blun-king-cli@9.1.587: Suspicious npm security report (Warn)

Loading npm security reports…

blun-king-cli@9.1.587: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

22 flagged

package.jsonView file

Lines 1-31json

2 "name": "blun-king-cli",

3 "version": "9.1.587",

4 "description": "BLUN CLI - your own AI agent with a Telegram channel. Get it done. With BLUN.",

5 "license": "MIT",

6 "bin": {

7 "blun": "bin/blun.js",

8 "king": "bin/king.js"

9 },

10 "scripts": {

11 "postinstall": "node bin/fix-node-pty-perms.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

12 },

13 "engines": {

14 "node": ">=24.15.0"

15 },

16 "os": [

17 "darwin",

18 "linux",

19 "win32"

20 ],

21 "cpu": [

22 "x64",

23 "arm64"

24 ],

25 "optionalDependencies": {

26 "@mariozechner/clipboard": "^0.3.9",

27 "node-pty": "^1.1.0"

28 },

29 "files": [

30 "bin/",

31 "blun.mjs",

bin/update-lease.jsView file

Lines 1-27javascript

1'use strict';

3const { createHash } = require('node:crypto');

4const fs = require('node:fs');

5const

agent-spine-plugin/scripts/check-hosts.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2import { spawn } from "node:child_process";

3import { readFile, stat } from "node:fs/promises";

4import { isAbsolute, relative, resolve } from "node:path";

5import { fileURLToPath }

telegram-plugin/compat/mcp-server-fa511cd1.mjsView file

169try { L170: new Function(""); L171: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

telegram-plugin/compat/mcp-server-fa511cd1.mjsView on unpkg · L169

bin/cognitive-state-store.cjsView file

Lines 1-22javascript

1'use strict';

3const crypto = require('node:crypto');

4const fs = require('node:fs');

Medium

Dynamic Require

telegram-plugin/dist/bridge.mjsView file

Lines 1-24javascript

1import { A as _enum, B as object, C as pidFile, D as tuiPidFile, E as tuiInboundQueueFile, G as union, I as intersection, K as unknown, L as literal, M as array, N as boolean, O as workspaceDir, S as outboxLog, T

native/darwin/prebuilds/darwin-x64/darwin-modifiers.nodeView file

•path = native/darwin/prebuilds/darwin-x64/darwin-modifiers.node kind = native_binary sizeBytes = 12776 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

native/darwin/prebuilds/darwin-x64/darwin-modifiers.nodeView on unpkg

standard-tools/language-guard/blun_language_guard.pyView file

•path = standard-tools/language-guard/blun_language_guard.py kind = build_helper sizeBytes = 29606 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

standard-tools/language-guard/blun_language_guard.pyView on unpkg

dist-web/vis/index.html.gzView file

•path = dist-web/vis/index.html.gz kind = high_entropy_blob sizeBytes = 125235 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist-web/vis/index.html.gzView on unpkg

•path = dist-web/vis/index.html.gz kind = compressed_blob sizeBytes = 125235 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist-web/vis/index.html.gzView on unpkg

blun.mjsView file

•path = blun.mjs kind = oversized_source_file sizeBytes = 21230191 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

blun.mjsView on unpkg

•path = blun.mjs kind = oversized_cli_entrypoint sizeBytes = 21230191 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

blun.mjsView on unpkg

agent-spine-plugin/scripts/check-install.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 15

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

agent-spine-plugin/scripts/check-install.jsView on unpkg

bin/managed-node.jsView file

•matchType = normalized_sha256 matchedPackage = blun-king-cli@9.1.519 matchedPath = bin/managed-node.js matchedIdentity = npm:Ymx1bi1raW5nLWNsaQ:9.1.519 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/managed-node.jsView on unpkg

bin/runtime-exit-ledger.cjsView file

•matchType = normalized_sha256 matchedPackage = blun-king-cli@9.1.519 matchedPath = bin/runtime-exit-ledger.cjs matchedIdentity = npm:Ymx1bi1raW5nLWNsaQ:9.1.519 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/runtime-exit-ledger.cjsView on unpkg

agent-spine-plugin/scripts/run-checks.jsView file

•matchType = token_shingles matchedPackage = blun-king-cli@9.1.519 matchedPath = agent-spine-plugin/scripts/run-checks.js matchedIdentity = npm:Ymx1bi1raW5nLWNsaQ:9.1.519 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

agent-spine-plugin/scripts/run-checks.jsView on unpkg

agent-spine-plugin/src/lib/peer-transport.jsView file

•matchType = normalized_sha256 matchedPackage = blun-king-cli@9.1.519 matchedPath = agent-spine-plugin/src/lib/peer-transport.js matchedIdentity = npm:Ymx1bi1raW5nLWNsaQ:9.1.519 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

