kaijibot@2026.7.11: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

kaijibot@2026.7.11: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/ports-CFP1pKVF.jsView file

4import { t as tryListenOnPort } from "./ports-probe-DUpiZfD0.js"; L5: import { execFileSync } from "node:child_process"; L6: import { createServer } from "node:net";

High

Child Process

Package source references child process execution.

dist/ports-CFP1pKVF.jsView on unpkg · L4

dist/exec-DYkamZj6.jsView file

101function escapeForCmdExe(arg) { L102: if (WINDOWS_UNSAFE_CMD_CHARS_RE.test(arg)) throw new Error(`Unsafe Windows cmd.exe argument detected: ${JSON.stringify(arg)}. Pass an explicit shell-wrapper argv at the call site i... L103: if (!arg.includes(" ") && !arg.includes("\"")) return arg;

High

Shell

Package source references shell execution.

dist/exec-DYkamZj6.jsView on unpkg · L101

dist/git-commit-bjDk4Nyp.jsView file

88try { L89: const pkg = createRequire(import.meta.url)("../../package.json"); L90: return formatCommit(pkg.gitHead ?? pkg.githead ?? null);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/git-commit-bjDk4Nyp.jsView on unpkg · L88

dist/control-ui/assets/index-PlnK9Z5S.jsView file

973contains invisible/control Unicode U+200D (zero width joiner) `}var Ky=50,qy=class{constructor(){this.items=[],this.cursor=-1}push(e){let t=e.trim();t&&this.items[this.items.length-1]!==t&&(this.items.push(t),this.items.length>Ky&&this.items.shift(),this.cursor=-1)}up(){return this.items.length===0?

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-PlnK9Z5S.jsView on unpkg · L973

dist/server.impl-Cr4_qbqY.jsView file

52Cross-file remote execution chain: dist/server.impl-Cr4_qbqY.js spawns dist/pi-embedded-runner-D5DTCDWg.js; helper contains network access plus dynamic code execution. L52: import { n as pickPrimaryTailnetIPv4, r as pickPrimaryTailnetIPv6 } from "./tailnet-DuYoufgW.js"; L53: import { _ as resolveRequestClientIp, a as isLoopbackHost, g as resolveHostName, h as resolveGatewayListenHosts, i as isLoopbackAddress, l as isTrustedProxyAddress, m as resolveGat... L54: import { c as AUTH_RATE_LIMIT_SCOPE_DEVICE_TOKEN, d as createAuthRateLimiter, f as normalizeRateLimitClientIp, i as isLocalDirectRequest, l as AUTH_RATE_LIMIT_SCOPE_HOOK_AUTH, n as... ... L67: import { i as resolveAssistantAvatarUrl, n as buildControlUiAvatarUrl, r as normalizeControlUiBasePath, t as CONTROL_UI_AVATAR_PREFIX } from "

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/server.impl-Cr4_qbqY.jsView on unpkg · L52

skills/video-frames/scripts/frame.shView file

•path = skills/video-frames/scripts/frame.sh kind = build_helper sizeBytes = 1347 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/video-frames/scripts/frame.shView on unpkg

dist/extensions/diffs/assets/viewer-runtime.jsView file

•path = [redacted]-runtime.js kind = oversized_source_file sizeBytes = 9867326 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/extensions/diffs/assets/viewer-runtime.jsView on unpkg

docs/install/macos-vm.mdView file

219patternName = generic_password severity = medium line = 219 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in docs/install/macos-vm.md

docs/install/macos-vm.mdView on unpkg · L219

docs/help/faq.mdView file

2691patternName = generic_password severity = medium line = 2691 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in docs/help/faq.md

docs/help/faq.mdView on unpkg · L2691

docs/gateway/tailscale.mdView file

90patternName = generic_password severity = medium line = 90 matchedText = auth: { ..." },

Medium

Secret Pattern

Hardcoded password in docs/gateway/tailscale.md

docs/gateway/tailscale.mdView on unpkg · L90

docs/gateway/configuration-reference.mdView file

714patternName = generic_password severity = medium line = 714 matchedText = password...D}",

Medium

Secret Pattern

Hardcoded password in docs/gateway/configuration-reference.md

docs/gateway/configuration-reference.mdView on unpkg · L714

2843patternName = generic_password severity = medium line = 2843 matchedText = // passw...WORD

Medium

Secret Pattern

Hardcoded password in docs/gateway/configuration-reference.md

docs/gateway/configuration-reference.mdView on unpkg · L2843

2870patternName = generic_password severity = medium line = 2870 matchedText = // passw...rd",

Medium

Secret Pattern

Hardcoded password in docs/gateway/configuration-reference.md

docs/gateway/configuration-reference.mdView on unpkg · L2870

docs/channels/bluebubbles.mdView file

44patternName = generic_password severity = medium line = 44 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in docs/channels/bluebubbles.md

docs/channels/bluebubbles.mdView on unpkg · L44

docs/channels/matrix.mdView file

140patternName = generic_password severity = medium line = 140 matchedText = password...cret

Medium

Secret Pattern

Hardcoded password in docs/channels/matrix.md

docs/channels/matrix.mdView on unpkg · L140

docs/channels/irc.mdView file

203patternName = generic_password severity = medium line = 203 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in docs/channels/irc.md

docs/channels/irc.mdView on unpkg · L203