Loading npm security reports…

@pixelzx/genesis@2026.7.19-1: Suspicious npm security report | LPM Firewall

registry / @pixelzx/genesis / 2026.7.19-1

@pixelzx/genesis@2026.7.19-1

⚠ Under review

Multi-channel AI gateway with extensible messaging integrations

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 22 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4,145 file(s), 35.2 MB of source, external domains: 127.0.0.1, 169.254.169.254, 192.168.1.100, a.co, accounts.feishu.cn, accounts.google.com, accounts.larksuite.com, adaptivecards.microsoft.com, ai-gateway.vercel.sh, ai.azure.com, aiplatform.googleapis.com, aistudio.google.com, aka.ms, albumart.url, api-data.line.me, api.anthropic.com, api.arcee.ai, api.botframework.azure.cn, api.botframework.com, api.botframework.us, api.chutes.ai, api.deepgram.com, api.deepseek.com, api.dev.runwayml.com, api.elevenlabs.io, api.exa.ai, api.example.com, api.firecrawl.dev, api.fireworks.ai, api.github.com, api.githubcopilot.com, api.gradium.ai, api.groq.com, api.individual.githubcopilot.com, api.kilo.ai, api.kimi.com, api.line.me, api.mainnet-beta.solana.com, api.minimax.io, api.minimaxi.com, api.mistral.ai, api.moonshot.ai, api.moonshot.cn, api.openai.com, api.perplexity.ai, api.plivo.com, api.pluralkit.me, api.push.apple.com, api.sandbox.push.apple.com, api.search.brave.com

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.preinstall = node scripts/preinstall-package-manager-warning.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/src-7idbw9ZQ.jsView file

1400patternName = private_key_rsa severity = critical line = 1400 matchedText = if (type...g");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src-7idbw9ZQ.jsView on unpkg · L1400

1400patternName = private_key_rsa severity = critical line = 1400 matchedText = if (type...g");

Critical

Secret Pattern

RSA private key in dist/src-7idbw9ZQ.js

dist/src-7idbw9ZQ.jsView on unpkg · L1400

dist/test.DNmyFkvJ-Bq7SBuA8.jsView file

4924snapshotContents = content; L4925: new Function("exports", snapshotContents)(data); L4926: } catch {}

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/test.DNmyFkvJ-Bq7SBuA8.jsView on unpkg · L4924

genesis.mjsView file

74try { L75: const mod = await import(specifier); L76: if (typeof mod.installProcessWarningFilter === "function") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

genesis.mjsView on unpkg · L74

dist/control-ui/assets/index-Dmolr-85.jsView file

3contains invisible/control Unicode U+FEFF (zero width no-break space) `?(se++,ce=0):e?ce+=e.length:ce++,e&&(oe+=e.length),e}var ve={default:function(){switch(B){case` `:case`\v`:case`\f`:case` `:case`\xA0`:case`<U+FEFF>`:case`

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-Dmolr-85.jsView on unpkg · L3

skills/model-usage/scripts/test_model_usage.pyView file

•path = skills/model-usage/scripts/test_model_usage.py kind = build_helper sizeBytes = 1310 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/model-usage/scripts/test_model_usage.pyView on unpkg

dist/control-ui/favicon.icoView file

•path = dist/control-ui/favicon.ico kind = high_entropy_blob sizeBytes = 6436 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/control-ui/favicon.icoView on unpkg

dist/extensions/diagnostics-otel/index.jsView file

•path = dist/extensions/diagnostics-otel/index.js kind = oversized_source_file sizeBytes = 2267180 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/extensions/diagnostics-otel/index.jsView on unpkg

dist/gateway-cli-Dc3b4zd0.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @pixelzx/genesis@2026.7.14 matchedIdentity = npm:QHBpeGVsengvZ2VuZXNpcw:2026.7.14 similarity = 0.458 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/gateway-cli-Dc3b4zd0.jsView on unpkg

dist/dist-DiycYvsS.jsView file

5170patternName = generic_password severity = medium line = 5170 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in dist/dist-DiycYvsS.js

dist/dist-DiycYvsS.jsView on unpkg · L5170

12559patternName = generic_password severity = medium line = 12559 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in dist/dist-DiycYvsS.js

dist/dist-DiycYvsS.jsView on unpkg · L12559

Source & flagged code

12 flagged

package.jsonView file

Lines 1413-1453json

1413 "lint:tmp:channel-agnostic-boundaries": "node scripts/check-channel-agnostic-boundaries.mjs",

1414 "lint:tmp:dynamic-import-warts": "node scripts/check-dynamic-import-warts.mjs",

1415 "lint:tmp:no-random-messaging": "node scripts/check-no-random-messaging-tmp.mjs",

1416 "lint:tmp:no-raw-channel-fetch": "node scripts/check-no-raw-channel-fetch.mjs",

1417 "lint:tmp:tsgo-core-boundary": "node scripts/check-tsgo-core-boundary.mjs",

1418 "lint:ui:no-raw-window-open": "node scripts/check-no-raw-window-open.mjs",

1419 "lint:web-fetch-provider-boundaries": "node scripts/check-web-fetch-provider-boundaries.mjs",

1420 "lint:web-search-provider-boundaries": "node scripts/check-web-search-provider-boundaries.mjs",

1421 "lint:webhook:no-low-level-body-read": "node scripts/check-webhook-auth-body-order.mjs",

1422 "mac:open": "open dist/Genesis.app",

1423 "mac:package": "bash scripts/package-mac-app.sh",

1424 "mac:restart": "bash scripts/restart-mac.sh",

1425 "moltbot:rpc": "node scripts/run-node.mjs agent --mode rpc --json",

1426 "plugin-sdk:api:check": "node --import tsx scripts/generate-plugin-sdk-api-baseline.ts --check",