agent-spine-plugin/src/lib/peer-transport.jsView on unpkg

bin/agent-api-usage-journal.cjsView file

•matchType = normalized_sha256 matchedPackage = blun-king-cli@9.1.519 matchedPath = bin/agent-api-usage-journal.cjs matchedIdentity = npm:Ymx1bi1raW5nLWNsaQ:9.1.519 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/agent-api-usage-journal.cjsView on unpkg

bin/cognitive-memory-command.cjsView file

•matchType = normalized_sha256 matchedPackage = blun-king-cli@9.1.519 matchedPath = bin/cognitive-memory-command.cjs matchedIdentity = npm:Ymx1bi1raW5nLWNsaQ:9.1.519 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cognitive-memory-command.cjsView on unpkg

agent-spine-plugin/src/lib/sqlite-transport.jsView file

•matchType = normalized_sha256 matchedPackage = blun-king-cli@9.1.519 matchedPath = agent-spine-plugin/src/lib/sqlite-transport.js matchedIdentity = npm:Ymx1bi1raW5nLWNsaQ:9.1.519 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

agent-spine-plugin/src/lib/sqlite-transport.jsView on unpkg

bin/node-version.jsView file

•matchType = normalized_sha256 matchedPackage = blun-king-cli@9.1.519 matchedPath = bin/node-version.js matchedIdentity = npm:Ymx1bi1raW5nLWNsaQ:9.1.519 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/node-version.jsView on unpkg

Source & flagged code

22 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/fix-node-pty-perms.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/update-lease.jsView file

7const path = require('node:path'); L8: const { spawn } = require('node:child_process'); L9:

High

Child Process

Package source references child process execution.

bin/update-lease.jsView on unpkg · L7

•matchType = normalized_sha256 matchedPackage = blun-king-cli@9.1.519 matchedPath = bin/update-lease.js matchedIdentity = npm:Ymx1bi1raW5nLWNsaQ:9.1.519 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/update-lease.jsView on unpkg

agent-spine-plugin/scripts/check-hosts.jsView file

High

Shell

Package source references shell execution.

agent-spine-plugin/scripts/check-hosts.jsView on unpkg · L7

telegram-plugin/compat/mcp-server-fa511cd1.mjsView file

169try { L170: new Function(""); L171: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

telegram-plugin/compat/mcp-server-fa511cd1.mjsView on unpkg · L169

bin/cognitive-state-store.cjsView file

2L3: const crypto = require('node:crypto'); L4: const fs = require('node:fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cognitive-state-store.cjsView on unpkg · L2

telegram-plugin/dist/bridge.mjsView file

4import { randomBytes } from "node:crypto"; L5: import { spawn } from "node:child_process"; L6: import { Readable, Writable } from "node:stream"; ... L11: import telegramApprovalRelay from "../bin/telegram-approval-relay.cjs"; L12: import privateConversationPolicy from "../bin/telegram-private-conversation-policy.cjs"; L13: import telegramTextChunkPolicy from "../bin/telegram-text-chunk-policy.cjs"; ... L309: if (file.file_path === void 0) return void 0; L310: const res = await fetch(`https://api.telegram.org/file/bot${token}/${file.file_path}`); L311: const buf = Buffer.from(await res.arrayBuffer()); L312: const ext = file.file_path.split(".").pop() ?? "jpg"; ... L317: } catch (err) { L318: process.stderr.write(`telegram channel: photo download failed: ${String(err)}\n`);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

telegram-plugin/dist/bridge.mjsView on unpkg · L4

native/darwin/prebuilds/darwin-x64/darwin-modifiers.nodeView file

•path = native/darwin/prebuilds/darwin-x64/darwin-modifiers.node kind = native_binary sizeBytes = 12776 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

native/darwin/prebuilds/darwin-x64/darwin-modifiers.nodeView on unpkg

standard-tools/language-guard/blun_language_guard.pyView file

•path = standard-tools/language-guard/blun_language_guard.py kind = build_helper sizeBytes = 29606 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

standard-tools/language-guard/blun_language_guard.pyView on unpkg

dist-web/vis/index.html.gzView file

•path = dist-web/vis/index.html.gz kind = high_entropy_blob sizeBytes = 125235 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist-web/vis/index.html.gzView on unpkg

•path = dist-web/vis/index.html.gz kind = compressed_blob sizeBytes = 125235 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist-web/vis/index.html.gzView on unpkg

blun.mjsView file

•path = blun.mjs kind = oversized_source_file sizeBytes = 21230191 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

blun.mjsView on unpkg

•path = blun.mjs kind = oversized_cli_entrypoint sizeBytes = 21230191 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

blun.mjsView on unpkg

agent-spine-plugin/scripts/check-install.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 15

