Loading npm security reports…
autopilot-ai@1.24.2: Clean npm security report (Allow) | LPM Firewall
Allowed — no malicious behavior detected
No malicious behavior detected. 33 low-signal pattern(s) reviewed.
autopilot-ai@1.24.2 autopilot (formerly kimiflare): a terminal coding agent that runs any OpenRouter model with your own key. Per-turn billed cost, web search, GitHub, headless browser, LSP, MCP, local memory.
scanned 18d ago · by lpm-firewall-ai The manifest has no install-time hook, and the reported bundle behavior resolves to an interactive inbox, configured telemetry, and opt-in local tracing. The dependency matches are routine library functions and the archive is test fixture data; no concrete attack behavior remains.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
The inbox and voice-note features require explicit commands; telemetry requires a configured endpoint.
Impact
No unauthorized credential disclosure, agent setting change, or harmful effect was established.
Mechanism
The inbox uses values entered for that feature, provider credentials use the provider client, and enabled traces are stored locally with redaction.
AI rationale
The manifest has no install-time hook, and the reported bundle behavior resolves to an interactive inbox, configured telemetry, and opt-in local tracing. The dependency matches are routine library functions and the archive is test fixture data; no concrete attack behavior remains.
public snapshot AI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
package.json exposes the CLI and SDK and defines prepublishOnly as a build step; bin/autopilot.mjs imports the main bundle. The flagged agent locations load bounded context files from the working directory; they do not write agent configuration. The inbox is an explicit command with a form for inbox-specific details; provider keys use the OpenRouter client, and the inbox sends user-entered values to hello.kimiflare.com. The OpenTelemetry sender uses a configured endpoint and installs its exit hook only when initialization succeeds. Trace recording requires an enabled setting, writes to a local trace directory, and redacts event payloads and saved blobs. The flagged dependency code performs serializer generation, address and format handling, and QR rendering; offline analysis identifies the archive as a test fixture with a short text member. Evidence against
The hello.kimiflare.com requests are tied to explicit voice-note or inbox workflows, not silent credential collection. Trace events can contain message data, but runtime recording is disabled by default and stores redacted records locally when enabled. 25 flagged 68 Source sends the broad process environment to a literal external destination.
L68: function defaultLogDir() {
L69: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L70: return join(xdg, "kimiflare", "logs");
...
L85: if (currentStream) {
L86: currentStream.end();
L87: currentStream = null;
...
L204: function setFetchForTesting(f) {
L205: fetchImpl = f ?? ((url, init) => fetch(url, init));
L206: }
...
L660: const raw = await readFile(configPath(), "utf8");
L661: persisted = JSON.parse(raw);
L662: hasFile = true;
Critical Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.js View on unpkg · L68 68 function defaultLogDir() {
L69: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L70: return join(xdg, "kimiflare", "logs");
...
L85: if (currentStream) {
L86: currentStream.end();
L87: currentStream = null;
...
L204: function setFetchForTesting(f) {
L205: fetchImpl = f ?? ((url, init) => fetch(url, init));
L206: }
...
L660: const raw = await readFile(configPath(), "utf8");
L661: persisted = JSON.parse(raw);
L662: hasFile = true;
Critical Dns Exfiltration
Source appears to send environment or credential material through DNS lookups.
dist/index.js View on unpkg · L68 4 Critical 15 High 7 Medium 7 Low
Critical Hardcoded Runtime Data Exfiltration dist/index.js
Critical Dns Exfiltration dist/index.js
Critical Remote Response Code Execution dist/index.js
Critical Trigger Reachable Dangerous Capability dist/index.js
High Child Process dist/index.js
High Shell dist/index.js
High Eval node_modules/ajv/dist/compile/jtd/serialize.js
High Same File Env Network Execution dist/sdk/index.js
High Credential Redirect Persistence dist/index.js
High Command Output Exfiltration dist/sdk/index.js
High Cloud Metadata Access node_modules/ip-address/dist/ipv6.js#virtual:normalized:round1
Affected versions and remediation This report applies to autopilot-ai@1.24.2 .
See all versions of autopilot-ai for other recorded verdicts.
