@vpxa/aikit@0.1.440: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@vpxa/aikit@0.1.440: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall-managed-launcher.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

packages/tools/dist/index.jsView file

1import{a as e,n as t,o as n,r,s as i,t as a}from"./import-resolver-BjraRSaz.js";import{access as o,mkdir as s,readFile as c,readdir as l,rename as u,stat as d,writeFile as f}from"n... L2: `)){if(!a)continue;if(a.startsWith(`## `)){i=a.slice(3).split(`...`)[0];continue}let e=a[0],o=a[1],s=a.slice(3).trim();e===`?`&&o===`?`?r.push(s):(e!==` `&&e!==`?`&&t.push({status:...

High

Child Process

Package source references child process execution.

packages/tools/dist/index.jsView on unpkg · L1

1import{a as e,n as t,o as n,r,s as i,t as a}from"./import-resolver-BjraRSaz.js";import{access as o,mkdir as s,readFile as c,readdir as l,rename as u,stat as d,writeFile as f}from"n... L2: `)){if(!a)continue;if(a.startsWith(`## `)){i=a.slice(3).split(`...`)[0];continue}let e=a[0],o=a[1],s=a.slice(3).trim();e===`?`&&o===`?`?r.push(s):(e!==` `&&e!==`?`&&t.push({status:... L3: `).trim()||t.message||`Command failed`}async function st(e={}){if(at>=2)throw Error(`Too many concurrent check runs (${at}/2). Retry when one finishes or use targeted check({ files... L4: `).length-1,a=t.slice(r).match(/export\s+(?:async\s+)?(\w+)/);l.push({name:n[1],path:e.record.sourcePath,line:e.record.startLine+i,kind:a?.[1]??`unknown`})}}let f=new Map;for(let e... L5: `)){let e=t.match(/^\s*-\s+['"]?([^'"#\s]+)[

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

packages/tools/dist/index.jsView on unpkg · L1

1import{a as e,n as t,o as n,r,s as i,t as a}from"./import-resolver-BjraRSaz.js";import{access as o,mkdir as s,readFile as c,readdir as l,rename as u,stat as d,writeFile as f}from"n... L2: `)){if(!a)continue;if(a.startsWith(`## `)){i=a.slice(3).split(`...`)[0];continue}let e=a[0],o=a[1],s=a.slice(3).trim();e===`?`&&o===`?`?r.push(s):(e!==` `&&e!==`?`&&t.push({status:... L3: `).trim()||t.message||`Command failed`}async function st(e={}){if(at>=2)throw Error(`Too many concurrent check runs (${at}/2). Retry when one finishes or use targeted check({ files... L4: `).length-1,a=t.slice(r).match(/export\s+(?:async\s+)?(\w+)/);l.push({name:n[1],path:e.record.sourcePath,line:e.record.startLine+i,kind:a?.[1]??`unknown`})}}let f=new Map;for(let e... L5: `)){let e=t.match(/^\s*-\s+['"]?([^'"#\s]+)[

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

packages/tools/dist/index.jsView on unpkg · L1

1import{a as e,n as t,o as n,r,s as i,t as a}from"./import-resolver-BjraRSaz.js";import{access as o,mkdir as s,readFile as c,readdir as l,rename as u,stat as d,writeFile as f}from"n... L2: `)){if(!a)continue;if(a.startsWith(`## `)){i=a.slice(3).split(`...`)[0];continue}let e=a[0],o=a[1],s=a.slice(3).trim();e===`?`&&o===`?`?r.push(s):(e!==` `&&e!==`?`&&t.push({status:... L3: `).trim()||t.message||`Command failed`}async function st(e={}){if(at>=2)throw Error(`Too many concurrent check runs (${at}/2). Retry when one finishes or use targeted check({ files... L4: `).length-1,a=t.slice(r).match(/export\s+(?:async\s+)?(\w+)/);l.push({name:n[1],path:e.record.sourcePath,line:e.record.startLine+i,kind:a?.[1]??`unknown`})}}let f=new Map;for(let e... L5: `)){let e=t.match(/^\s*-\s+['"]?([^'"#\s]+)[

