registry  /  @moonshot-ai/kimi-code  /  0.23.1

@moonshot-ai/kimi-code@0.23.1

The Starting Point for Next-Gen Agents

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket
Supply chain
HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings
ManifestNo manifest risk signals triggered.
scanned 428 file(s), 17.0 MB of source, external domains: 127.0.0.1, chevrotain.io, code.kimi.com, docs.expo.dev, en.wikipedia.org, gitforwindows.org, github.com, jquery.org, langium.org, lodash.com, moonshotai.github.io, openjsf.org, remixicon.com, tldrlegal.com, underscorejs.org, undici.nodejs.org, vuejs.org, www.w3.org
Oversized source lightweight scan
dist/main.mjs12.8 MB file, sampled 256 KB
FilesystemNetworkChildProcessEnvironmentVarsCryptoShellDynamicRequireHighEntropyStringsUrlStringsdocs.expo.devgitforwindows.orggithub.commoonshotai.github.ioundici.nodejs.org

Source & flagged code

7 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
dist-web/assets/codeql-DsOJ9woJ.jsView file
1const e=Object.freeze(JSON.parse('{"displayName":"CodeQL","fileTypes":["ql","qll"],"name":"codeql","patterns":[{"include":"#module-member"}],"repository":{"abstract":{"match":"\\\\...
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist-web/assets/codeql-DsOJ9woJ.jsView on unpkg · L1
native/darwin/prebuilds/darwin-x64/darwin-modifiers.nodeView file
•path = native/darwin/prebuilds/darwin-x64/darwin-modifiers.node kind = native_binary sizeBytes = 12776 magicHex = [redacted]
Medium
Ships Native Binary

Package ships native binary artifacts.

native/darwin/prebuilds/darwin-x64/darwin-modifiers.nodeView on unpkg
dist-web/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file
•path = dist-web/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist-web/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg
dist/main.mjsView file
•path = dist/main.mjs kind = oversized_source_file sizeBytes = 13456343 magicHex = [redacted]
High
Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/main.mjsView on unpkg
•path = dist/main.mjs kind = oversized_cli_entrypoint sizeBytes = 13456343 magicHex = [redacted]
Medium
Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/main.mjsView on unpkg

Findings

3 High8 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighShips High Entropy Blobdist-web/assets/KaTeX_Script-Regular-D3wIWfF6.woff2
HighOversized Source Filedist/main.mjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist-web/assets/codeql-DsOJ9woJ.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumShips Native Binarynative/darwin/prebuilds/darwin-x64/darwin-modifiers.node
MediumOversized Cli Entrypointdist/main.mjs
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings