registry  /  @moonshot-ai/kimi-code  /  0.21.0

@moonshot-ai/kimi-code@0.21.0

The Starting Point for Next-Gen Agents

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket
Supply chain
HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings
ManifestNo manifest risk signals triggered.
scanned 427 file(s), 16.8 MB of source, external domains: 127.0.0.1, chevrotain.io, docs.expo.dev, en.wikipedia.org, gitforwindows.org, github.com, jquery.org, langium.org, lodash.com, moonshotai.github.io, openjsf.org, tldrlegal.com, underscorejs.org, undici.nodejs.org, vuejs.org, www.w3.org
Oversized source lightweight scan
dist/main.mjs11.5 MB file, sampled 256 KB
FilesystemNetworkChildProcessEnvironmentVarsCryptoShellDynamicRequireHighEntropyStringsUrlStringsdocs.expo.devgitforwindows.orggithub.commoonshotai.github.ioundici.nodejs.org

Source & flagged code

6 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
dist-web/assets/codeql-DsOJ9woJ.jsView file
1const e=Object.freeze(JSON.parse('{"displayName":"CodeQL","fileTypes":["ql","qll"],"name":"codeql","patterns":[{"include":"#module-member"}],"repository":{"abstract":{"match":"\\\\...
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist-web/assets/codeql-DsOJ9woJ.jsView on unpkg · L1
dist-web/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file
•path = dist-web/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist-web/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg
dist/main.mjsView file
•path = dist/main.mjs kind = oversized_source_file sizeBytes = 12017102 magicHex = [redacted]
High
Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/main.mjsView on unpkg
•path = dist/main.mjs kind = oversized_cli_entrypoint sizeBytes = 12017102 magicHex = [redacted]
Medium
Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/main.mjsView on unpkg

Findings

3 High7 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighShips High Entropy Blobdist-web/assets/KaTeX_Script-Regular-D3wIWfF6.woff2
HighOversized Source Filedist/main.mjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist-web/assets/codeql-DsOJ9woJ.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumOversized Cli Entrypointdist/main.mjs
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings