registry / Destructive action / @vpxa/aikit

@vpxa/aikit

Local-first AI developer toolkit — knowledge base, code analysis, context management, and developer tools for LLM agents

This report shows the evidence for @vpxa/aikit@0.1.469. 1 of 52 known versions is blocked or flagged. The newest version, 0.1.492, is allowed. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The guarded postinstall migration is narrow, but the runtime startup path contains confirmed unattended self-update behavior and destructive deletion of a foreign AI-agent configuration file.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User starts AI Kit's stdio or HTTP MCP server.

Impact

Loss of unrelated Claude MCP configuration and execution of newly downloaded package code.

Mechanism

startup auto-updater plus unconditional whole-file MCP config deletion

Attack narrative

On MCP startup, the server imports and calls autoUpgradeScaffold(). That code checks npm for a newer version, downloads and installs it under ~/.aikit, and separately removes ~/.claude/mcp.json wholesale when the file contains an "AI Kit" entry. The deletion discards unrelated MCP settings and occurs without an explicit user migration command.

AI rationale

The guarded postinstall migration is narrow, but the runtime startup path contains confirmed unattended self-update behavior and destructive deletion of a foreign AI-agent configuration file.

Evidence

package.jsonbin/postinstall-managed-launcher.mjspackages/server/dist/version-check-WY-1_gsR.jspackages/server/dist/server-stdio-81oC7t67.jspackages/server/dist/server-http-CoKUja5g.js~/.aikit/current-version.json~/.aikit/versions/~/.claude/mcp.json

Network endpoints1

registry.npmjs.org/@vpxa/aikit/latest

Decision evidence

public snapshot

AI called this Malicious at 93.0% confidence as Malware with low false-positive risk.

Evidence for block

packages/server/dist/version-check-WY-1_gsR.js deletes ~/.claude/mcp.json when it contains an "AI Kit" MCP entry.
The same module is invoked on stdio and HTTP server startup.
It silently downloads and installs newer package versions into ~/.aikit/versions.
Runtime updater fetches registry metadata then runs npm pack, tar, and npm install.

Evidence against

bin/postinstall-managed-launcher.mjs is guarded to ~/.aikit version staging.
Postinstall only invokes the narrow migrate-launcher command for version-pinned AI Kit entries.
No credential harvesting or non-registry exfiltration found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedProtestwareTelemetryUrlStrings

Source & flagged code

11 flagged

package.jsonView file

•scripts.postinstall = node ./bin/postinstall-managed-launcher.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

packages/tools/dist/index.jsView file

High

Child Process

Package source references child process execution.

packages/tools/dist/index.jsView on unpkg · L1

1import{a as e,n as t,o as n,r,s as i,t as a}from"./import-resolver-CUsGkGED.js";import{access as o,mkdir as s,readFile as c,readdir as l,rename as u,stat as d,writeFile as f}from"n... L2: `)){if(!a)continue;if(a.startsWith(`## `)){i=a.slice(3).split(`...`)[0];continue}let e=a[0],o=a[1],s=a.slice(3).trim();e===`?`&&o===`?`?r.push(s):(e!==` `&&e!==`?`&&t.push({status:... L3: `).trim()||t.message||`Command failed`}async function ot(e={}){if(it>=2)throw Error(`Too many concurrent check runs (${it}/2). Retry when one finishes or use targeted check({ files... L4: `).length-1,a=t.slice(r).match(/export\s+(?:async\s+)?(\w+)/);l.push({name:n[1],path:e.record.sourcePath,line:e.record.startLine+i,kind:a?.[1]??`unknown`})}}let f=new Map;for(let e... L5: `)){let e=t.match(/^\s*-\s+['"]?([^'"#\s]+)[

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

packages/tools/dist/index.jsView on unpkg · L1

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

packages/tools/dist/index.jsView on unpkg · L1

Low

Weak Crypto

Package source references weak cryptographic algorithms.

packages/tools/dist/index.jsView on unpkg · L1

scaffold/dist/definitions/bodies.mjsView file

496- [ ] **SSRF protection**: URLs validated against allowlist, no open redirects, internal IPs blocked L497: - [ ] **eval/Function prevention**: No dynamic code execution from user input (\`eval()\`, \`new Function()\`, \`vm.runInNewContext()\`) L498: - [ ] **Path traversal**: File paths sanitized, no \`..\` sequences reaching outside allowed directories

