registry / autopilot-ai / 2.6.0
autopilot-ai@2.6.0
autopilot (formerly kimiflare): a terminal coding agent for any model with your own key: OpenRouter, Anthropic, OpenAI, Gemini, Bedrock, Vertex, Ollama and more. Per-turn cost, web search, GitHub, headless browser, LSP, MCP, local memory.
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe manifest has no install-time hook, and inspected network behavior is either disabled by default or tied to configured services. Scanner flags for evaluation and dynamic execution correspond to the package’s isolated code-running feature; reviewed dependency installation is ordinary native build setup.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Normal CLI or SDK use; telemetry transmission requires an explicitly configured endpoint.
Impact
No confirmed attack surface was established in the inspected sources.
Mechanism
The package runs supplied code in an isolated runtime, writes enabled traces locally, and limits the inspected SDK control request to loopback.
AI rationale
The manifest has no install-time hook, and inspected network behavior is either disabled by default or tied to configured services. Scanner flags for evaluation and dynamic execution correspond to the package’s isolated code-running feature; reviewed dependency installation is ordinary native build setup.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes a CLI and uses `prepublishOnly` only to run the build; it defines no install hook.
- Trace recording is disabled unless enabled and writes to a session trace directory; the SDK types describe that directory as on disk.
- The OpenTelemetry sink sends nothing unless an endpoint is explicitly configured.
- The bundled sandbox client is described as connecting to a self-hosted daemon; the package’s SQLite dependency uses a native build installer.
- The SDK control request targets a loopback address, and its trace recorder interface describes local disk storage.
- The evaluation sink runs supplied code in an isolated runtime with a timeout, consistent with the package’s coding-agent functionality.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
15 flaggeddist/index.jsView file
41Source sends the broad process environment to a literal external destination.
L41: function defaultLogDir() {
L42: const xdg = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
L43: return join(xdg, "kimiflare", "logs");
...
L58: if (currentStream) {
L59: currentStream.end();
L60: currentStream = null;
...
L188: function setFetchForTesting(f) {
L189: fetchImpl = f ?? ((url, init) => fetch(url, init));
L190: }
...
L989: import { createSign } from "crypto";
L990: import { execFile } from "child_process";
L991: import { readFile } from "fs/promises";
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg · L411055const iat = Math.floor(now2 / 1e3);
L1056: const payload = enc({ iss: sa.client_email, scope: SCOPE, aud: sa.token_uri ?? "https://oauth2.googleapis.com/token", iat, exp: iat + 3600 });
L1057: const signature = createSign("RSA-SHA256").update(`${header}.${payload}`).sign(sa.private_key).toString("base64url");
...
L1062: const tokenUrl = creds.type === "service_account" ? creds.token_uri ?? "https://oauth2.googleapis.com/token" : "https://oauth2.googleapis.com/token";
L1063: const body = creds.type === "service_account" ? new URLSearchParams({ grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer", assertion: signJwt(creds, now2) }) : new URLSearchP...
L1064: const res = await fetchImpl2(tokenUrl, { method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded" },
Critical
Command Output Exfiltration
Findings
6 Critical8 High4 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
CriticalCommand Output Exfiltrationdist/index.js
CriticalDns Exfiltrationdist/index.js
CriticalRemote Response Code Executiondist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/sdk/index.d.ts
HighChild Processdist/index.js
HighShelldist/index.js
HighEval
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighRemote Agent Bridgedist/index.js
Affected versions and remediation
This report applies to autopilot-ai@2.6.0.
See all versions of autopilot-ai for other recorded verdicts.
- Review the evidence and your use of autopilot-ai@2.6.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.