Loading npm security reports…

kaijibot: AI-agent control-surface risk | LPM Firewall

registry / kaijibot / 2026.8.14-1

kaijibot@2026.8.14-1

Proactive cognitive AI assistant with Feishu/WeChat integration — learns user interests, pushes cross-domain insights, evolves skills, self-corrects. 40+ LLM providers, runs on cloud/desktop/Android.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm installation automatically modifies ~/.agents/skills and obtains global agent skills through npx. This is an unconsented broad AI-agent control-surface mutation.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install

Impact

Adds externally sourced lark-* SKILL.md capabilities to the user's agent environment.

Mechanism

postinstall globally installs third-party agent skills

Policy narrative

On npm installation, the package runs scripts/postinstall-bundled-plugins.mjs. Unless an opt-out variable is already set or it detects a source checkout, it invokes npx to globally install all larksuite/cli skills into ~/.agents/skills. That mutates a broad, foreign agent control surface and obtains externally supplied capability content without an explicit user setup command.

Rationale

The inspected postinstall hook performs unconsented mutation of ~/.agents/skills via a global npx skill installation. This meets the install-time AI-agent control-surface blocking policy.

Evidence

package.jsonscripts/postinstall-bundled-plugins.mjs~/.agents/skills

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/control-ui/assets/index-B2vTvM2B.jsView file

911contains invisible/control Unicode U+200D (zero width joiner) `}var Ug=50,Wg=class{constructor(){this.items=[],this.cursor=-1}push(e){let t=e.trim();t&&this.items[this.items.length-1]!==t&&(this.items.push(t),this.items.length>Ug&&this.items.shift(),this.cursor=-1)}up(){return this.items.length===0?

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-B2vTvM2B.jsView on unpkg · L911

912`);return M(t,-1)?``:e.slice(t)}function LS(e){return e.replace(/^[ \t\r\f\v]+/,``)}function RS(e){let t=LS(e);return t.startsWith(NS)?RS(FS(t.slice(2))):t.startsWith(MS)?RS(IS(t.s... L913: `)?BS(e,RS(t)):e.startsWith(` `)?BS(e,t):BS(e,zS(t))}[...[...AS,`_`,`$`],...jS],[...jS];function HS(e){return M(e,``)?[]:[e.slice(0,1),e.slice(1)]}function US(e,t){return N(e,(e,n)... L914: \r `.includes(e[o]);)o++};return l()};e.parse=o}))(),rj=new Set([`"`,`\\`,`/`,`b`,`f`,`n`,`r`,`t`,`u`]);function ij(e){let t=e.codePointAt(0);return t!==void 0&&t>=0&&t<=31}functio...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/control-ui/assets/index-B2vTvM2B.jsView on unpkg · L912

dist/launchd-Cm2E2m_1.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.9-3 matchedPath = dist/launchd-Cm2E2m_1.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.9-3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/launchd-Cm2E2m_1.jsView on unpkg

8import path from "node:path"; L9: import { spawn } from "node:child_process"; L10: import os from "node:os"; ... L44: } L45: function buildLaunchAgentPlist$1({ label, comment, programArguments, workingDirectory, stdoutPath, stderrPath, environment }) { L46: const argsXml = programArguments.map((arg) => `\n <string>${plistEscape(arg)}</string>`).join(""); ... L62: } L63: function resolveLaunchdRestartTarget(env = process.env) { L64: const domain = resolveGuiDomain$1(); L65: const label = resolveLaunchAgentLabel$1(env); L66: const home = normalizeOptionalString(env.HOME) || os.homedir(); L67: return {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/launchd-Cm2E2m_1.jsView on unpkg · L8

skills/video-frames/scripts/frame.shView file

•path = skills/video-frames/scripts/frame.sh kind = build_helper sizeBytes = 1347 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/video-frames/scripts/frame.shView on unpkg

dist/extensions/diffs/assets/viewer-runtime.jsView file

•path = [redacted]-runtime.js kind = oversized_source_file sizeBytes = 9867326 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/extensions/diffs/assets/viewer-runtime.jsView on unpkg

dist/clawhub-Br81or9N.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.9-3 matchedPath = dist/clawhub-Br81or9N.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.9-3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/clawhub-Br81or9N.jsView on unpkg

dist/gateway-cli-BenQBXEC.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.6 matchedPath = dist/gateway-cli-BBYbn1vt.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/gateway-cli-BenQBXEC.jsView on unpkg

dist/runner-jvYZHMjd.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.9-3 matchedPath = dist/runner-jvYZHMjd.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.9-3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runner-jvYZHMjd.jsView on unpkg

dist/sandbox-nK89MQSS.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.9-3 matchedPath = dist/sandbox-nK89MQSS.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.9-3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/sandbox-nK89MQSS.jsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 1084-1124json