1427 "plugin-sdk:api:gen": "node --import tsx scripts/generate-plugin-sdk-api-baseline.ts --write",

1428 "plugin-sdk:check-exports": "node scripts/sync-plugin-sdk-exports.mjs --check",

1429 "plugin-sdk:sync-exports": "node scripts/sync-plugin-sdk-exports.mjs",

1430 "plugin-sdk:usage": "node --import tsx scripts/analyze-plugin-sdk-usage.ts",

1431 "plugins:sync": "node --import tsx scripts/sync-plugin-versions.ts",

1432 "postinstall": "node scripts/postinstall-bundled-plugins.mjs",

1433 "preinstall": "node scripts/preinstall-package-manager-warning.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L1433

1434 "prepack": "node --import tsx scripts/genesis-prepack.ts",

1435 "prepare": "command -v git >/dev/null 2>&1 && git rev-parse --is-inside-work-tree >/dev/null 2>&1 && git config core.hooksPath git-hooks || exit 0",

1436 "prepush:ci": "bash scripts/prepush-ci.sh",

1437 "probe:anthropic:prompt": "node --import tsx scripts/anthropic-prompt-probe.ts",

1438 "protocol:check": "pnpm protocol:gen && pnpm protocol:gen:swift && git diff --exit-code -- dist/protocol.schema.json apps/macos/Sources/GenesisProtocol/GatewayModels.swift apps/shared/GenesisKit/Sources/GenesisProtocol/GatewayModels.swift",

1439 "protocol:gen": "node --import tsx scripts/protocol-gen.ts",

1440 "protocol:gen:swift": "node --import tsx scripts/protocol-gen-swift.ts",

1441 "proxy:coverage": "node scripts/run-node.mjs proxy coverage",

1442 "proxy:gateway": "node scripts/run-node.mjs proxy run -- node scripts/run-node.mjs gateway",

1443 "proxy:install-ca": "node --import tsx scripts/proxy-install-ca.mjs",

1444 "proxy:run": "node scripts/run-node.mjs proxy run",

1445 "proxy:start": "node scripts/run-node.mjs proxy start",

1446 "qa:e2e": "node --import tsx scripts/qa-e2e.ts",

1447 "qa:lab:build": "vite build --config extensions/qa-lab/web/vite.config.ts",

1448 "qa:lab:ui": "pnpm genesis qa ui",

1449 "qa:lab:up": "node --import tsx scripts/qa-lab-up.ts",

1450 "qa:lab:up:fast": "node --import tsx scripts/qa-lab-up.ts --use-prebuilt-image --bind-ui-dist --skip-ui-build",

1451 "qa:lab:watch": "vite build --watch --config extensions/qa-lab/web/vite.config.ts",

1452 "release-metadata:check": "node scripts/check-release-metadata-only.mjs",

1453 "release:check": "pnpm deps:root-ownership:check && pnpm check:base-config-schema && pnpm check:bundled-channel-config-metadata && pnpm config:docs:check && pnpm plugin-sdk:check-exports && pnpm plugin-sdk:api:check && node --import tsx scripts/release-check.ts",

dist/src-7idbw9ZQ.jsView file

Lines 1380-1420javascript

1380//#region node_modules/jwks-rsa/node_modules/jose/dist/node/cjs/key/import.js

1381var require_import = /* @__PURE__ */ __commonJSMin(((exports) => {

1382 Object.defineProperty(exports, "__esModule", { value: true });

1383

dist/test.DNmyFkvJ-Bq7SBuA8.jsView file

Lines 4904-4944javascript

4904];

4905function addSerializer(plugin) {

4906 PLUGINS = [plugin].concat(PLUGINS);

4907}

4908function getSerializers() {

genesis.mjsView file

Lines 54-94javascript

54 if (!isModuleNotFoundError(err)) {

55 return false;

56 }

57

58 const expectedUrl = new URL(specifier,

dist/control-ui/assets/index-Dmolr-85.jsView file

3contains invisible/control Unicode U+FEFF (zero width no-break space) `?(se++,ce=0):e?ce+=e.length:ce++,e&&(oe+=e.length),e}var ve={default:function(){switch(B){case` `:case`\v`:case`\f`:case` `:case`\xA0`:case`<U+FEFF>`:case`

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-Dmolr-85.jsView on unpkg · L3

skills/model-usage/scripts/test_model_usage.pyView file

•path = skills/model-usage/scripts/test_model_usage.py kind = build_helper sizeBytes = 1310 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/model-usage/scripts/test_model_usage.pyView on unpkg

dist/control-ui/favicon.icoView file

•path = dist/control-ui/favicon.ico kind = high_entropy_blob sizeBytes = 6436 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/control-ui/favicon.icoView on unpkg

dist/extensions/diagnostics-otel/index.jsView file

•path = dist/extensions/diagnostics-otel/index.js kind = oversized_source_file sizeBytes = 2267180 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/extensions/diagnostics-otel/index.jsView on unpkg

dist/gateway-cli-Dc3b4zd0.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @pixelzx/genesis@2026.7.14 matchedIdentity = npm:QHBpeGVsengvZ2VuZXNpcw:2026.7.14 similarity = 0.458 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/gateway-cli-Dc3b4zd0.jsView on unpkg

dist/dist-DiycYvsS.jsView file

5170patternName = generic_password severity = medium line = 5170 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in dist/dist-DiycYvsS.js

dist/dist-DiycYvsS.jsView on unpkg · L5170

12559patternName = generic_password severity = medium line = 12559 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in dist/dist-DiycYvsS.js

dist/dist-DiycYvsS.jsView on unpkg · L12559