Review the evidence and your use of autopilot-ai@1.24.2 before allowing it. Restrict the permissions described in this report. Choose an independently verified alternative or release. This report does not establish that other versions are safe. Evidence last updated: 2026-10-18 13:20:06.578Z (UTC) .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced .
The Ajv dynamic function constructs a serializer from generated code; the archive analysis describes test data rather than an activated payload. Behavioral surface
Source ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem NativeBindings Network Shell
Supply chain HighEntropyStrings UrlStrings
Manifest No manifest risk signals triggered.
scanned 4 file(s), 2.10 MB of source, external domains: 127.0.0.1, api.github.com, app.requesty.ai, docs.docker.com, duckduckgo.com, github.com, hello.kimiflare.com, html.duckduckgo.com, kimiflare.com, luals.github.io, openrouter.ai, registry.npmjs.org, router.eu.requesty.ai, router.requesty.ai, status.openrouter.ai, www.w3.org
68
function defaultLogDir() {
L69: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L70: return join(xdg, "kimiflare", "logs");
...
L85: if (currentStream) {
L86: currentStream.end();
L87: currentStream = null;
...
L204: function setFetchForTesting(f) {
L205: fetchImpl = f ?? ((url, init) => fetch(url, init));
L206: }
...
L660: const raw = await readFile(configPath(), "utf8");
L661: persisted = JSON.parse(raw);
L662: hasFile = true;
Critical Remote Response Code Execution
Source passes code obtained from a remote response into a dynamic execution sink.
dist/index.js View on unpkg · L68 • Trigger-reachable chain: manifest.exports -> dist/index.js
Reachable file contains a blocking source-risk pattern.
Critical Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.js View on unpkg 1131 // src/remote/deploy.ts
L1132: import { execSync } from "child_process";
L1133: import { join as join7, dirname as dirname4 } from "path";
7759 if (lower === "cmd") {
L7760: return { shell: process.env.COMSPEC || "cmd.exe", args: ["/c"], isPosix: false };
L7761: }
• Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
import { readFile, mkdir, writeFile, chmod } from "fs/promises";
const baseUrl = process.env.KIMIFLARE_BASE_URL ?? persisted.baseUrl;
const requesty = !!requestyApiKey && !openrouterApiKey && !baseUrl;
if (!openrouterApiKey && !baseUrl && !requestyApiKey) return null;
baseUrl,
await writeFile(p, JSON.stringify(next, null, 2), "utf8");
await writeFile(p, JSON.stringify(merged, null, 2), "utf8");
await writeFile(p, JSON.stringify(cfg, null, 2), "utf8");
High Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.js View on unpkg 68 function defaultLogDir() {
L69: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L70: return join(xdg, "kimiflare", "logs");
...
L85: if (currentStream) {
L86: currentStream.end();
L87: currentStream = null;
...
L204: function setFetchForTesting(f) {
L205: fetchImpl = f ?? ((url, init) => fetch(url, init));
L206: }
...
L660: const raw = await readFile(configPath(), "utf8");
L661: persisted = JSON.parse(raw);
L662: hasFile = true;
High Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/index.js View on unpkg · L68 665 const openrouterApiKey = process.env.OPENROUTER_API_KEY || process.env.KIMIFLARE_OPENROUTER_KEY || persisted.openrouterApiKey || persisted.providerKeys?.openrouter || void 0;
L666: const baseUrl = process.env.KIMIFLARE_BASE_URL ?? persisted.baseUrl;
L667: const apiKey = process.env.KIMIFLARE_API_KEY ?? persisted.apiKey;
...
L955: try {
L956: const pkg = JSON.parse(readFileSync(path, "utf8"));
L957: cachedVersion = pkg.version ?? "0.0.0";
...
L1131: // src/remote/deploy.ts
L1132: import { execSync } from "child_process";
L1133: import { join as join7, dirname as dirname4 } from "path";
...
L4667: - Treat blockers as problems to work through, not as a stopping point. After an error or failed attempt, diagnose the cause and try a safe, materially different recovery or verific...
L4668:
High Remote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
dist/index.js View on unpkg · L665 68 Cross-file remote execution chain: dist/index.js spawns dist/sdk/index.js; helper contains network access plus dynamic code execution.