1084 "lint:fix": "node scripts/run-oxlint.mjs --fix && pnpm format",

1085 "lint:plugins:no-extension-imports": "node scripts/check-plugin-extension-import-boundary.mjs",

1086 "lint:plugins:no-extension-src-imports": "node --import tsx scripts/check-no-extension-src-imports.ts",

1087 "lint:plugins:no-extension-test-core-imports": "node --import tsx scripts/check-no-extension-test-core-imports.ts",

1088 "lint:plugins:no-monolithic-plugin-sdk-entry-imports": "node --import tsx scripts/check-no-monolithic-plugin-sdk-entry-imports.ts",

1089 "lint:plugins:no-register-http-handler": "node scripts/check-no-register-http-handler.mjs",

1090 "lint:plugins:plugin-sdk-subpaths-exported": "node scripts/check-plugin-sdk-subpath-exports.mjs",

1091 "lint:tmp:channel-agnostic-boundaries": "node scripts/check-channel-agnostic-boundaries.mjs",

1092 "lint:tmp:no-random-messaging": "node scripts/check-no-random-messaging-tmp.mjs",

1093 "lint:tmp:no-raw-channel-fetch": "node scripts/check-no-raw-channel-fetch.mjs",

1094 "lint:ui:no-raw-window-open": "node scripts/check-no-raw-window-open.mjs",

1095 "lint:web-fetch-provider-boundaries": "node scripts/check-web-fetch-provider-boundaries.mjs",

1096 "lint:web-search-provider-boundaries": "node scripts/check-web-search-provider-boundaries.mjs",

1097 "lint:webhook:no-low-level-body-read": "node scripts/check-webhook-auth-body-order.mjs",

1098 "plugin-sdk:api:check": "node --import tsx scripts/generate-plugin-sdk-api-baseline.ts --check",

1099 "plugin-sdk:api:gen": "node --import tsx scripts/generate-plugin-sdk-api-baseline.ts --write",

1100 "plugin-sdk:check-exports": "node scripts/sync-plugin-sdk-exports.mjs --check",

1101 "plugin-sdk:sync-exports": "node scripts/sync-plugin-sdk-exports.mjs",

1102 "plugin-sdk:usage": "node --import tsx scripts/analyze-plugin-sdk-usage.ts",

1103 "plugins:sync": "node --import tsx scripts/sync-plugin-versions.ts",

1104 "postinstall": "node scripts/postinstall-bundled-plugins.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L1104

1105 "prepack": "node --import tsx scripts/kaijibot-prepack.ts",

1106 "prepare": "command -v git >/dev/null 2>&1 && git rev-parse --is-inside-work-tree >/dev/null 2>&1 && git config core.hooksPath git-hooks || exit 0",

1107 "protocol:gen": "node --import tsx scripts/protocol-gen.ts",

1108 "runtime-sidecars:check": "node --import tsx scripts/generate-runtime-sidecar-paths-baseline.ts --check",

1109 "runtime-sidecars:gen": "node --import tsx scripts/generate-runtime-sidecar-paths-baseline.ts --write",

1110 "stage:bundled-plugin-runtime-deps": "node scripts/stage-bundled-plugin-runtime-deps.mjs",

1111 "start": "node scripts/run-node.mjs",

1112 "test": "node scripts/test-projects.mjs",

1113 "test:auth:compat": "node scripts/run-vitest.mjs run --config vitest/vitest.gateway.config.ts src/gateway/server.auth.compat-baseline.test.ts src/gateway/client.test.ts src/gateway/reconnect-gating.test.ts src/gateway/protocol/connect-error-details.test.ts",

1114 "test:build:singleton": "node scripts/test-built-plugin-singleton.mjs",

1115 "test:bundled": "node scripts/run-vitest.mjs run --config vitest/vitest.bundled.config.ts",

