Loading npm security reports…
autopilot-ai@1.25.1: Clean npm security report (Allow) | LPM Firewall
Allowed — no malicious behavior detected
No malicious behavior detected. 31 low-signal pattern(s) reviewed.
autopilot-ai@1.25.1 autopilot (formerly kimiflare): a terminal coding agent that runs any OpenRouter model with your own key. Per-turn billed cost, web search, GitHub, headless browser, LSP, MCP, local memory.
scanned 17d ago · by lpm-firewall-ai Source inspection found no malicious behavior. The flagged network path is a user-invoked inbox feature using details entered in its form, while the other highlighted files implement ordinary library functions or contain inert fixture data.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The user starts the CLI; the inbox request requires selecting that feature and submitting its form.
Impact
No confirmed attack surface; the inbox details are sent for the requested inbox operation.
Mechanism
The inbox form sends the entered handle and secret to hello.kimiflare.com to check for messages. No automatic transfer of stored service credentials or project records was found in the inspected paths.
AI rationale
Source inspection found no malicious behavior. The flagged network path is a user-invoked inbox feature using details entered in its form, while the other highlighted files implement ordinary library functions or contain inert fixture data.
Evidence
dist/index.js dist/sdk/index.js
public snapshot AI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
package.json exposes a CLI and has only a prepublishOnly build hook; bin/autopilot.mjs imports the CLI bundle. The inbox request follows a user-selected menu action and required form input; it sends those entered details to the inbox service to retrieve messages. The coding-agent bundles read one named project guidance file of at most 20 KiB and add it to the system prompt; the SDK exposes session creation as an API. Flagged bundled files implement QR rendering, schema serialization, date and URI validation, and IPv6 parsing; the serializer generates code from schemas. The inspected archive analysis found a small text fixture and reports that its non-regular member was not followed or activated. Behavioral surface
Source ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem Network Shell
Supply chain HighEntropyStrings
23 flagged 41 Source sends the broad process environment to a literal external destination.
L41: function defaultLogDir() {
L42: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L43: return join(xdg, "kimiflare", "logs");
...
L58: if (currentStream) {
L59: currentStream.end();
L60: currentStream = null;
...
L177: function setFetchForTesting(f) {
L178: fetchImpl = f ?? ((url, init) => fetch(url, init));
L179: }
...
L633: const raw = await readFile(configPath(), "utf8");
L634: persisted = JSON.parse(raw);
L635: hasFile = true;
Critical Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.js View on unpkg · L41 41 function defaultLogDir() {
L42: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L43: return join(xdg, "kimiflare", "logs");
...
L58: if (currentStream) {
L59: currentStream.end();
L60: currentStream = null;
...
L177: function setFetchForTesting(f) {
L178: fetchImpl = f ?? ((url, init) => fetch(url, init));
L179: }
...
L633: const raw = await readFile(configPath(), "utf8");
L634: persisted = JSON.parse(raw);
L635: hasFile = true;
Critical Dns Exfiltration
Source appears to send environment or credential material through DNS lookups.
dist/index.js View on unpkg · L41 5 Critical 12 High 7 Medium 7 Low
Critical Hardcoded Runtime Data Exfiltration dist/index.js
Critical Dns Exfiltration dist/index.js
Critical Remote Response Code Execution dist/index.js
Critical Trigger Reachable Dangerous Capability dist/index.js
Critical Previous Version Dangerous Delta dist/index.js
High Child Process dist/index.js
High Shell dist/index.js
High Eval node_modules/ajv/dist/compile/jtd/serialize.js
High Credential Redirect Persistence dist/index.js
High Cloud Metadata Access node_modules/ip-address/dist/ipv6.js#virtual:normalized:round1
High Obfuscated Payload Loader dist/index.js
High
Affected versions and remediation This report applies to autopilot-ai@1.25.1 .
See all versions of autopilot-ai for other recorded verdicts.
Review the evidence and your use of autopilot-ai@1.25.1 before allowing it. Restrict the permissions described in this report. Choose an independently verified alternative or release. This report does not establish that other versions are safe. Evidence last updated: 2026-10-19 08:24:52.146Z (UTC) .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced .
UrlStrings
Manifest No manifest risk signals triggered.
scanned 4 file(s), 2.12 MB of source, external domains: 127.0.0.1, api.github.com, app.requesty.ai, docs.docker.com, duckduckgo.com, github.com, hello.kimiflare.com, html.duckduckgo.com, kimiflare.com, luals.github.io, openrouter.ai, registry.npmjs.org, router.eu.requesty.ai, router.requesty.ai, status.openrouter.ai, www.w3.org
41
function defaultLogDir() {
L42: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L43: return join(xdg, "kimiflare", "logs");
...
L58: if (currentStream) {
L59: currentStream.end();
L60: currentStream = null;
...
