blun-king-cli: Unknown npm security report (Allow)

Loading npm security reports…

blun-king-cli: Unknown npm security report (Allow) | LPM Firewall

Source & flagged code

24 flagged

package.jsonView file

Lines 1-32json

2 "name": "blun-king-cli",

3 "version": "9.1.621",

4 "description": "BLUN CLI - your own AI agent with a Telegram channel. Get it done. With BLUN.",

5 "license": "MIT",

6 "bin": {

7 "blun": "bin/blun.js",

8 "king": "bin/king.js"

9 },

10 "scripts": {

11 "test": "node --test test/*.test.js",

12 "postinstall": "node scripts/fix-node-pty-perms.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L12

13 "prepack": "node bin/verify-bundled-agent-sources.cjs"

14 },

15 "engines": {

16 "node": ">=24.15.0"

17 },

18 "os": [

19 "darwin",

20 "linux",

21 "win32"

22 ],

23 "cpu": [

24 "x64",

25 "arm64"

26 ],

27 "optionalDependencies": {

28 "@mariozechner/clipboard": "^0.3.9",

29 "node-pty": "1.2.0-beta.15"

30 },

31 "dependencies": {

32 "quickjs-emscripten": "0.32.0"

bin/update-lease.jsView file

Lines 1-27javascript

1'use strict';

3const { createHash } = require('node:crypto');

4const fs = require('node:fs');

5const

telegram-plugin/dist/mcp-server.mjsView file

169try { L170: new Function(""); L171: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

telegram-plugin/dist/mcp-server.mjsView on unpkg · L169

bin/agentspine-king-worker-host.mjsView file

Lines 27-67javascript

27 const relative = path.relative(blunHome, path.resolve(config.gatewayStateDirectory));

28 if (path.isAbsolute(relative) || relative === '..' || relative.startsWith(

bin/verify-agent-behavior.cjsView file

Lines 1-34javascript

1'use strict';

2const fs = require('node:fs');

3const path = require('node:path');

4const os

telegram-plugin/dist/bridge.mjsView file

5import { homedir } from "node:os"; L6: import { spawn } from "node:child_process"; L7: import { Readable, Writable } from "node:stream"; ... L36: * Check out the L37: * [documentation](https://grammy.dev/ref/core/composer#on) L38: * of `bot.on` for examples. In addition, the ... L220: is_upgrade_separate: {}, L221: is_private: {} L222: }; ... L285: video_chat_participants_invited: {}, L286: web_app_data: {} L287: };

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

telegram-plugin/dist/bridge.mjsView on unpkg · L5

native/darwin/prebuilds/darwin-x64/darwin-modifiers.nodeView file

•path = native/darwin/prebuilds/darwin-x64/darwin-modifiers.node kind = native_binary sizeBytes = 12776 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

native/darwin/prebuilds/darwin-x64/darwin-modifiers.nodeView on unpkg

standard-tools/language-guard/language_gateway.pyView file

•path = standard-tools/language-guard/language_gateway.py kind = build_helper sizeBytes = 2426 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

standard-tools/language-guard/language_gateway.pyView on unpkg

dist-web/vis/index.html.gzView file

•path = dist-web/vis/index.html.gz kind = high_entropy_blob sizeBytes = 125253 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist-web/vis/index.html.gzView on unpkg

•path = dist-web/vis/index.html.gz kind = compressed_blob sizeBytes = 125253 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist-web/vis/index.html.gzView on unpkg

blun.mjsView file

•path = blun.mjs kind = oversized_source_file sizeBytes = 22115887 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

blun.mjsView on unpkg

•path = blun.mjs kind = oversized_cli_entrypoint sizeBytes = 22115887 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

blun.mjsView on unpkg

agent-spine-plugin/scripts/check-install.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 15