Low

Weak Crypto

Package source references weak cryptographic algorithms.

packages/tools/dist/index.jsView on unpkg · L1

scaffold/dist/definitions/bodies.mjsView file

519- [ ] **SSRF protection**: URLs validated against allowlist, no open redirects, internal IPs blocked L520: - [ ] **eval/Function prevention**: No dynamic code execution from user input (\`eval()\`, \`new Function()\`, \`vm.runInNewContext()\`) L521: - [ ] **Path traversal**: File paths sanitized, no \`..\` sequences reaching outside allowed directories

Low

Eval

Package source references a known benign dynamic code generation pattern.

scaffold/dist/definitions/bodies.mjsView on unpkg · L519

bin/aikit.mjsView file

53L54: await import(pathToFileURL(serverPath).href); L55: } else {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/aikit.mjsView on unpkg · L53

packages/server/dist/proxy.jsView file

1L2: import{n as e}from"./auth-WyW7VMsN.js";import{fileURLToPath as t}from"node:url";import{spawn as n}from"node:child_process";import{homedir as r}from"node:os";import{createInterface ... L3: `);for(let e of n.split(` L4: `))e.startsWith(`data: `)?t.push(e.slice(6)):e.startsWith(`data:`)&&t.push(e.slice(5));return t}const o={input:process.stdin,output:process.stdout,error:process.stderr,fetchImpl:gl... L5: `);let v=n.readTokenImpl();if(!v){n.error.write(`[aikit-proxy] No token found at ~/.aikit/token ... L11: L12: `))if(t.trim())for(let e of a(t))S(n.output,e)}else S(n.output,i)}catch(t){S(n.output,h(e,t))}}async function c(e,t=globalThis.fetch){try{return(await t(`${e}/health`,{method:`GET`... L13: `)?t:`${t}\n`)}function h(e,t){let n=null;try{n=JSON.parse(e).id??null}catch{n=null}r

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

packages/server/dist/proxy.jsView on unpkg · L1

packages/browser/dist/index.jsView file

1import{exec as e,execFileSync as t,execSync as n,spawn as r}from"node:child_process";import{appendFileSync as i,closeSync as a,copyFileSync as o,existsSync as s,mkdirSync as c,open... L2: `)}return JSON.stringify(t,null,2)}catch{return e}}function xe(e,t=0,n=[]){let r=` `.repeat(t),i=typeof e.role==`string`?e.role.toUpperCase():``,a=typeof e.ref==`string`?e.ref:``,... L3: const text = await r.text();

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

packages/browser/dist/index.jsView on unpkg · L1

packages/chunker/wasm/tree-sitter-go.wasmView file

•path = packages/chunker/wasm/tree-sitter-go.wasm kind = wasm_module sizeBytes = 235957 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

packages/chunker/wasm/tree-sitter-go.wasmView on unpkg

scaffold/dist/definitions/skills/docs.mjsView file

•path = [redacted].mjs kind = oversized_source_file sizeBytes = 2785692 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

scaffold/dist/definitions/skills/docs.mjsView on unpkg

packages/server/dist/server-BAoNHD_m.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @vpxa/aikit@0.1.437 matchedIdentity = npm:QHZweGEvYWlraXQ:0.1.437 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

packages/server/dist/server-BAoNHD_m.jsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 112-152json

112 "playwright-core": "^1.x"

113 },

114 "devDependencies": {

115 "@biomejs/biome": "^2.x",

116 "@types/better-sqlite3": "^7.x",

117 "@types/express": "^5.x",

118 "@types/node": "^24.x",

119 "rimraf": "^6.x",

120 "tsdown": "^0.x",

121 "turbo": "^2.x",

122 "typescript": "^6.x",

123 "vite": "^8.x",

124 "vite-plugin-singlefile": "^2.x",

125 "vitest": "^4.x",

126 "ws": "^8.x"