L177: function setFetchForTesting(f) {
L178: fetchImpl = f ?? ((url, init) => fetch(url, init));
L179: }
...
L633: const raw = await readFile(configPath(), "utf8");
L634: persisted = JSON.parse(raw);
L635: hasFile = true;
Critical Remote Response Code Execution
Source passes code obtained from a remote response into a dynamic execution sink.
dist/index.js View on unpkg · L41 • Trigger-reachable chain: manifest.exports -> dist/index.js
Reachable file contains a blocking source-risk pattern.
Critical Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.js View on unpkg • matchType = previous_version_dangerous_delta
matchedPackage = autopilot-ai@1.25.0
matchedIdentity = npm:YXV0b3BpbG90LWFp:1.25.0
similarity = 0.983
summary = stored previous version shares package body but lacks this dangerous source file
Critical Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.js View on unpkg 1104 // src/remote/deploy.ts
L1105: import { execSync } from "child_process";
L1106: import { join as join7, dirname as dirname4 } from "path";
7653 if (lower === "cmd") {
L7654: return { shell: process.env.COMSPEC || "cmd.exe", args: ["/c"], isPosix: false };
L7655: }
• Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
import { readFile, mkdir, writeFile, chmod } from "fs/promises";
const baseUrl = process.env.KIMIFLARE_BASE_URL ?? persisted.baseUrl;
const requesty = !!requestyApiKey && !openrouterApiKey && !baseUrl;
if (!openrouterApiKey && !baseUrl && !requestyApiKey) return null;
baseUrl,
await writeFile(p, JSON.stringify(next, null, 2), "utf8");
await writeFile(p, JSON.stringify(merged, null, 2), "utf8");
await writeFile(p, JSON.stringify(cfg, null, 2), "utf8");
High Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.js View on unpkg 41 function defaultLogDir() {
L42: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L43: return join(xdg, "kimiflare", "logs");
...
L58: if (currentStream) {
L59: currentStream.end();
L60: currentStream = null;
...
L177: function setFetchForTesting(f) {
L178: fetchImpl = f ?? ((url, init) => fetch(url, init));
L179: }
...
L633: const raw = await readFile(configPath(), "utf8");
L634: persisted = JSON.parse(raw);
L635: hasFile = true;
High Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/index.js View on unpkg · L41 638 const openrouterApiKey = process.env.OPENROUTER_API_KEY || process.env.KIMIFLARE_OPENROUTER_KEY || persisted.openrouterApiKey || persisted.providerKeys?.openrouter || void 0;
L639: const baseUrl = process.env.KIMIFLARE_BASE_URL ?? persisted.baseUrl;
L640: const apiKey = process.env.KIMIFLARE_API_KEY ?? persisted.apiKey;
...
L928: try {
L929: const pkg = JSON.parse(readFileSync(path, "utf8"));
L930: cachedVersion = pkg.version ?? "0.0.0";
...
L1104: // src/remote/deploy.ts
L1105: import { execSync } from "child_process";
L1106: import { join as join7, dirname as dirname4 } from "path";
...
L4453: - Treat blockers as problems to work through, not as a stopping point. After an error or failed attempt, diagnose the cause and try a safe, materially different recovery or verific...
L4454:
High Remote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
dist/index.js View on unpkg · L638 41 Cross-file remote execution chain: dist/index.js spawns dist/sdk/index.js; helper contains network access plus dynamic code execution.
L41: function defaultLogDir() {
L42: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L43: return join(xdg, "kimiflare", "logs");
...
L58: if (currentStream) {
L59: currentStream.end();
L60: currentStream = null;
...
L177: function setFetchForTesting(f) {
L178: fetchImpl = f ?? ((url, init) => fetch(url, init));
L179: }
...
L633: const raw = await readFile(configPath(), "utf8");
L634: persisted = JSON.parse(raw);
L635: hasFile = true;
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/index.js View on unpkg · L41 2969 async function rotateJsonl(path, maxBytes, rotations) {
L2970: const { rename: rename4 } = await import("fs/promises");
L2971: let s;
Medium Dynamic Require
Package source references dynamic require/import behavior.
dist/index.js View on unpkg · L2969 41 function defaultLogDir() {
L42: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L43: return join(xdg, "kimiflare", "logs");
...
L58: if (currentStream) {
L59: currentStream.end();
L60: currentStream = null;
...
L177: function setFetchForTesting(f) {
L178: fetchImpl = f ?? ((url, init) => fetch(url, init));
L179: }
...