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

agent-spine-plugin/scripts/check-install.jsView on unpkg

bin/managed-node.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/managed-node.jsView on unpkg

bin/runtime-exit-ledger.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/runtime-exit-ledger.cjsView on unpkg

agent-spine-plugin/scripts/run-checks.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

agent-spine-plugin/scripts/run-checks.jsView on unpkg

agent-spine-plugin/src/lib/peer-transport.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

agent-spine-plugin/src/lib/peer-transport.jsView on unpkg

bin/agent-api-usage-journal.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/agent-api-usage-journal.cjsView on unpkg

bin/cognitive-memory-command.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cognitive-memory-command.cjsView on unpkg

agent-spine-plugin/src/lib/sqlite-transport.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

agent-spine-plugin/src/lib/sqlite-transport.jsView on unpkg

bin/node-version.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/node-version.jsView on unpkg

Source & flagged code

22 flagged

package.jsonView file

Lines 1-31json

2 "name": "blun-king-cli",

3 "version": "9.1.587",

4 "description": "BLUN CLI - your own AI agent with a Telegram channel. Get it done. With BLUN.",

5 "license": "MIT",

6 "bin": {

7 "blun": "bin/blun.js",

8 "king": "bin/king.js"

9 },

10 "scripts": {

11 "postinstall": "node bin/fix-node-pty-perms.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

12 },

13 "engines": {

14 "node": ">=24.15.0"

15 },

16 "os": [

17 "darwin",

18 "linux",

19 "win32"

20 ],

21 "cpu": [

22 "x64",

23 "arm64"

24 ],

25 "optionalDependencies": {

26 "@mariozechner/clipboard": "^0.3.9",

27 "node-pty": "^1.1.0"

28 },

29 "files": [

30 "bin/",

31 "blun.mjs",

bin/update-lease.jsView file

Lines 1-27javascript

1'use strict';

3const { createHash } = require('node:crypto');

4const fs = require('node:fs');

5const

agent-spine-plugin/scripts/check-hosts.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2import { spawn } from "node:child_process";

3import { readFile, stat } from "node:fs/promises";

4import { isAbsolute, relative, resolve } from "node:path";

5import { fileURLToPath }

telegram-plugin/compat/mcp-server-fa511cd1.mjsView file

169try { L170: new Function(""); L171: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

telegram-plugin/compat/mcp-server-fa511cd1.mjsView on unpkg · L169

bin/cognitive-state-store.cjsView file

Lines 1-22javascript

1'use strict';

3const crypto = require('node:crypto');

4const fs = require('node:fs');

Medium

Dynamic Require

telegram-plugin/dist/bridge.mjsView file

Lines 1-24javascript

native/darwin/prebuilds/darwin-x64/darwin-modifiers.nodeView file

•path = native/darwin/prebuilds/darwin-x64/darwin-modifiers.node kind = native_binary sizeBytes = 12776 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

native/darwin/prebuilds/darwin-x64/darwin-modifiers.nodeView on unpkg

standard-tools/language-guard/blun_language_guard.pyView file

•path = standard-tools/language-guard/blun_language_guard.py kind = build_helper sizeBytes = 29606 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

standard-tools/language-guard/blun_language_guard.pyView on unpkg

dist-web/vis/index.html.gzView file

•path = dist-web/vis/index.html.gz kind = high_entropy_blob sizeBytes = 125235 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist-web/vis/index.html.gzView on unpkg

•path = dist-web/vis/index.html.gz kind = compressed_blob sizeBytes = 125235 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist-web/vis/index.html.gzView on unpkg

blun.mjsView file

•path = blun.mjs kind = oversized_source_file sizeBytes = 21230191 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

blun.mjsView on unpkg

•path = blun.mjs kind = oversized_cli_entrypoint sizeBytes = 21230191 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

blun.mjsView on unpkg

agent-spine-plugin/scripts/check-install.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 15

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

agent-spine-plugin/scripts/check-install.jsView on unpkg

bin/managed-node.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/managed-node.jsView on unpkg

bin/runtime-exit-ledger.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/runtime-exit-ledger.cjsView on unpkg

agent-spine-plugin/scripts/run-checks.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

agent-spine-plugin/scripts/run-checks.jsView on unpkg

agent-spine-plugin/src/lib/peer-transport.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

agent-spine-plugin/src/lib/peer-transport.jsView on unpkg

bin/agent-api-usage-journal.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/agent-api-usage-journal.cjsView on unpkg

bin/cognitive-memory-command.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cognitive-memory-command.cjsView on unpkg

agent-spine-plugin/src/lib/sqlite-transport.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

agent-spine-plugin/src/lib/sqlite-transport.jsView on unpkg

bin/node-version.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/node-version.jsView on unpkg

blun-king-cli@9.1.587

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code