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

agent-spine-plugin/scripts/check-install.jsView on unpkg

bin/managed-node.jsView file

•matchType = normalized_sha256 matchedPackage = blun-king-cli@9.1.519 matchedPath = bin/managed-node.js matchedIdentity = npm:Ymx1bi1raW5nLWNsaQ:9.1.519 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/managed-node.jsView on unpkg

agent-spine-plugin/scripts/run-checks.jsView file

•matchType = token_shingles matchedPackage = blun-king-cli@9.1.519 matchedPath = agent-spine-plugin/scripts/run-checks.js matchedIdentity = npm:Ymx1bi1raW5nLWNsaQ:9.1.519 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

agent-spine-plugin/scripts/run-checks.jsView on unpkg

agent-spine-plugin/src/lib/peer-transport.jsView file

•matchType = normalized_sha256 matchedPackage = blun-king-cli@9.1.519 matchedPath = agent-spine-plugin/src/lib/peer-transport.js matchedIdentity = npm:Ymx1bi1raW5nLWNsaQ:9.1.519 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

agent-spine-plugin/src/lib/peer-transport.jsView on unpkg

agent-spine-plugin/src/lib/sqlite-transport.jsView file

•matchType = normalized_sha256 matchedPackage = blun-king-cli@9.1.519 matchedPath = agent-spine-plugin/src/lib/sqlite-transport.js matchedIdentity = npm:Ymx1bi1raW5nLWNsaQ:9.1.519 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

agent-spine-plugin/src/lib/sqlite-transport.jsView on unpkg

bin/node-version.jsView file

•matchType = normalized_sha256 matchedPackage = blun-king-cli@9.1.519 matchedPath = bin/node-version.js matchedIdentity = npm:Ymx1bi1raW5nLWNsaQ:9.1.519 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/node-version.jsView on unpkg

dist-web/assets/chunk-5RXB4S5H-BFRQvIJS.jsView file

•matchType = normalized_sha256 matchedPackage = @jait/gateway@0.1.848 matchedPath = web-dist/assets/chunk-5RXB4S5H-CK_tVTHM.js matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.848 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-web/assets/chunk-5RXB4S5H-BFRQvIJS.jsView on unpkg

dist-web/assets/chunk-5RXB4S5H-BfZa4yDH.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-web/assets/chunk-5RXB4S5H-BfZa4yDH.jsView on unpkg

dist-web/assets/diagram-Q27KOJAE-BA3z3sXf.jsView file

•matchType = normalized_sha256 matchedPackage = blun-king-cli@9.1.519 matchedPath = dist-web/assets/diagram-Q27KOJAE-D1mYQ_cI.js matchedIdentity = npm:Ymx1bi1raW5nLWNsaQ:9.1.519 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-web/assets/diagram-Q27KOJAE-BA3z3sXf.jsView on unpkg

dist-web/assets/diagram-Q27KOJAE-hy_T73PK.jsView file

•matchType = normalized_sha256 matchedPackage = blun-king-cli@9.1.519 matchedPath = dist-web/assets/diagram-Q27KOJAE-hy_T73PK.js matchedIdentity = npm:Ymx1bi1raW5nLWNsaQ:9.1.519 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-web/assets/diagram-Q27KOJAE-hy_T73PK.jsView on unpkg

bin/launcher-runtime.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = blun-king-cli@9.1.588 matchedIdentity = npm:Ymx1bi1raW5nLWNsaQ:9.1.588 similarity = 0.650 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/launcher-runtime.jsView on unpkg

Source & flagged code

24 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/fix-node-pty-perms.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/update-lease.jsView file

7const path = require('node:path'); L8: const { spawn } = require('node:child_process'); L9:

High

Child Process

Package source references child process execution.

bin/update-lease.jsView on unpkg · L7

•matchType = token_shingles matchedPackage = blun-king-cli@9.1.519 matchedPath = bin/update-lease.js matchedIdentity = npm:Ymx1bi1raW5nLWNsaQ:9.1.519 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/update-lease.jsView on unpkg

telegram-plugin/dist/mcp-server.mjsView file

169try { L170: new Function(""); L171: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

telegram-plugin/dist/mcp-server.mjsView on unpkg · L169

bin/agentspine-king-worker-host.mjsView file

47} L48: const { withOwnedFileLock } = await import(pathToFileURL(path.join(packageRoot, L49: 'agent-spine-plugin/src/lib/owned-file-lock.js')).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/agentspine-king-worker-host.mjsView on unpkg · L47

