critical Secret Pattern
AWS access key ID in symphony/multica-ref/packages/views/issues/utils/redact.test.ts
symphony/multica-ref/packages/views/issues/utils/redact.test.ts View on unpkg · L72