L633: const raw = await readFile(configPath(), "utf8");
L634: persisted = JSON.parse(raw);
L635: hasFile = true;
Low Weak Crypto
Package source references weak cryptographic algorithms.
dist/index.js View on unpkg · L41 node_modules/ajv/dist/compile/jtd/serialize.js View file 49 sourceCode = `${gen.scopeRefs(names_1.default.scope)}return ${serializeFuncCode}`;
L50: const makeSerialize = new Function(`${names_1.default.scope}`, sourceCode);
L51: const serialize = makeSerialize(this.scope.get());
High Eval
Package source references dynamic code evaluation.
node_modules/ajv/dist/compile/jtd/serialize.js View on unpkg · L49 node_modules/ip-address/dist/ipv6.js#virtual:normalized:round1 View file 156 * @example
L157: * var addressAndPort = Address6.fromURL("http://[ffff::]:8080/foo/");
L158: * addressAndPort.address.correctForm(); // "ffff::"
...
L186: }
L187: // If there"s a port convert it to an integer\n if (port) {\n port = parseInt(port, 10);\n // squelch out of range ports (valid ports are 0-65535)\n ...
L188: * Throws `AddressError` if the mask is non-contiguous (e.g.
...
L399: * on `this.parsedAddress`. Called automatically by the constructor; you
L400: * typically don"t need to call it directly. Throws `AddressError` if the\n * input is malformed.\n */\n // TODO: Make private?\n parse(address) {\n address = t...
L401: and Windows Server 2008 implementations, more bits are used. In those
...
L551: *
L552: * To get a Node
High Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
node_modules/ip-address/dist/ipv6.js#virtual:normalized:round1 View on unpkg · L156 node_modules/better-sqlite3/binding.gyp View file • path = node_modules/better-sqlite3/binding.gyp
kind = build_helper
sizeBytes = 942
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
node_modules/better-sqlite3/binding.gyp View on unpkg node_modules/tar-fs/test/fixtures/invalid.tar View file • path = node_modules/tar-fs/test/fixtures/invalid.tar
kind = payload_in_excluded_dir
sizeBytes = 2560
magicHex = [redacted]
High Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
node_modules/tar-fs/test/fixtures/invalid.tar View on unpkg • path = node_modules/tar-fs/test/fixtures/invalid.tar
kind = compressed_blob
sizeBytes = 2560
magicHex = [redacted]
Medium Ships Compressed Blob
Package ships compressed or archive-like blobs.
node_modules/tar-fs/test/fixtures/invalid.tar View on unpkg • path = node_modules/tar-fs/test/fixtures/invalid.tar
kind = nested_archive_needs_inspection
sizeBytes = 2560
magicHex = [redacted]
Low Nested Archive Needs Inspection
Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.
node_modules/tar-fs/test/fixtures/invalid.tar View on unpkg node_modules/typescript/lib/typescript.js View file • path = node_modules/typescript/lib/typescript.js
kind = oversized_source_file
sizeBytes = 9112572
magicHex = [redacted]
Medium Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
node_modules/typescript/lib/typescript.js View on unpkg dist/sdk/index.d.ts#virtual:normalized:round1 View file • stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 38
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/sdk/index.d.ts#virtual:normalized:round1 View on unpkg node_modules/qrcode/lib/renderer/svg.js View file • matchType = normalized_sha256
matchedPackage = @walkhi/code-relax@0.1.0-beta.1
matchedPath = node_modules/qrcode/lib/renderer/svg.js
matchedIdentity = npm:QHdhbGtoaS9jb2RlLXJlbGF4:0.1.0-beta.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
node_modules/qrcode/lib/renderer/svg.js View on unpkg node_modules/ajv-formats/dist/formats.js View file • matchType = normalized_sha256
matchedPackage = polyrouter@1.0.35
matchedPath = app/node_modules/ajv-formats/dist/formats.js
matchedIdentity = npm:cG9seXJvdXRlcg:1.0.35
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
node_modules/ajv-formats/dist/formats.js View on unpkg Remote Agent Bridge
dist/index.js
High Cross File Remote Execution Context dist/index.js
High Payload In Excluded Dir node_modules/tar-fs/test/fixtures/invalid.tar
High Semantic Analysis Limited dist/sdk/index.d.ts#virtual:normalized:round1
High Known Malware Source Similarity node_modules/qrcode/lib/renderer/svg.js
High Known Malware Source Similarity node_modules/ajv-formats/dist/formats.js
Medium Dynamic Require dist/index.js
Medium Ships Build Helper node_modules/better-sqlite3/binding.gyp
Medium Ships Compressed Blob node_modules/tar-fs/test/fixtures/invalid.tar
Medium Oversized Source File node_modules/typescript/lib/typescript.js
Medium Structural Risk Force Deep Review
Low Non Install Lifecycle Scripts
Low Weak Crypto dist/index.js
Low Nested Archive Needs Inspection node_modules/tar-fs/test/fixtures/invalid.tar
exports map bin → autopilot
Artifact 71.5 MB · 9,169 files 2 signature(s) · provenance
Install lifecycle prepublishOnly
Behavioral surface ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem Network Shell HighEntropyStrings UrlStrings Manifest: clean