1116 "test:changed": "node scripts/test-projects.mjs --changed origin/main",

1117 "test:changed:max": "KAIJIBOT_VITEST_MAX_WORKERS=8 node scripts/test-projects.mjs --changed origin/main",

1118 "test:channels": "node scripts/run-vitest.mjs run --config vitest/vitest.channels.config.ts",

1119 "test:contracts": "pnpm test:contracts:channels && pnpm test:contracts:plugins",

1120 "test:contracts:channels": "node scripts/run-vitest.mjs run --config vitest/vitest.contracts.config.ts --maxWorkers=1 src/channels/plugins/contracts",

1121 "test:contracts:plugins": "node scripts/run-vitest.mjs run --config vitest/vitest.contracts.config.ts --maxWorkers=1 src/plugins/contracts",

1122 "test:coverage": "node scripts/run-vitest.mjs run --config vitest/vitest.unit.config.ts --coverage",

1123 "test:coverage:changed": "node scripts/run-vitest.mjs run --config vitest/vitest.unit.config.ts --coverage --changed origin/main",

1124 "test:e2e": "node scripts/run-vitest.mjs run --config vitest/vitest.e2e.config.ts",

dist/control-ui/assets/index-B2vTvM2B.jsView file

911contains invisible/control Unicode U+200D (zero width joiner) `}var Ug=50,Wg=class{constructor(){this.items=[],this.cursor=-1}push(e){let t=e.trim();t&&this.items[this.items.length-1]!==t&&(this.items.push(t),this.items.length>Ug&&this.items.shift(),this.cursor=-1)}up(){return this.items.length===0?

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-B2vTvM2B.jsView on unpkg · L911

912`);return M(t,-1)?``:e.slice(t)}function LS(e){return e.replace(/^[ \t\r\f\v]+/,``)}function RS(e){let t=LS(e);return t.startsWith(NS)?RS(FS(t.slice(2))):t.startsWith(MS)?RS(IS(t.s... L913: `)?BS(e,RS(t)):e.startsWith(` `)?BS(e,t):BS(e,zS(t))}[...[...AS,`_`,`$`],...jS],[...jS];function HS(e){return M(e,``)?[]:[e.slice(0,1),e.slice(1)]}function US(e,t){return N(e,(e,n)... L914: \r `.includes(e[o]);)o++};return l()};e.parse=o}))(),rj=new Set([`"`,`\\`,`/`,`b`,`f`,`n`,`r`,`t`,`u`]);function ij(e){let t=e.codePointAt(0);return t!==void 0&&t>=0&&t<=31}functio...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/control-ui/assets/index-B2vTvM2B.jsView on unpkg · L912

dist/launchd-Cm2E2m_1.jsView file

Lines 1-28javascript

1import { r as formatErrorMessage } from "./errors-CGMew-1w.js";

2import { i as normalizeLowercaseStringOrEmpty, s as normalizeOptionalString } from "./string-coerce-CIT1-v_a.js";

3import { d as resolveGatewayLaunchAgentLabel, f as resolveGatewayServiceDescription, g

skills/video-frames/scripts/frame.shView file

•path = skills/video-frames/scripts/frame.sh kind = build_helper sizeBytes = 1347 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/video-frames/scripts/frame.shView on unpkg

dist/extensions/diffs/assets/viewer-runtime.jsView file

•path = [redacted]-runtime.js kind = oversized_source_file sizeBytes = 9867326 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/extensions/diffs/assets/viewer-runtime.jsView on unpkg

dist/clawhub-Br81or9N.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.9-3 matchedPath = dist/clawhub-Br81or9N.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.9-3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/clawhub-Br81or9N.jsView on unpkg

dist/gateway-cli-BenQBXEC.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.6 matchedPath = dist/gateway-cli-BBYbn1vt.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/gateway-cli-BenQBXEC.jsView on unpkg

dist/runner-jvYZHMjd.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.9-3 matchedPath = dist/runner-jvYZHMjd.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.9-3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runner-jvYZHMjd.jsView on unpkg

dist/sandbox-nK89MQSS.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.9-3 matchedPath = dist/sandbox-nK89MQSS.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.9-3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/sandbox-nK89MQSS.jsView on unpkg