Low

Eval

Package source references a known benign dynamic code generation pattern.

scaffold/dist/definitions/bodies.mjsView on unpkg · L496

bin/aikit.mjsView file

53L54: await import(pathToFileURL(serverPath).href); L55: } else {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/aikit.mjsView on unpkg · L53

packages/server/dist/proxy.jsView file

1L2: import{n as e}from"./auth-WyW7VMsN.js";import{fileURLToPath as t}from"node:url";import{spawn as n}from"node:child_process";import{homedir as r}from"node:os";import{createInterface ... L3: `);for(let e of n.split(` L4: `))e.startsWith(`data: `)?t.push(e.slice(6)):e.startsWith(`data:`)&&t.push(e.slice(5));return t}const o={input:process.stdin,output:process.stdout,error:process.stderr,fetchImpl:gl... L5: `);let v=n.readTokenImpl();if(!v){n.error.write(`[aikit-proxy] No token found at ~/.aikit/token ... L11: L12: `))if(t.trim())for(let e of a(t))S(n.output,e)}else S(n.output,i)}catch(t){S(n.output,h(e,t))}}async function c(e,t=globalThis.fetch){try{return(await t(`${e}/health`,{method:`GET`... L13: `)?t:`${t}\n`)}function h(e,t){let n=null;try{n=JSON.parse(e).id??null}catch{n=null}r

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

packages/server/dist/proxy.jsView on unpkg · L1

packages/browser/dist/index.jsView file

1import{exec as e,execFileSync as t,execSync as n,spawn as r}from"node:child_process";import{appendFileSync as i,closeSync as a,copyFileSync as o,existsSync as s,mkdirSync as c,open... L2: `)}return JSON.stringify(t,null,2)}catch{return e}}function we(e,t=0,n=[]){let r=` `.repeat(t),i=typeof e.role==`string`?e.role.toUpperCase():``,a=typeof e.ref==`string`?e.ref:``,... L3: const text = await r.text();

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

packages/browser/dist/index.jsView on unpkg · L1

packages/chunker/wasm/tree-sitter-go.wasmView file

•path = packages/chunker/wasm/tree-sitter-go.wasm kind = wasm_module sizeBytes = 235957 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

packages/chunker/wasm/tree-sitter-go.wasmView on unpkg

packages/server/dist/version-check-WY-1_gsR.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @vpxa/aikit@0.1.461 matchedIdentity = npm:QHZweGEvYWlraXQ:0.1.461 similarity = 0.908 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

packages/server/dist/version-check-WY-1_gsR.jsView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall-managed-launcher.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

packages/tools/dist/index.jsView file

High

Child Process

Package source references child process execution.

packages/tools/dist/index.jsView on unpkg · L1

Findings

1 Critical6 High7 Medium7 Low

CriticalPrevious Version Dangerous Deltapackages/server/dist/version-check-WY-1_gsR.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processpackages/tools/dist/index.js

HighShell

HighSame File Env Network Executionpackages/server/dist/proxy.js

HighCommand Output Exfiltrationpackages/browser/dist/index.js

HighCloud Metadata Accesspackages/tools/dist/index.js

MediumDynamic Requirebin/aikit.mjs

MediumUnsafe Vm Contextpackages/tools/dist/index.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Wasm Module

Affected versions and remediation

This report applies to @vpxa/aikit@0.1.469.

The versions list below shows the verdict for each recorded version.

Avoid installing @vpxa/aikit@0.1.469. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-10 07:50:40.182Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

52 known versions

0.1.492latestUnknown—AllowUnder ReviewSep 30, 2026, 3:32 PM 0.1.491Unknown—AllowUnder ReviewSep 30, 2026, 4:42 AM 0.1.489Unknown—AllowUnder ReviewSep 28, 2026, 12:41 PM 0.1.487Unknown—AllowUnder ReviewSep 24, 2026, 11:46 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other destructive action packages

Behavioral surface

Related packages

Other destructive action packages

Source & flagged code