L68: function defaultLogDir() {
L69: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L70: return join(xdg, "kimiflare", "logs");
...
L85: if (currentStream) {
L86: currentStream.end();
L87: currentStream = null;
...
L204: function setFetchForTesting(f) {
L205: fetchImpl = f ?? ((url, init) => fetch(url, init));
L206: }
...
L660: const raw = await readFile(configPath(), "utf8");
L661: persisted = JSON.parse(raw);
L662: hasFile = true;
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/index.js View on unpkg · L68 2995 async function rotateJsonl(path, maxBytes, rotations) {
L2996: const { rename: rename3 } = await import("fs/promises");
L2997: let s;
Medium Dynamic Require
Package source references dynamic require/import behavior.
dist/index.js View on unpkg · L2995 68 function defaultLogDir() {
L69: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L70: return join(xdg, "kimiflare", "logs");
...
L85: if (currentStream) {
L86: currentStream.end();
L87: currentStream = null;
...
L204: function setFetchForTesting(f) {
L205: fetchImpl = f ?? ((url, init) => fetch(url, init));
L206: }
...
L660: const raw = await readFile(configPath(), "utf8");
L661: persisted = JSON.parse(raw);
L662: hasFile = true;
Low Weak Crypto
Package source references weak cryptographic algorithms.
dist/index.js View on unpkg · L68 node_modules/ajv/dist/compile/jtd/serialize.js View file 49 sourceCode = `${gen.scopeRefs(names_1.default.scope)}return ${serializeFuncCode}`;
L50: const makeSerialize = new Function(`${names_1.default.scope}`, sourceCode);
L51: const serialize = makeSerialize(this.scope.get());
High Eval
Package source references dynamic code evaluation.
node_modules/ajv/dist/compile/jtd/serialize.js View on unpkg · L49 6553 const { command, env: coauthorEnv } = isPosix ? injectCoauthor(args.command, ctx.coauthor) : { command: args.command, env: {} };
L6554: return new Promise((resolve6, reject) => {
L6555: logger.debug("bash:spawn", { command: args.command.slice(0, 200), cwd: ctx.cwd, shell });
L6556: const child = spawn(shell, [...shellArgs, command], {
L6557: cwd: ctx.cwd,
L6558: env: {
L6559: ...process.env,
L6560: ...coauthorEnv,
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/sdk/index.js View on unpkg · L6553 6553 const { command, env: coauthorEnv } = isPosix ? injectCoauthor(args.command, ctx.coauthor) : { command: args.command, env: {} };
L6554: return new Promise((resolve6, reject) => {
L6555: logger.debug("bash:spawn", { command: args.command.slice(0, 200), cwd: ctx.cwd, shell });
L6556: const child = spawn(shell, [...shellArgs, command], {
L6557: cwd: ctx.cwd,
...
L6563: });
L6564: child.stdin?.end();
L6565: let stdout = "";
L6566: let stderr = "";
High Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/sdk/index.js View on unpkg · L6553 6553 Trigger-reachable command-output exfiltration chain: manifest.exports -> dist/sdk/index.js
L6553: const { command, env: coauthorEnv } = isPosix ? injectCoauthor(args.command, ctx.coauthor) : { command: args.command, env: {} };
L6554: return new Promise((resolve6, reject) => {
L6555: logger.debug("bash:spawn", { command: args.command.slice(0, 200), cwd: ctx.cwd, shell });
L6556: const child = spawn(shell, [...shellArgs, command], {
L6557: cwd: ctx.cwd,
...
L6563: });
L6564: child.stdin?.end();
L6565: let stdout = "";
L6566: let stderr = "";
High Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
dist/sdk/index.js View on unpkg · L6553 node_modules/ip-address/dist/ipv6.js#virtual:normalized:round1 View file 156 * @example
L157: * var addressAndPort = Address6.fromURL("http://[ffff::]:8080/foo/");
L158: * addressAndPort.address.correctForm(); // "ffff::"
...
L186: }
L187: // If there"s a port convert it to an integer\n if (port) {\n port = parseInt(port, 10);\n // squelch out of range ports (valid ports are 0-65535)\n ...
