Loading npm security reports…
autopilot-ai@1.24.1: Clean npm security report (Allow) | LPM Firewall
Allowed — no malicious behavior detected
No malicious behavior detected. 34 low-signal pattern(s) reviewed.
autopilot-ai@1.24.1 autopilot (formerly kimiflare): a terminal coding agent that runs any OpenRouter model with your own key. Per-turn billed cost, web search, GitHub, headless browser, LSP, MCP, local memory.
scanned 18d ago · by lpm-firewall-ai Source inspection supports a clean verdict: the manifest has no install-time hook, the flagged agent locations only load bounded context files, and telemetry has no package-selected default recipient. The scanner’s exfiltration and dependency findings are not supported as attacks by the inspected source.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The CLI or SDK is run; telemetry export additionally requires an endpoint to be configured.
Impact
No unconsented credential disclosure or agent configuration change was established.
Mechanism
The flagged agent context behavior reads local project context for prompts. Telemetry posts logs to the configured collector, while Requesty credentials go to Requesty-host endpoints.
AI rationale
Source inspection supports a clean verdict: the manifest has no install-time hook, the flagged agent locations only load bounded context files, and telemetry has no package-selected default recipient. The scanner’s exfiltration and dependency findings are not supported as attacks by the inspected source.
public snapshot AI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
package.json has only a prepublishOnly build hook; the executable entrypoint imports the bundled CLI. Both flagged agent integration locations load bounded local context files and add their contents to the agent prompt; they do not write agent configuration. OpenTelemetry export has no default endpoint and returns disabled unless the user configures one; any export goes to that configured endpoint. The Requesty API key is sent with requests to an HTTPS endpoint restricted to Requesty hosts. The flagged dependency paths are ordinary library code; the inspected archive analysis describes a small text fixture and no activated payload. Evidence against
The scanner alleges package-controlled runtime exfiltration, but inspected outbound telemetry requires a configured endpoint; no hidden package-selected collector was identified. The inbox feature sends a handle and secret to the package’s feedback service only after the user opens the inbox and supplies both values. 26 flagged 68 Source sends the broad process environment to a literal external destination.
L68: function defaultLogDir() {
L69: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L70: return join(xdg, "kimiflare", "logs");
...
L85: if (currentStream) {
L86: currentStream.end();
L87: currentStream = null;
...
L204: function setFetchForTesting(f) {
L205: fetchImpl = f ?? ((url, init) => fetch(url, init));
L206: }
...
L660: const raw = await readFile(configPath(), "utf8");
L661: persisted = JSON.parse(raw);
L662: hasFile = true;
Critical Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.js View on unpkg · L68 68 function defaultLogDir() {
L69: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L70: return join(xdg, "kimiflare", "logs");
...
L85: if (currentStream) {
L86: currentStream.end();
L87: currentStream = null;
...
L204: function setFetchForTesting(f) {
L205: fetchImpl = f ?? ((url, init) => fetch(url, init));
L206: }
...
L660: const raw = await readFile(configPath(), "utf8");
L661: persisted = JSON.parse(raw);
L662: hasFile = true;
Critical Dns Exfiltration
Source appears to send environment or credential material through DNS lookups.
dist/index.js View on unpkg · L68 5 Critical 15 High 7 Medium 7 Low
Critical Hardcoded Runtime Data Exfiltration dist/index.js
Critical Dns Exfiltration dist/index.js
Critical Remote Response Code Execution dist/index.js
Critical Trigger Reachable Dangerous Capability dist/index.js
Critical Previous Version Dangerous Delta node_modules/commander/lib/command.js
High Child Process dist/index.js
High Shell dist/index.js
High Eval node_modules/ajv/dist/compile/jtd/serialize.js
High Same File Env Network Execution dist/sdk/index.js
High Credential Redirect Persistence dist/index.js
High Command Output Exfiltration dist/sdk/index.js
High
Affected versions and remediation This report applies to autopilot-ai@1.24.1 .
See all versions of autopilot-ai for other recorded verdicts.
Review the evidence and your use of autopilot-ai@1.24.1 before allowing it. Restrict the permissions described in this report. Choose an independently verified alternative or release. This report does not establish that other versions are safe. Evidence last updated: 2026-10-18 11:19:18.252Z (UTC) .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced .
DynamicRequire
EnvironmentVars
Eval
Filesystem
NativeBindings
Network
Shell
Supply chain HighEntropyStrings UrlStrings
Manifest No manifest risk signals triggered.
scanned 4 file(s), 2.10 MB of source, external domains: 127.0.0.1, api.github.com, app.requesty.ai, docs.docker.com, duckduckgo.com, github.com, hello.kimiflare.com, html.duckduckgo.com, kimiflare.com, luals.github.io, openrouter.ai, registry.npmjs.org, router.eu.requesty.ai, router.requesty.ai, status.openrouter.ai, www.w3.org
68
function defaultLogDir() {
L69: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L70: return join(xdg, "kimiflare", "logs");
...
L85: if (currentStream) {
L86: currentStream.end();
L87: currentStream = null;
...
L204: function setFetchForTesting(f) {
L205: fetchImpl = f ?? ((url, init) => fetch(url, init));
L206: }
...
L660: const raw = await readFile(configPath(), "utf8");
L661: persisted = JSON.parse(raw);
L662: hasFile = true;
Critical Remote Response Code Execution
Source passes code obtained from a remote response into a dynamic execution sink.
dist/index.js View on unpkg · L68 • Trigger-reachable chain: manifest.exports -> dist/index.js
Reachable file contains a blocking source-risk pattern.
Critical Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.js View on unpkg 1131 // src/remote/deploy.ts
L1132: import { execSync } from "child_process";
L1133: import { join as join7, dirname as dirname4 } from "path";
7759 if (lower === "cmd") {
L7760: return { shell: process.env.COMSPEC || "cmd.exe", args: ["/c"], isPosix: false };
L7761: }
• Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
import { readFile, mkdir, writeFile, chmod } from "fs/promises";
const baseUrl = process.env.KIMIFLARE_BASE_URL ?? persisted.baseUrl;
const requesty = !!requestyApiKey && !openrouterApiKey && !baseUrl;
if (!openrouterApiKey && !baseUrl && !requestyApiKey) return null;
baseUrl,
await writeFile(p, JSON.stringify(next, null, 2), "utf8");
await writeFile(p, JSON.stringify(merged, null, 2), "utf8");
await writeFile(p, JSON.stringify(cfg, null, 2), "utf8");
High Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.js View on unpkg 68 function defaultLogDir() {
L69: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L70: return join(xdg, "kimiflare", "logs");
...
L85: if (currentStream) {
L86: currentStream.end();
L87: currentStream = null;
...
L204: function setFetchForTesting(f) {
L205: fetchImpl = f ?? ((url, init) => fetch(url, init));
L206: }
...
L660: const raw = await readFile(configPath(), "utf8");
L661: persisted = JSON.parse(raw);
L662: hasFile = true;
High Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/index.js View on unpkg · L68 665 const openrouterApiKey = process.env.OPENROUTER_API_KEY || process.env.KIMIFLARE_OPENROUTER_KEY || persisted.openrouterApiKey || persisted.providerKeys?.openrouter || void 0;
L666: const baseUrl = process.env.KIMIFLARE_BASE_URL ?? persisted.baseUrl;
L667: const apiKey = process.env.KIMIFLARE_API_KEY ?? persisted.apiKey;
...
L955: try {
L956: const pkg = JSON.parse(readFileSync(path, "utf8"));
L957: cachedVersion = pkg.version ?? "0.0.0";
...
L1131: // src/remote/deploy.ts
L1132: import { execSync } from "child_process";
L1133: import { join as join7, dirname as dirname4 } from "path";
...
L4667: - Treat blockers as problems to work through, not as a stopping point. After an error or failed attempt, diagnose the cause and try a safe, materially different recovery or verific...
L4668:
High Remote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
dist/index.js View on unpkg · L665 68 Cross-file remote execution chain: dist/index.js spawns dist/sdk/index.js; helper contains network access plus dynamic code execution.
L68: function defaultLogDir() {
L69: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L70: return join(xdg, "kimiflare", "logs");
...
L85: if (currentStream) {
L86: currentStream.end();
L87: currentStream = null;
...
L204: function setFetchForTesting(f) {
L205: fetchImpl = f ?? ((url, init) => fetch(url, init));
L206: }
...