bin/verify-agent-behavior.cjsView file

14function verifyAgentBehavior(packageRoot, reportParent) { L15: const parent = reportParent || path.join(os.homedir(), '.blun', 'diagnostics', 'package-contracts'); L16: fs.mkdirSync(parent, { recursive: true }); ... L23: }; L24: const read = file => JSON.parse(fs.readFileSync(file, 'utf8')); L25: const core = fs.readFileSync(path.join(packageRoot, 'blun.mjs'), 'utf8'); ... L93: assert.equal(gate({ ...message, replyToUsername: 'ExampleBot' }, 'ExampleBot').action, 'deliver'); L94: assert.equal(gate({ ...message, chatType: 'private', chatId: 'operator' }, 'ExampleBot').action, 'deliver'); L95: passed.push('registered-bridge-drops-unmentioned-groups-preserves-mentions-replies-dms');

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

bin/verify-agent-behavior.cjsView on unpkg · L14

telegram-plugin/dist/bridge.mjsView file

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

telegram-plugin/dist/bridge.mjsView on unpkg · L5

native/darwin/prebuilds/darwin-x64/darwin-modifiers.nodeView file

•path = native/darwin/prebuilds/darwin-x64/darwin-modifiers.node kind = native_binary sizeBytes = 12776 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

native/darwin/prebuilds/darwin-x64/darwin-modifiers.nodeView on unpkg

standard-tools/language-guard/language_gateway.pyView file

•path = standard-tools/language-guard/language_gateway.py kind = build_helper sizeBytes = 2426 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

standard-tools/language-guard/language_gateway.pyView on unpkg

dist-web/vis/index.html.gzView file

•path = dist-web/vis/index.html.gz kind = high_entropy_blob sizeBytes = 125253 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist-web/vis/index.html.gzView on unpkg

•path = dist-web/vis/index.html.gz kind = compressed_blob sizeBytes = 125253 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist-web/vis/index.html.gzView on unpkg

blun.mjsView file

•path = blun.mjs kind = oversized_source_file sizeBytes = 22115887 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

blun.mjsView on unpkg

•path = blun.mjs kind = oversized_cli_entrypoint sizeBytes = 22115887 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

blun.mjsView on unpkg

agent-spine-plugin/scripts/check-install.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 15

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

agent-spine-plugin/scripts/check-install.jsView on unpkg

bin/managed-node.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/managed-node.jsView on unpkg

agent-spine-plugin/scripts/run-checks.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

agent-spine-plugin/scripts/run-checks.jsView on unpkg

agent-spine-plugin/src/lib/peer-transport.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

agent-spine-plugin/src/lib/peer-transport.jsView on unpkg

agent-spine-plugin/src/lib/sqlite-transport.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

agent-spine-plugin/src/lib/sqlite-transport.jsView on unpkg

bin/node-version.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/node-version.jsView on unpkg

dist-web/assets/chunk-5RXB4S5H-BFRQvIJS.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-web/assets/chunk-5RXB4S5H-BFRQvIJS.jsView on unpkg

dist-web/assets/chunk-5RXB4S5H-BfZa4yDH.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-web/assets/chunk-5RXB4S5H-BfZa4yDH.jsView on unpkg

dist-web/assets/diagram-Q27KOJAE-BA3z3sXf.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-web/assets/diagram-Q27KOJAE-BA3z3sXf.jsView on unpkg

dist-web/assets/diagram-Q27KOJAE-hy_T73PK.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-web/assets/diagram-Q27KOJAE-hy_T73PK.jsView on unpkg

bin/launcher-runtime.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/launcher-runtime.jsView on unpkg

Source & flagged code

24 flagged

package.jsonView file

Lines 1-32json

2 "name": "blun-king-cli",

3 "version": "9.1.621",

4 "description": "BLUN CLI - your own AI agent with a Telegram channel. Get it done. With BLUN.",

5 "license": "MIT",

6 "bin": {

7 "blun": "bin/blun.js",

8 "king": "bin/king.js"

