@rayul/kordis@0.15.1: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

@rayul/kordis@0.15.1: AI-agent control-surface risk | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

951status: CommentStatusSchema.nullable(), L952: body: z9.string().min(1).max(1e4), L953: parent_id: UuidSchema.nullable(), ... L962: /** L963: * Web permalink (`https://kordis.store/<full_slug>#comment-<id>`). Server L964: * populates whenever it has the package slug at serialization time — ... L1120: // Schema-level backstop only: publish-service enforces the real 2 MB L1121: // BYTE cap (utf8 chars can be multi-byte, base64 inflates 4/3). The L1122: // char ceiling here just keeps non-core-api consumers of the contract ... L1368: * pinned (@version) AND has been yanked by its author. CLI uses this L1369: * to print the stderr warning. Bare-slug / range pulls never set L1370: * this flag (those paths silently skip yanked versions). Field is

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L951

951Trigger-reachable chain: manifest.main -> dist/index.js L951: status: CommentStatusSchema.nullable(), L952: body: z9.string().min(1).max(1e4), L953: parent_id: UuidSchema.nullable(), ... L962: /** L963: * Web permalink (`https://kordis.store/<full_slug>#comment-<id>`). Server L964: * populates whenever it has the package slug at serialization time — ... L1120: // Schema-level backstop only: publish-service enforces the real 2 MB L1121: // BYTE cap (utf8 chars can be multi-byte, base64 inflates 4/3). The L1122: // char ceiling here just keeps non-core-api consumers of the contract ... L1368: * pinned (@version) AND has been yanked by its author. CLI uses this L1369: * to print the stderr warning. Bare-slug / range pulls never set L1370: * this flag (those paths silently skip yanked versions

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L951

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: // merges the hooks section into `.claude/settings.json` target: ".claude/settings.json" // `mcpToCodex` merges `.codex/config.toml` (`:103-109`), `mcpToContinue` target: ".codex/config.toml" // still knows how to write `.claude/judgments/<name>.md`, and it is kept. baseUrl; this.baseUrl = config.baseUrl.replace(/\/$/, ""); if (token) headers.authorization = `Bearer ${token}`;

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

951Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js L951: status: CommentStatusSchema.nullable(), L952: body: z9.string().min(1).max(1e4), L953: parent_id: UuidSchema.nullable(), ... L962: /** L963: * Web permalink (`https://kordis.store/<full_slug>#comment-<id>`). Server L964: * populates whenever it has the package slug at serialization time — ... L1120: // Schema-level backstop only: publish-service enforces the real 2 MB L1121: // BYTE cap (utf8 chars can be multi-byte, base64 inflates 4/3). The L1122: // char ceiling here just keeps non-core-api consumers of the contract ... L1368: * pinned (@version) AND has been yanked by its author. CLI uses this L1369: * to print the stderr warning. Bare-slug / range pulls never set L1370: * this flag (those paths silen

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/index.jsView on unpkg · L951

Source & flagged code

6 flagged

package.jsonView file

Lines 7-47json

7 "homepage": "https://kordis.store",

8 "type": "module",

9 "bin": {

10 "kordis": "bin/kordis.js"

11 },

12 "main": "./dist/index.js",

13 "files": [

14 "bin",

15 "dist",

16 "assets",

17 "scripts",

18 "README.md",

19 "LICENSE",

20 "NOTICE"

21 ],

22 "scripts": {

23 "dev": "tsx src/index.ts",

24 "build": "tsup && rm -rf assets && mkdir -p assets && cp -R ../../packages/skills/. assets/",

25 "typecheck": "tsc --noEmit",

26 "test": "vitest run",

27 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 "prepublishOnly": "pnpm build"

29 },

30 "dependencies": {

31 "@iarna/toml": "^2.2.5",

32 "commander": "^12.1.0",

33 "jszip": "^3.10.1",

34 "kleur": "^4.1.5",

35 "open": "^10.1.0",

36 "ora": "^8.1.1",

37 "prompts": "^2.4.2",

38 "semver": "^7.8.4",

39 "yaml": "^2.9.0",

40 "zod": "^3.23.8"

41 },

42 "optionalDependencies": {

43 "keytar": "7.9.0"

44 },

45 "devDependencies": {

46 "@kordis/api-client": "workspace:*",

47 "@kordis/config": "workspace:*",

dist/index.jsView file

951status: CommentStatusSchema.nullable(), L952: body: z9.string().min(1).max(1e4), L953: parent_id: UuidSchema.nullable(), ... L962: /** L963: * Web permalink (`https://kordis.store/<full_slug>#comment-<id>`). Server L964: * populates whenever it has the package slug at serialization time — ... L1120: // Schema-level backstop only: publish-service enforces the real 2 MB L1121: // BYTE cap (utf8 chars can be multi-byte, base64 inflates 4/3). The L1122: // char ceiling here just keeps non-core-api consumers of the contract ... L1368: * pinned (@version) AND has been yanked by its author. CLI uses this L1369: * to print the stderr warning. Bare-slug / range pulls never set L1370: * this flag (those paths silently skip yanked versions). Field is

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L951

951Trigger-reachable chain: manifest.main -> dist/index.js L951: status: CommentStatusSchema.nullable(), L952: body: z9.string().min(1).max(1e4), L953: parent_id: UuidSchema.nullable(), ... L962: /** L963: * Web permalink (`https://kordis.store/<full_slug>#comment-<id>`). Server L964: * populates whenever it has the package slug at serialization time — ... L1120: // Schema-level backstop only: publish-service enforces the real 2 MB L1121: // BYTE cap (utf8 chars can be multi-byte, base64 inflates 4/3). The L1122: // char ceiling here just keeps non-core-api consumers of the contract ... L1368: * pinned (@version) AND has been yanked by its author. CLI uses this L1369: * to print the stderr warning. Bare-slug / range pulls never set L1370: * this flag (those paths silently skip yanked versions

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L951