127 },

128 "engines": {

129 "node": ">=18"

130 },

131 "scripts": {

132 "postinstall": "node ./bin/postinstall-managed-launcher.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L132

133 "setup-hooks": "node scripts/setup-hooks.mjs",

134 "build": "node scripts/build.mjs && node packages/claude-desktop/scripts/build-mcpb.mjs",

135 "typecheck": "tsc -b tsconfig.build.json --emitDeclarationOnly",

136 "clean": "turbo run clean && rimraf --glob node_modules \"packages/*/node_modules\"",

137 "lint": "biome check .",

138 "lint:fix": "biome check --write . --unsafe",

139 "format": "biome format --write .",

140 "start": "node packages/server/dist/bin.js",

141 "start:http": "node packages/server/dist/bin.js --transport http",

142 "prompt-analysis": "pnpm --dir ./scripts/tools/prompt-analysis build && node ./scripts/tools/prompt-analysis/run.mjs",

143 "dogfood": "node scripts/dogfood-evaluate.mjs",

144 "memory:evaluate": "node scripts/memory-evaluate.mjs",

145 "memory:dogfood": "node scripts/dogfood-evaluate.mjs --focus memory",

146 "test": "vitest run",

147 "test:contract": "vitest run packages/server/src/__tests__/tool-catalog-contract.test.ts",

148 "check:scaffold-contracts": "node .tmp/check-remember.mjs",

149 "test:dogfood": "vitest run packages/server/src/dogfood/__tests__/evaluation.test.ts",

150 "test:memory": "vitest run packages/server/src/memory/__tests__/evaluation.test.ts packages/server/src/__tests__/memory-explain.tool.test.ts",

151 "verify-publish": "node scripts/verify-publish.mjs",

152 "release": "node scripts/release.mjs",

packages/tools/dist/index.jsView file

Lines 1-21javascript

1import{a as e,n as t,o as n,r,s as i,t as a}from"./import-resolver-BjraRSaz.js";import{access as o,mkdir as s,readFile as c,readdir as l,rename as u,stat as

scaffold/dist/definitions/bodies.mjsView file

Lines 499-539javascript

4994. **Dependency Audit** — Check for known CVEs in dependencies

5005. **Secret Detection** — Scan for hardcoded credentials, API keys, tokens

5016. **Auth/AuthZ Review** — verify access control, session management

bin/aikit.mjsView file

Lines 33-59javascript

33} else {

34 // Fallback to bundled path

35 cliPath = resolve(__dirname, '..', 'packages', 'cli', 'dist', 'index.js');

36 serverPath = resolve

packages/server/dist/proxy.jsView file

Lines 1-13javascript

1

2import{n as e}from"./auth-WyW7VMsN.js";import{fileURLToPath as t}from"node:url";import{spawn as n}from"node:child_process";import{homedir as r}from"node:os"

packages/browser/dist/index.jsView file

Lines 1-11javascript

1import{exec as e,execFileSync as t,execSync as n,spawn as r}from"node:child_process";import{appendFileSync as i,closeSync as a,copyFileSync as o,existsSync as s,mkdirSync as c,openSync as l,readFileSync as

packages/chunker/wasm/tree-sitter-go.wasmView file

•path = packages/chunker/wasm/tree-sitter-go.wasm kind = wasm_module sizeBytes = 235957 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

packages/chunker/wasm/tree-sitter-go.wasmView on unpkg

scaffold/dist/definitions/skills/docs.mjsView file

•path = [redacted].mjs kind = oversized_source_file sizeBytes = 2785692 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

scaffold/dist/definitions/skills/docs.mjsView on unpkg

packages/server/dist/server-BAoNHD_m.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @vpxa/aikit@0.1.437 matchedIdentity = npm:QHZweGEvYWlraXQ:0.1.437 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

packages/server/dist/server-BAoNHD_m.jsView on unpkg