L188: * Throws `AddressError` if the mask is non-contiguous (e.g.
...
L399: * on `this.parsedAddress`. Called automatically by the constructor; you
L400: * typically don"t need to call it directly. Throws `AddressError` if the\n * input is malformed.\n */\n // TODO: Make private?\n parse(address) {\n address = t...
L401: and Windows Server 2008 implementations, more bits are used. In those
...
L551: *
L552: * To get a Node
High Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
node_modules/ip-address/dist/ipv6.js#virtual:normalized:round1 View on unpkg · L156 node_modules/better-sqlite3/binding.gyp View file • path = node_modules/better-sqlite3/binding.gyp
kind = build_helper
sizeBytes = 942
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
node_modules/better-sqlite3/binding.gyp View on unpkg node_modules/tar-fs/test/fixtures/invalid.tar View file • path = node_modules/tar-fs/test/fixtures/invalid.tar
kind = payload_in_excluded_dir
sizeBytes = 2560
magicHex = [redacted]
High Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
node_modules/tar-fs/test/fixtures/invalid.tar View on unpkg • path = node_modules/tar-fs/test/fixtures/invalid.tar
kind = compressed_blob
sizeBytes = 2560
magicHex = [redacted]
Medium Ships Compressed Blob
Package ships compressed or archive-like blobs.
node_modules/tar-fs/test/fixtures/invalid.tar View on unpkg • path = node_modules/tar-fs/test/fixtures/invalid.tar
kind = nested_archive_needs_inspection
sizeBytes = 2560
magicHex = [redacted]
Low Nested Archive Needs Inspection
Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.
node_modules/tar-fs/test/fixtures/invalid.tar View on unpkg node_modules/typescript/lib/typescript.js View file • path = node_modules/typescript/lib/typescript.js
kind = oversized_source_file
sizeBytes = 9112572
magicHex = [redacted]
Medium Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
node_modules/typescript/lib/typescript.js View on unpkg dist/sdk/index.d.ts#virtual:normalized:round1 View file • stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 38
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/sdk/index.d.ts#virtual:normalized:round1 View on unpkg node_modules/qrcode/lib/renderer/svg.js View file • matchType = normalized_sha256
matchedPackage = @walkhi/code-relax@0.1.0-beta.1
matchedPath = node_modules/qrcode/lib/renderer/svg.js
matchedIdentity = npm:QHdhbGtoaS9jb2RlLXJlbGF4:0.1.0-beta.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
node_modules/qrcode/lib/renderer/svg.js View on unpkg node_modules/ajv-formats/dist/formats.js View file • matchType = normalized_sha256
matchedPackage = polyrouter@1.0.35
matchedPath = app/node_modules/ajv-formats/dist/formats.js
matchedIdentity = npm:cG9seXJvdXRlcg:1.0.35
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
node_modules/ajv-formats/dist/formats.js View on unpkg High
Obfuscated Payload Loader
dist/index.js
High Remote Agent Bridge dist/index.js
High Cross File Remote Execution Context dist/index.js
High Trigger Reachable Command Output Exfiltration dist/sdk/index.js
High Payload In Excluded Dir node_modules/tar-fs/test/fixtures/invalid.tar
High Semantic Analysis Limited dist/sdk/index.d.ts#virtual:normalized:round1
High Known Malware Source Similarity node_modules/qrcode/lib/renderer/svg.js
High Known Malware Source Similarity node_modules/ajv-formats/dist/formats.js
Medium Dynamic Require dist/index.js
Medium Ships Build Helper node_modules/better-sqlite3/binding.gyp
Medium Ships Compressed Blob node_modules/tar-fs/test/fixtures/invalid.tar
Medium Oversized Source File node_modules/typescript/lib/typescript.js
Medium Structural Risk Force Deep Review
Low Non Install Lifecycle Scripts
Low Weak Crypto dist/index.js
Low Nested Archive Needs Inspection node_modules/tar-fs/test/fixtures/invalid.tar
exports map bin → autopilot
Artifact 71.4 MB · 9,169 files 2 signature(s) · provenance
Install lifecycle prepublishOnly
Behavioral surface ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem NativeBindings Network Shell HighEntropyStrings UrlStrings Manifest: clean