Loading npm security reports…
autopilot-ai@1.25.0: Credential exfiltration – flagged | LPM Firewall
Flagged — allowed with a warning
Allowed by default policy, but 30 finding(s) warrant review before installing.
autopilot-ai@1.25.0 autopilot (formerly kimiflare): a terminal coding agent that runs any OpenRouter model with your own key. Per-turn billed cost, web search, GitHub, headless browser, LSP, MCP, local memory.
scanned 18d ago · by lpm-firewall-ai This is conditional credential exposure: the key is sent to an unrestricted alternate URL only when OPENROUTER_BASE_URL is configured, while the shipped default is the intended OpenRouter API. No package-selected off-service recipient or install-time attack was found, so a warning is appropriate.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Set OPENROUTER_BASE_URL to another host and run a model, embedding, key-check, generation-lookup, or OAuth exchange operation.
Impact
The selected host can receive the credential or OAuth exchange data. No package-selected unrelated recipient was identified.
Mechanism
The package builds OpenRouter request URLs from OPENROUTER_BASE_URL and attaches the OpenRouter key or OAuth exchange data to requests.
AI rationale
This is conditional credential exposure: the key is sent to an unrestricted alternate URL only when OPENROUTER_BASE_URL is configured, while the shipped default is the intended OpenRouter API. No package-selected off-service recipient or install-time attack was found, so a warning is appropriate.
public snapshot AI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
The OpenRouter key can come from environment variables or persisted configuration, and OPENROUTER_BASE_URL can replace the default https://openrouter.ai/api/v1 endpoint. Chat requests send the key as a Bearer header to the computed URL; embedding and generation lookup requests use the same configurable base and key. User-entered key checks and OAuth code exchange also use the computed OpenRouter URL. package.json has no install lifecycle hook; prepublishOnly runs the build, and the autopilot binary imports the CLI entrypoint. The flagged agent integration reads bounded conventional project context files and adds them to the model prompt; it does not mutate agent configuration. Evidence against
The default API destination is OpenRouter; the alternate destination requires an explicit OPENROUTER_BASE_URL setting, and no package-selected unrelated recipient was found. The agent context-file behavior is ordinary prompt setup, not an install-time control-surface change. 22 flagged 68 Source sends the broad process environment to a literal external destination.
L68: function defaultLogDir() {
L69: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L70: return join(xdg, "kimiflare", "logs");
...
L85: if (currentStream) {
L86: currentStream.end();
L87: currentStream = null;
...
L204: function setFetchForTesting(f) {
L205: fetchImpl = f ?? ((url, init) => fetch(url, init));
L206: }
...
L660: const raw = await readFile(configPath(), "utf8");
L661: persisted = JSON.parse(raw);
L662: hasFile = true;
Critical Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.js View on unpkg · L68 68 function defaultLogDir() {
L69: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L70: return join(xdg, "kimiflare", "logs");
...
L85: if (currentStream) {
L86: currentStream.end();
L87: currentStream = null;
...
L204: function setFetchForTesting(f) {
L205: fetchImpl = f ?? ((url, init) => fetch(url, init));
L206: }
...
L660: const raw = await readFile(configPath(), "utf8");
L661: persisted = JSON.parse(raw);
L662: hasFile = true;
Critical Dns Exfiltration
Source appears to send environment or credential material through DNS lookups.
dist/index.js View on unpkg · L68 4 Critical 12 High 7 Medium 7 Low
Critical Hardcoded Runtime Data Exfiltration dist/index.js
Critical Dns Exfiltration dist/index.js
Critical Remote Response Code Execution dist/index.js
Critical Trigger Reachable Dangerous Capability dist/index.js
High Child Process dist/index.js
High Shell dist/index.js
High Eval node_modules/ajv/dist/compile/jtd/serialize.js
High Credential Redirect Persistence dist/index.js
High Cloud Metadata Access node_modules/ip-address/dist/ipv6.js#virtual:normalized:round1
High Obfuscated Payload Loader dist/index.js
High Remote Agent Bridge dist/index.js
High
Affected versions and remediation This report applies to autopilot-ai@1.25.0 .
See all versions of autopilot-ai for other recorded verdicts.
Review the evidence and your use of autopilot-ai@1.25.0 before allowing it. Restrict the permissions described in this report. Choose an independently verified alternative or release. This report does not establish that other versions are safe. Evidence last updated: 2026-10-18 13:50:23.750Z (UTC) .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced .
89% Suspicious
AI assessment confidence
Package metadata npm Maintainers sinameraji
Version 1.25.0
Latest on npm 3.10.1
Published Oct 18, 2026
License MIT
Dependencies 16
Integrity verified
Package size 14.2 MB
Files 9,169
Keywords autopilot kimiflare ai cli coding-agent terminal kimi k2.6
DynamicRequire
EnvironmentVars
Eval
Filesystem
NativeBindings
Network
Shell
Supply chain HighEntropyStrings UrlStrings
Manifest No manifest risk signals triggered.
scanned 4 file(s), 2.13 MB of source, external domains: 127.0.0.1, api.github.com, app.requesty.ai, docs.docker.com, duckduckgo.com, github.com, hello.kimiflare.com, html.duckduckgo.com, kimiflare.com, luals.github.io, openrouter.ai, registry.npmjs.org, router.eu.requesty.ai, router.requesty.ai, status.openrouter.ai, www.w3.org
68
function defaultLogDir() {
L69: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L70: return join(xdg, "kimiflare", "logs");
...