L660: const raw = await readFile(configPath(), "utf8");
L661: persisted = JSON.parse(raw);
L662: hasFile = true;
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/index.js View on unpkg · L68 2995 async function rotateJsonl(path, maxBytes, rotations) {
L2996: const { rename: rename3 } = await import("fs/promises");
L2997: let s;
Medium Dynamic Require
Package source references dynamic require/import behavior.
dist/index.js View on unpkg · L2995 68 function defaultLogDir() {
L69: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L70: return join(xdg, "kimiflare", "logs");
...
L85: if (currentStream) {
L86: currentStream.end();
L87: currentStream = null;
...
L204: function setFetchForTesting(f) {
L205: fetchImpl = f ?? ((url, init) => fetch(url, init));
L206: }
...
L660: const raw = await readFile(configPath(), "utf8");
L661: persisted = JSON.parse(raw);
L662: hasFile = true;
Low Weak Crypto
Package source references weak cryptographic algorithms.
dist/index.js View on unpkg · L68 node_modules/ajv/dist/compile/jtd/serialize.js View file 49 sourceCode = `${gen.scopeRefs(names_1.default.scope)}return ${serializeFuncCode}`;
L50: const makeSerialize = new Function(`${names_1.default.scope}`, sourceCode);
L51: const serialize = makeSerialize(this.scope.get());
High Eval
Package source references dynamic code evaluation.
node_modules/ajv/dist/compile/jtd/serialize.js View on unpkg · L49 6553 const { command, env: coauthorEnv } = isPosix ? injectCoauthor(args.command, ctx.coauthor) : { command: args.command, env: {} };
L6554: return new Promise((resolve6, reject) => {
L6555: logger.debug("bash:spawn", { command: args.command.slice(0, 200), cwd: ctx.cwd, shell });
L6556: const child = spawn(shell, [...shellArgs, command], {
L6557: cwd: ctx.cwd,
L6558: env: {
L6559: ...process.env,
L6560: ...coauthorEnv,
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/sdk/index.js View on unpkg · L6553 6553 const { command, env: coauthorEnv } = isPosix ? injectCoauthor(args.command, ctx.coauthor) : { command: args.command, env: {} };
L6554: return new Promise((resolve6, reject) => {
L6555: logger.debug("bash:spawn", { command: args.command.slice(0, 200), cwd: ctx.cwd, shell });
L6556: const child = spawn(shell, [...shellArgs, command], {
L6557: cwd: ctx.cwd,
...
L6563: });
L6564: child.stdin?.end();
L6565: let stdout = "";
L6566: let stderr = "";
High Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/sdk/index.js View on unpkg · L6553 6553 Trigger-reachable command-output exfiltration chain: manifest.exports -> dist/sdk/index.js
L6553: const { command, env: coauthorEnv } = isPosix ? injectCoauthor(args.command, ctx.coauthor) : { command: args.command, env: {} };
L6554: return new Promise((resolve6, reject) => {
L6555: logger.debug("bash:spawn", { command: args.command.slice(0, 200), cwd: ctx.cwd, shell });
L6556: const child = spawn(shell, [...shellArgs, command], {
L6557: cwd: ctx.cwd,
...
L6563: });
L6564: child.stdin?.end();
L6565: let stdout = "";
L6566: let stderr = "";
High Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/sdk/index.js View on unpkg · L6553 node_modules/ip-address/dist/ipv6.js#virtual:normalized:round1 View file 156 * @example
L157: * var addressAndPort = Address6.fromURL("http://[ffff::]:8080/foo/");
L158: * addressAndPort.address.correctForm(); // "ffff::"
...
L186: }
L187: // If there"s a port convert it to an integer\n if (port) {\n port = parseInt(port, 10);\n // squelch out of range ports (valid ports are 0-65535)\n ...
L188: * Throws `AddressError` if the mask is non-contiguous (e.g.
...
L399: * on `this.parsedAddress`. Called automatically by the constructor; you
L400: * typically don"t need to call it directly. Throws `AddressError` if the\n * input is malformed.\n */\n // TODO: Make private?\n parse(address) {\n address = t...
L401: and Windows Server 2008 implementations, more bits are used. In those
...
