kaijibot@2026.7.12: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

kaijibot@2026.7.12: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/control-ui/assets/index-B-71fWDN.jsView file

973contains invisible/control Unicode U+200D (zero width joiner) `}var Ky=50,qy=class{constructor(){this.items=[],this.cursor=-1}push(e){let t=e.trim();t&&this.items[this.items.length-1]!==t&&(this.items.push(t),this.items.length>Ky&&this.items.shift(),this.cursor=-1)}up(){return this.items.length===0?

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-B-71fWDN.jsView on unpkg · L973

974`);return F(t,-1)?``:e.slice(t)}function BT(e){return e.replace(/^[ \t\r\f\v]+/,``)}function VT(e){let t=BT(e);return t.startsWith(IT)?VT(RT(t.slice(2))):t.startsWith(FT)?VT(zT(t.s... L975: `)?UT(e,VT(t)):e.startsWith(` `)?UT(e,t):UT(e,HT(t))}[...[...NT,`_`,`$`],...PT],[...PT];function GT(e){return F(e,``)?[]:[e.slice(0,1),e.slice(1)]}function KT(e,t){return I(e,(e,n)... L976: \r `.includes(e[o]);)o++};return l()};e.parse=o}))(),cP=new Set([`"`,`\\`,`/`,`b`,`f`,`n`,`r`,`t`,`u`]);function lP(e){let t=e.codePointAt(0);return t!==void 0&&t>=0&&t<=31}functio...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/control-ui/assets/index-B-71fWDN.jsView on unpkg · L974

dist/systemd-CU0atyBV.jsView file

15try { L16: return os.userInfo().username; L17: } catch { ... L24: try { L25: const { stdout } = await runExec("loginctl", [ L26: "show-user", ... L378: } L379: async function isSystemdUserServiceAvailable(env = process.env) { L380: const res = await execSystemctlUser(env, ["status"]); ... L437: const enable = await execSystemctlUser(params.env, ["enable", unitName]); L438: if (enable.code !== 0) throw new Error(`systemctl enable failed: ${enable.stderr || enable.stdout}`.trim()); L439: const restart = await execSystemctlUser(params.env, ["restart", unitName]);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/systemd-CU0atyBV.jsView on unpkg · L15

skills/video-frames/scripts/frame.shView file

•path = skills/video-frames/scripts/frame.sh kind = build_helper sizeBytes = 1347 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/video-frames/scripts/frame.shView on unpkg

dist/extensions/diffs/assets/viewer-runtime.jsView file

•path = [redacted]-runtime.js kind = oversized_source_file sizeBytes = 9867326 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/extensions/diffs/assets/viewer-runtime.jsView on unpkg

docs/install/macos-vm.mdView file

219patternName = generic_password severity = medium line = 219 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in docs/install/macos-vm.md

docs/install/macos-vm.mdView on unpkg · L219

docs/help/faq.mdView file

2691patternName = generic_password severity = medium line = 2691 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in docs/help/faq.md

docs/help/faq.mdView on unpkg · L2691

docs/gateway/tailscale.mdView file

90patternName = generic_password severity = medium line = 90 matchedText = auth: { ..." },

Medium

Secret Pattern

Hardcoded password in docs/gateway/tailscale.md

docs/gateway/tailscale.mdView on unpkg · L90

docs/gateway/configuration-reference.mdView file

714patternName = generic_password severity = medium line = 714 matchedText = password...D}",

Medium

Secret Pattern

Hardcoded password in docs/gateway/configuration-reference.md

docs/gateway/configuration-reference.mdView on unpkg · L714

2843patternName = generic_password severity = medium line = 2843 matchedText = // passw...WORD

Medium

Secret Pattern

Hardcoded password in docs/gateway/configuration-reference.md

docs/gateway/configuration-reference.mdView on unpkg · L2843

2870patternName = generic_password severity = medium line = 2870 matchedText = // passw...rd",

Medium

Secret Pattern

Hardcoded password in docs/gateway/configuration-reference.md

docs/gateway/configuration-reference.mdView on unpkg · L2870

docs/channels/bluebubbles.mdView file

44patternName = generic_password severity = medium line = 44 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in docs/channels/bluebubbles.md

docs/channels/bluebubbles.mdView on unpkg · L44

docs/channels/matrix.mdView file

140patternName = generic_password severity = medium line = 140 matchedText = password...cret

Medium

Secret Pattern

Hardcoded password in docs/channels/matrix.md

docs/channels/matrix.mdView on unpkg · L140

docs/channels/irc.mdView file

203patternName = generic_password severity = medium line = 203 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in docs/channels/irc.md

docs/channels/irc.mdView on unpkg · L203