L85: if (currentStream) {
L86: currentStream.end();
L87: currentStream = null;
...
L204: function setFetchForTesting(f) {
L205: fetchImpl = f ?? ((url, init) => fetch(url, init));
L206: }
...
L660: const raw = await readFile(configPath(), "utf8");
L661: persisted = JSON.parse(raw);
L662: hasFile = true;
Critical Remote Response Code Execution
Source passes code obtained from a remote response into a dynamic execution sink.
dist/index.js View on unpkg · L68 • Trigger-reachable chain: manifest.exports -> dist/index.js
Reachable file contains a blocking source-risk pattern.
Critical Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.js View on unpkg 1131 // src/remote/deploy.ts
L1132: import { execSync } from "child_process";
L1133: import { join as join7, dirname as dirname4 } from "path";
7777 if (lower === "cmd") {
L7778: return { shell: process.env.COMSPEC || "cmd.exe", args: ["/c"], isPosix: false };
L7779: }
• Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
import { readFile, mkdir, writeFile, chmod } from "fs/promises";
const baseUrl = process.env.KIMIFLARE_BASE_URL ?? persisted.baseUrl;
const requesty = !!requestyApiKey && !openrouterApiKey && !baseUrl;
if (!openrouterApiKey && !baseUrl && !requestyApiKey) return null;
baseUrl,
await writeFile(p, JSON.stringify(next, null, 2), "utf8");
await writeFile(p, JSON.stringify(merged, null, 2), "utf8");
await writeFile(p, JSON.stringify(cfg, null, 2), "utf8");
High Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.js View on unpkg 68 function defaultLogDir() {
L69: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L70: return join(xdg, "kimiflare", "logs");
...
L85: if (currentStream) {
L86: currentStream.end();
L87: currentStream = null;
...
L204: function setFetchForTesting(f) {
L205: fetchImpl = f ?? ((url, init) => fetch(url, init));
L206: }
...
L660: const raw = await readFile(configPath(), "utf8");
L661: persisted = JSON.parse(raw);
L662: hasFile = true;
High Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/index.js View on unpkg · L68 665 const openrouterApiKey = process.env.OPENROUTER_API_KEY || process.env.KIMIFLARE_OPENROUTER_KEY || persisted.openrouterApiKey || persisted.providerKeys?.openrouter || void 0;
L666: const baseUrl = process.env.KIMIFLARE_BASE_URL ?? persisted.baseUrl;
L667: const apiKey = process.env.KIMIFLARE_API_KEY ?? persisted.apiKey;
...
L955: try {
L956: const pkg = JSON.parse(readFileSync(path, "utf8"));
L957: cachedVersion = pkg.version ?? "0.0.0";
...
L1131: // src/remote/deploy.ts
L1132: import { execSync } from "child_process";
L1133: import { join as join7, dirname as dirname4 } from "path";
...
L4668: - Treat blockers as problems to work through, not as a stopping point. After an error or failed attempt, diagnose the cause and try a safe, materially different recovery or verific...
L4669:
High Remote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
dist/index.js View on unpkg · L665 68 Cross-file remote execution chain: dist/index.js spawns dist/sdk/index.js; helper contains network access plus dynamic code execution.
L68: function defaultLogDir() {
L69: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L70: return join(xdg, "kimiflare", "logs");
...
L85: if (currentStream) {
L86: currentStream.end();
L87: currentStream = null;
...
L204: function setFetchForTesting(f) {
L205: fetchImpl = f ?? ((url, init) => fetch(url, init));
L206: }
...
L660: const raw = await readFile(configPath(), "utf8");
L661: persisted = JSON.parse(raw);
L662: hasFile = true;
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/index.js View on unpkg · L68 2996 async function rotateJsonl(path, maxBytes, rotations) {
L2997: const { rename: rename3 } = await import("fs/promises");
L2998: let s;
Medium Dynamic Require
Package source references dynamic require/import behavior.
dist/index.js View on unpkg · L2996 68 function defaultLogDir() {
L69: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L70: return join(xdg, "kimiflare", "logs");
...
L85: if (currentStream) {
L86: currentStream.end();
L87: currentStream = null;
...
L204: function setFetchForTesting(f) {
L205: fetchImpl = f ?? ((url, init) => fetch(url, init));
L206: }
...
