registry / @vpxa/aikit / 0.1.411

@vpxa/aikit@0.1.411

Local-first AI developer toolkit — knowledge base, code analysis, context management, and developer tools for LLM agents

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The guarded postinstall control-surface mutation creates lifecycle risk, but source inspection does not establish malicious behavior or a covert payload chain. Per policy, this is a warn-level same-vendor launcher migration.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm install inside the package's managed AI Kit staging layout; browser launch for runtime download.

Impact

Can update existing AI Kit IDE MCP configuration entries; no unconsented broad control-surface mutation was confirmed.

Mechanism

guarded same-vendor MCP launcher migration and user-invoked runtime bootstrap

AI rationale

Evidence

package.jsonbin/postinstall-managed-launcher.mjsbin/aikit.mjspackages/cli/dist/index.jspackages/browser/dist/index.js

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

package.json runs bin/postinstall-managed-launcher.mjs at postinstall.
bin/postinstall-managed-launcher.mjs conditionally imports the CLI and invokes migrate-launcher.
packages/cli/dist/index.js migrates version-pinned user IDE MCP entries.
packages/browser/dist/index.js can run npx -y agent-browser@latest on explicit browser launch.

Evidence against

Postinstall is a no-op outside ~/.aikit/versions/v*-staging/package.
Migration requires ~/.aikit/current-version.json and an existing matching version-pinned AI Kit entry.
Migrator targets AI Kit launcher replacement, not arbitrary config entries.
No credential harvesting, covert exfiltration, or destructive payload was found in inspected paths.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStrings

Source & flagged code

13 flagged

package.jsonView file

•scripts.postinstall = node ./bin/postinstall-managed-launcher.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

packages/tools/dist/index.jsView file

High

Child Process

Package source references child process execution.

packages/tools/dist/index.jsView on unpkg · L1

1import{a as e,n as t,o as n,r,s as i,t as a}from"./import-resolver-BjraRSaz.js";import{access as o,mkdir as s,readFile as c,readdir as l,rename as u,stat as d,writeFile as f}from"n... L2: `)){if(!a)continue;if(a.startsWith(`## `)){i=a.slice(3).split(`...`)[0];continue}let e=a[0],o=a[1],s=a.slice(3).trim();e===`?`&&o===`?`?r.push(s):(e!==` `&&e!==`?`&&t.push({status:... L3: `).trim()||t.message||`Command failed`}async function ot(e={}){if(it>=2)throw Error(`Too many concurrent check runs (${it}/2). Retry when one finishes or use targeted check({ files... L4: `).length-1,a=t.slice(r).match(/export\s+(?:async\s+)?(\w+)/);l.push({name:n[1],path:e.record.sourcePath,line:e.record.startLine+i,kind:a?.[1]??`unknown`})}}let f=new Map;for(let e... L5: `)){let e=t.match(/^\s*-\s+['"]?([^'"#\s]+)[

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

packages/tools/dist/index.jsView on unpkg · L1

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

packages/tools/dist/index.jsView on unpkg · L1

Low

Weak Crypto

Package source references weak cryptographic algorithms.

packages/tools/dist/index.jsView on unpkg · L1

scaffold/dist/definitions/bodies.mjsView file

489- [ ] **SSRF protection**: URLs validated against allowlist, no open redirects, internal IPs blocked L490: - [ ] **eval/Function prevention**: No dynamic code execution from user input (\`eval()\`, \`new Function()\`, \`vm.runInNewContext()\`) L491: - [ ] **Path traversal**: File paths sanitized, no \`..\` sequences reaching outside allowed directories

Low

Eval

Package source references a known benign dynamic code generation pattern.

scaffold/dist/definitions/bodies.mjsView on unpkg · L489

bin/aikit.mjsView file

53L54: await import(pathToFileURL(serverPath).href); L55: } else {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/aikit.mjsView on unpkg · L53

packages/server/dist/proxy.jsView file

1import{n as e}from"./auth-B5Pmafno.js";import{fileURLToPath as t}from"node:url";import{spawn as n}from"node:child_process";import{homedir as r}from"node:os";import{createInterface ... L2: `);for(let e of n.split(` L3: `))e.startsWith(`data: `)?t.push(e.slice(6)):e.startsWith(`data:`)&&t.push(e.slice(5));return t}const o={input:process.stdin,output:process.stdout,error:process.stderr,fetchImpl:gl... L4: `);let v=n.readTokenImpl();if(!v){n.error.write(`[aikit-proxy] No token found at ~/.aikit/token ... L10: L11: `))if(t.trim())for(let e of a(t))S(n.output,e)}else S(n.output,i)}catch(t){S(n.output,h(e,t))}}async function c(e,t=globalThis.fetch){try{return(await t(`${e}/health`,{method:`GET`... L12: `)?t:`${t}\n`)}function h(e,t){let n=null;try{n=JSON.parse(e).id??null}catch{n=null}return