9 },

10 "scripts": {

11 "test": "node --test test/*.test.js",

12 "postinstall": "node scripts/fix-node-pty-perms.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L12

13 "prepack": "node bin/verify-bundled-agent-sources.cjs"

14 },

15 "engines": {

16 "node": ">=24.15.0"

17 },

18 "os": [

19 "darwin",

20 "linux",

21 "win32"

22 ],

23 "cpu": [

24 "x64",

25 "arm64"

26 ],

27 "optionalDependencies": {

28 "@mariozechner/clipboard": "^0.3.9",

29 "node-pty": "1.2.0-beta.15"

30 },

31 "dependencies": {

32 "quickjs-emscripten": "0.32.0"

bin/update-lease.jsView file

Lines 1-27javascript

1'use strict';

3const { createHash } = require('node:crypto');

4const fs = require('node:fs');

5const

telegram-plugin/dist/mcp-server.mjsView file

169try { L170: new Function(""); L171: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

telegram-plugin/dist/mcp-server.mjsView on unpkg · L169

bin/agentspine-king-worker-host.mjsView file

Lines 27-67javascript

27 const relative = path.relative(blunHome, path.resolve(config.gatewayStateDirectory));

28 if (path.isAbsolute(relative) || relative === '..' || relative.startsWith(

bin/verify-agent-behavior.cjsView file

Lines 1-34javascript

1'use strict';

2const fs = require('node:fs');

3const path = require('node:path');

4const os

telegram-plugin/dist/bridge.mjsView file

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

telegram-plugin/dist/bridge.mjsView on unpkg · L5

native/darwin/prebuilds/darwin-x64/darwin-modifiers.nodeView file

•path = native/darwin/prebuilds/darwin-x64/darwin-modifiers.node kind = native_binary sizeBytes = 12776 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

native/darwin/prebuilds/darwin-x64/darwin-modifiers.nodeView on unpkg

standard-tools/language-guard/language_gateway.pyView file

•path = standard-tools/language-guard/language_gateway.py kind = build_helper sizeBytes = 2426 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

standard-tools/language-guard/language_gateway.pyView on unpkg

dist-web/vis/index.html.gzView file

•path = dist-web/vis/index.html.gz kind = high_entropy_blob sizeBytes = 125253 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist-web/vis/index.html.gzView on unpkg

•path = dist-web/vis/index.html.gz kind = compressed_blob sizeBytes = 125253 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist-web/vis/index.html.gzView on unpkg

blun.mjsView file

•path = blun.mjs kind = oversized_source_file sizeBytes = 22115887 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

blun.mjsView on unpkg

•path = blun.mjs kind = oversized_cli_entrypoint sizeBytes = 22115887 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

blun.mjsView on unpkg

agent-spine-plugin/scripts/check-install.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 15

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

agent-spine-plugin/scripts/check-install.jsView on unpkg

bin/managed-node.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/managed-node.jsView on unpkg

agent-spine-plugin/scripts/run-checks.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

agent-spine-plugin/scripts/run-checks.jsView on unpkg

agent-spine-plugin/src/lib/peer-transport.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

agent-spine-plugin/src/lib/peer-transport.jsView on unpkg

agent-spine-plugin/src/lib/sqlite-transport.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

agent-spine-plugin/src/lib/sqlite-transport.jsView on unpkg

bin/node-version.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/node-version.jsView on unpkg

dist-web/assets/chunk-5RXB4S5H-BFRQvIJS.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-web/assets/chunk-5RXB4S5H-BFRQvIJS.jsView on unpkg

dist-web/assets/chunk-5RXB4S5H-BfZa4yDH.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-web/assets/chunk-5RXB4S5H-BfZa4yDH.jsView on unpkg

dist-web/assets/diagram-Q27KOJAE-BA3z3sXf.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-web/assets/diagram-Q27KOJAE-BA3z3sXf.jsView on unpkg

dist-web/assets/diagram-Q27KOJAE-hy_T73PK.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-web/assets/diagram-Q27KOJAE-hy_T73PK.jsView on unpkg

bin/launcher-runtime.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/launcher-runtime.jsView on unpkg

blun-king-cli@9.1.621

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code