L660: const raw = await readFile(configPath(), "utf8");
L661: persisted = JSON.parse(raw);
L662: hasFile = true;
Low Weak Crypto
Package source references weak cryptographic algorithms.
dist/index.js View on unpkg · L68 node_modules/ajv/dist/compile/jtd/serialize.js View file 49 sourceCode = `${gen.scopeRefs(names_1.default.scope)}return ${serializeFuncCode}`;
L50: const makeSerialize = new Function(`${names_1.default.scope}`, sourceCode);
L51: const serialize = makeSerialize(this.scope.get());
High Eval
Package source references dynamic code evaluation.
node_modules/ajv/dist/compile/jtd/serialize.js View on unpkg · L49 node_modules/ip-address/dist/ipv6.js#virtual:normalized:round1 View file 156 * @example
L157: * var addressAndPort = Address6.fromURL("http://[ffff::]:8080/foo/");
L158: * addressAndPort.address.correctForm(); // "ffff::"
...
L186: }
L187: // If there"s a port convert it to an integer\n if (port) {\n port = parseInt(port, 10);\n // squelch out of range ports (valid ports are 0-65535)\n ...
L188: * Throws `AddressError` if the mask is non-contiguous (e.g.
...
L399: * on `this.parsedAddress`. Called automatically by the constructor; you
L400: * typically don"t need to call it directly. Throws `AddressError` if the\n * input is malformed.\n */\n // TODO: Make private?\n parse(address) {\n address = t...
L401: and Windows Server 2008 implementations, more bits are used. In those
...
L551: *
L552: * To get a Node
High Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
node_modules/ip-address/dist/ipv6.js#virtual:normalized:round1 View on unpkg · L156 node_modules/better-sqlite3/binding.gyp View file • path = node_modules/better-sqlite3/binding.gyp
kind = build_helper
sizeBytes = 942
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
node_modules/better-sqlite3/binding.gyp View on unpkg node_modules/tar-fs/test/fixtures/invalid.tar View file • path = node_modules/tar-fs/test/fixtures/invalid.tar
kind = payload_in_excluded_dir
sizeBytes = 2560
magicHex = [redacted]
High Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
node_modules/tar-fs/test/fixtures/invalid.tar View on unpkg • path = node_modules/tar-fs/test/fixtures/invalid.tar
kind = compressed_blob
sizeBytes = 2560
magicHex = [redacted]
Medium Ships Compressed Blob
Package ships compressed or archive-like blobs.
node_modules/tar-fs/test/fixtures/invalid.tar View on unpkg • path = node_modules/tar-fs/test/fixtures/invalid.tar
kind = nested_archive_needs_inspection
sizeBytes = 2560
magicHex = [redacted]
Low Nested Archive Needs Inspection
Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.
node_modules/tar-fs/test/fixtures/invalid.tar View on unpkg node_modules/typescript/lib/typescript.js View file • path = node_modules/typescript/lib/typescript.js
kind = oversized_source_file
sizeBytes = 9112572
magicHex = [redacted]
Medium Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
node_modules/typescript/lib/typescript.js View on unpkg dist/sdk/index.d.ts#virtual:normalized:round1 View file • stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 38
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/sdk/index.d.ts#virtual:normalized:round1 View on unpkg node_modules/qrcode/lib/renderer/svg.js View file • matchType = normalized_sha256
matchedPackage = @walkhi/code-relax@0.1.0-beta.1
matchedPath = node_modules/qrcode/lib/renderer/svg.js
matchedIdentity = npm:QHdhbGtoaS9jb2RlLXJlbGF4:0.1.0-beta.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
node_modules/qrcode/lib/renderer/svg.js View on unpkg node_modules/ajv-formats/dist/formats.js View file • matchType = normalized_sha256
matchedPackage = polyrouter@1.0.35
matchedPath = app/node_modules/ajv-formats/dist/formats.js
matchedIdentity = npm:cG9seXJvdXRlcg:1.0.35
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
node_modules/ajv-formats/dist/formats.js View on unpkg Cross File Remote Execution Context
dist/index.js
High Payload In Excluded Dir node_modules/tar-fs/test/fixtures/invalid.tar
High Semantic Analysis Limited dist/sdk/index.d.ts#virtual:normalized:round1
High Known Malware Source Similarity node_modules/qrcode/lib/renderer/svg.js
High Known Malware Source Similarity node_modules/ajv-formats/dist/formats.js
Medium Dynamic Require dist/index.js
Medium Ships Build Helper node_modules/better-sqlite3/binding.gyp
Medium Ships Compressed Blob node_modules/tar-fs/test/fixtures/invalid.tar
Medium Oversized Source File node_modules/typescript/lib/typescript.js
Medium Structural Risk Force Deep Review
Low Non Install Lifecycle Scripts
Low Weak Crypto dist/index.js
Low Nested Archive Needs Inspection node_modules/tar-fs/test/fixtures/invalid.tar
Runtime surface package.json Entrypoints exports map bin → autopilot
Runtime node >=20
Artifact 71.5 MB · 9,169 files 2 signature(s) · provenance
Install lifecycle prepublishOnly
Behavioral surface ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem NativeBindings Network Shell HighEntropyStrings UrlStrings Manifest: clean