L551: *
L552: * To get a Node
High Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
node_modules/ip-address/dist/ipv6.js#virtual:normalized:round1 View on unpkg · L156 node_modules/better-sqlite3/binding.gyp View file • path = node_modules/better-sqlite3/binding.gyp
kind = build_helper
sizeBytes = 942
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
node_modules/better-sqlite3/binding.gyp View on unpkg node_modules/tar-fs/test/fixtures/invalid.tar View file • path = node_modules/tar-fs/test/fixtures/invalid.tar
kind = payload_in_excluded_dir
sizeBytes = 2560
magicHex = [redacted]
High Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
node_modules/tar-fs/test/fixtures/invalid.tar View on unpkg • path = node_modules/tar-fs/test/fixtures/invalid.tar
kind = compressed_blob
sizeBytes = 2560
magicHex = [redacted]
Medium Ships Compressed Blob
Package ships compressed or archive-like blobs.
node_modules/tar-fs/test/fixtures/invalid.tar View on unpkg • path = node_modules/tar-fs/test/fixtures/invalid.tar
kind = nested_archive_needs_inspection
sizeBytes = 2560
magicHex = [redacted]
Low Nested Archive Needs Inspection
Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.
node_modules/tar-fs/test/fixtures/invalid.tar View on unpkg node_modules/typescript/lib/typescript.js View file • path = node_modules/typescript/lib/typescript.js
kind = oversized_source_file
sizeBytes = 9112572
magicHex = [redacted]
Medium Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
node_modules/typescript/lib/typescript.js View on unpkg dist/sdk/index.d.ts#virtual:normalized:round1 View file • stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 38
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/sdk/index.d.ts#virtual:normalized:round1 View on unpkg node_modules/qrcode/lib/renderer/svg.js View file • matchType = normalized_sha256
matchedPackage = @walkhi/code-relax@0.1.0-beta.1
matchedPath = node_modules/qrcode/lib/renderer/svg.js
matchedIdentity = npm:QHdhbGtoaS9jb2RlLXJlbGF4:0.1.0-beta.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
node_modules/qrcode/lib/renderer/svg.js View on unpkg node_modules/ajv-formats/dist/formats.js View file • matchType = normalized_sha256
matchedPackage = polyrouter@1.0.35
matchedPath = app/node_modules/ajv-formats/dist/formats.js
matchedIdentity = npm:cG9seXJvdXRlcg:1.0.35
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
node_modules/ajv-formats/dist/formats.js View on unpkg node_modules/commander/lib/command.js View file • matchType = previous_version_dangerous_delta
matchedPackage = autopilot-ai@1.23.0
matchedIdentity = npm:YXV0b3BpbG90LWFp:1.23.0
similarity = 0.600
summary = stored previous version shares package body but lacks this dangerous source file
Critical Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
node_modules/commander/lib/command.js View on unpkg Cloud Metadata Access
node_modules/ip-address/dist/ipv6.js#virtual:normalized:round1
High Obfuscated Payload Loader dist/index.js
High Remote Agent Bridge dist/index.js
High Cross File Remote Execution Context dist/index.js
High Trigger Reachable Command Output Exfiltration dist/sdk/index.js
High Payload In Excluded Dir node_modules/tar-fs/test/fixtures/invalid.tar
High Semantic Analysis Limited dist/sdk/index.d.ts#virtual:normalized:round1
High Known Malware Source Similarity node_modules/qrcode/lib/renderer/svg.js
High Known Malware Source Similarity node_modules/ajv-formats/dist/formats.js
Medium Dynamic Require dist/index.js
Medium Ships Build Helper node_modules/better-sqlite3/binding.gyp
Medium Ships Compressed Blob node_modules/tar-fs/test/fixtures/invalid.tar
Medium Oversized Source File node_modules/typescript/lib/typescript.js
Medium Structural Risk Force Deep Review
Low Non Install Lifecycle Scripts
Low Weak Crypto dist/index.js
Low Nested Archive Needs Inspection node_modules/tar-fs/test/fixtures/invalid.tar
exports map bin → autopilot
Artifact 71.4 MB · 9,169 files 2 signature(s) · provenance
Install lifecycle prepublishOnly
Behavioral surface ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem NativeBindings Network Shell HighEntropyStrings UrlStrings Manifest: clean