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

packages/server/dist/proxy.jsView on unpkg · L1

packages/server/dist/startup-maintenance-Co9jDlcc.jsView file

1import{t as e}from"./rolldown-runtime-DT7IzrpZ.js";import{t}from"./curated-manager-D4MOFQ-t.js";import{fileURLToPath as n}from"node:url";import{INSTALL_ARGS as r,cleanupOldVersions... L2: `)}const Ne={enabled:!0,batchThreshold:20,cooldownMs:3e5,maxCandidatesPerSession:5,initialConfidence:40,excludeTools:[`knowledge`,`replay`,`stash`,`checkpoint`,`session_digest`,`re... ... L6: `)});return i.tags=b([...i.tags,`user-preference`,`collaboration`]),[i]}function et(e){let t=/\b(pros? and? cons?|tradeoffs?|alternative|compare|vs\.?|rather than|option|weigh|bene... L7: `)});return i.tags=b([...i.tags,`user-preference`,`decision-style`,`tradeoff`]),[i]}function tt(e,t=Ne){if(!t.enabled||e.length===0)return[];let n=new Set(t.excludeTools.map(e=>e.t... L8: `)}`,`lessons`,[...a??[],`confidence-${i

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

packages/server/dist/startup-maintenance-Co9jDlcc.jsView on unpkg · L1

packages/store/dist/index.jsView file

113Cross-file remote execution chain: packages/store/dist/index.js spawns packages/server/dist/index.js; helper contains network access plus dynamic code execution. L113: SELECT knowledge_id, 'default', '1', ?, 'float32', embedding, ? L114: FROM ${t.name}`,[a,r]);let s=e.queryAll(`SELECT COUNT(*) AS cnt FROM memory_embeddings`)[0]?.cnt??0;i+=s-o}i>0&&oe.info(`[migration v4] backfilled ${i} embeddings into memory_embed... L115: CREATE TABLE IF NOT EXISTS ${Pe} ( ... L662: entry_id ASC L663: LIMIT ?`);return{create(e,n){t.run(e,n??`working`)},get(e){return n.get(e)},touch(e){r.run(e)},updateScore(e,t){i.run(t,e)},updateConfidence(e,t){a.run(t,e)},updateTier(e,t){o.run(...

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

packages/store/dist/index.jsView on unpkg · L113

packages/chunker/wasm/tree-sitter-go.wasmView file

•path = packages/chunker/wasm/tree-sitter-go.wasm kind = wasm_module sizeBytes = 235957 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

packages/chunker/wasm/tree-sitter-go.wasmView on unpkg

scaffold/dist/definitions/skills/docs.mjsView file

•path = [redacted].mjs kind = oversized_source_file sizeBytes = 2785696 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

scaffold/dist/definitions/skills/docs.mjsView on unpkg

packages/browser/dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @vpxa/aikit@0.1.377 matchedIdentity = npm:QHZweGEvYWlraXQ:0.1.377 similarity = 0.492 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

packages/browser/dist/index.jsView on unpkg

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall-managed-launcher.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

packages/tools/dist/index.jsView file

High

Child Process

Package source references child process execution.

packages/tools/dist/index.jsView on unpkg · L1

Findings

1 Critical8 High7 Medium6 Low

CriticalPrevious Version Dangerous Deltapackages/browser/dist/index.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processpackages/tools/dist/index.js

HighShell

HighSame File Env Network Executionpackages/server/dist/proxy.js

HighCommand Output Exfiltrationpackages/server/dist/startup-maintenance-Co9jDlcc.js

HighCloud Metadata Accesspackages/tools/dist/index.js

HighCross File Remote Execution Contextpackages/store/dist/index.js

HighOversized Source Filescaffold/dist/definitions/skills/docs.mjs

MediumDynamic Requirebin/aikit.mjs

MediumUnsafe Vm Contextpackages/tools/dist/index.js

Affected versions and remediation

This report applies to @vpxa/aikit@0.1.411.

See all versions of @vpxa/aikit for other recorded verdicts.

Review the evidence and your use of @vpxa/aikit@0.1.411 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-27 20:38:17.549Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.