kaijibot@2026.7.17-1: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

kaijibot@2026.7.17-1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

kaijibot.mjsView file

74try { L75: const mod = await import(specifier); L76: if (typeof mod.installProcessWarningFilter === "function") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

kaijibot.mjsView on unpkg · L74

dist/tui-BAZYymTj.jsView file

726contains invisible/control Unicode U+2067 (right-to-left isolate) const RTL_ISOLATE_START = "<U+2067>";

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/tui-BAZYymTj.jsView on unpkg · L726

skills/video-frames/scripts/frame.shView file

•path = skills/video-frames/scripts/frame.sh kind = build_helper sizeBytes = 1347 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/video-frames/scripts/frame.shView on unpkg

dist/extensions/diffs/assets/viewer-runtime.jsView file

•path = [redacted]-runtime.js kind = oversized_source_file sizeBytes = 9867326 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/extensions/diffs/assets/viewer-runtime.jsView on unpkg

docs/install/macos-vm.mdView file

219patternName = generic_password severity = medium line = 219 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in docs/install/macos-vm.md

docs/install/macos-vm.mdView on unpkg · L219

docs/help/faq.mdView file

2691patternName = generic_password severity = medium line = 2691 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in docs/help/faq.md

docs/help/faq.mdView on unpkg · L2691

docs/gateway/tailscale.mdView file

90patternName = generic_password severity = medium line = 90 matchedText = auth: { ..." },

Medium

Secret Pattern

Hardcoded password in docs/gateway/tailscale.md

docs/gateway/tailscale.mdView on unpkg · L90

docs/gateway/configuration-reference.mdView file

714patternName = generic_password severity = medium line = 714 matchedText = password...D}",

Medium

Secret Pattern

Hardcoded password in docs/gateway/configuration-reference.md

docs/gateway/configuration-reference.mdView on unpkg · L714

2843patternName = generic_password severity = medium line = 2843 matchedText = // passw...WORD

Medium

Secret Pattern

Hardcoded password in docs/gateway/configuration-reference.md

docs/gateway/configuration-reference.mdView on unpkg · L2843

2870patternName = generic_password severity = medium line = 2870 matchedText = // passw...rd",

Medium

Secret Pattern

Hardcoded password in docs/gateway/configuration-reference.md

docs/gateway/configuration-reference.mdView on unpkg · L2870

docs/channels/bluebubbles.mdView file

46patternName = generic_password severity = medium line = 46 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in docs/channels/bluebubbles.md

docs/channels/bluebubbles.mdView on unpkg · L46

docs/channels/matrix.mdView file

140patternName = generic_password severity = medium line = 140 matchedText = password...cret

Medium

Secret Pattern

Hardcoded password in docs/channels/matrix.md

docs/channels/matrix.mdView on unpkg · L140

docs/channels/irc.mdView file

203patternName = generic_password severity = medium line = 203 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in docs/channels/irc.md

docs/channels/irc.mdView on unpkg · L203

Source & flagged code

14 flagged

package.jsonView file

Lines 1080-1120json

1080 "lint:fix": "node scripts/run-oxlint.mjs --fix && pnpm format",

1081 "lint:plugins:no-extension-imports": "node scripts/check-plugin-extension-import-boundary.mjs",

1082 "lint:plugins:no-extension-src-imports": "node --import tsx scripts/check-no-extension-src-imports.ts",

1083 "lint:plugins:no-extension-test-core-imports": "node --import tsx scripts/check-no-extension-test-core-imports.ts",

1084 "lint:plugins:no-monolithic-plugin-sdk-entry-imports": "node --import tsx scripts/check-no-monolithic-plugin-sdk-entry-imports.ts",

1085 "lint:plugins:no-register-http-handler": "node scripts/check-no-register-http-handler.mjs",

1086 "lint:plugins:plugin-sdk-subpaths-exported": "node scripts/check-plugin-sdk-subpath-exports.mjs",

1087 "lint:tmp:channel-agnostic-boundaries": "node scripts/check-channel-agnostic-boundaries.mjs",

1088 "lint:tmp:no-random-messaging": "node scripts/check-no-random-messaging-tmp.mjs",

1089 "lint:tmp:no-raw-channel-fetch": "node scripts/check-no-raw-channel-fetch.mjs",

1090 "lint:ui:no-raw-window-open": "node scripts/check-no-raw-window-open.mjs",

1091 "lint:web-fetch-provider-boundaries": "node scripts/check-web-fetch-provider-boundaries.mjs",

1092 "lint:web-search-provider-boundaries": "node scripts/check-web-search-provider-boundaries.mjs",

1093 "lint:webhook:no-low-level-body-read": "node scripts/check-webhook-auth-body-order.mjs",

1094 "plugin-sdk:api:check": "node --import tsx scripts/generate-plugin-sdk-api-baseline.ts --check",

1095 "plugin-sdk:api:gen": "node --import tsx scripts/generate-plugin-sdk-api-baseline.ts --write",

1096 "plugin-sdk:check-exports": "node scripts/sync-plugin-sdk-exports.mjs --check",

1097 "plugin-sdk:sync-exports": "node scripts/sync-plugin-sdk-exports.mjs",

1098 "plugin-sdk:usage": "node --import tsx scripts/analyze-plugin-sdk-usage.ts",

1099 "plugins:sync": "node --import tsx scripts/sync-plugin-versions.ts",

1100 "postinstall": "node scripts/postinstall-bundled-plugins.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L1100

1101 "prepack": "node --import tsx scripts/kaijibot-prepack.ts",

1102 "prepare": "command -v git >/dev/null 2>&1 && git rev-parse --is-inside-work-tree >/dev/null 2>&1 && git config core.hooksPath git-hooks || exit 0",

1103 "protocol:gen": "node --import tsx scripts/protocol-gen.ts",

1104 "runtime-sidecars:check": "node --import tsx scripts/generate-runtime-sidecar-paths-baseline.ts --check",

1105 "runtime-sidecars:gen": "node --import tsx scripts/generate-runtime-sidecar-paths-baseline.ts --write",

1106 "stage:bundled-plugin-runtime-deps": "node scripts/stage-bundled-plugin-runtime-deps.mjs",

1107 "start": "node scripts/run-node.mjs",

1108 "test": "node scripts/test-projects.mjs",

1109 "test:auth:compat": "node scripts/run-vitest.mjs run --config vitest/vitest.gateway.config.ts src/gateway/server.auth.compat-baseline.test.ts src/gateway/client.test.ts src/gateway/reconnect-gating.test.ts src/gateway/protocol/connect-error-details.test.ts",

1110 "test:build:singleton": "node scripts/test-built-plugin-singleton.mjs",

1111 "test:bundled": "node scripts/run-vitest.mjs run --config vitest/vitest.bundled.config.ts",

1112 "test:changed": "node scripts/test-projects.mjs --changed origin/main",

1113 "test:changed:max": "KAIJIBOT_VITEST_MAX_WORKERS=8 node scripts/test-projects.mjs --changed origin/main",

1114 "test:channels": "node scripts/run-vitest.mjs run --config vitest/vitest.channels.config.ts",

1115 "test:contracts": "pnpm test:contracts:channels && pnpm test:contracts:plugins",

1116 "test:contracts:channels": "node scripts/run-vitest.mjs run --config vitest/vitest.contracts.config.ts --maxWorkers=1 src/channels/plugins/contracts",

1117 "test:contracts:plugins": "node scripts/run-vitest.mjs run --config vitest/vitest.contracts.config.ts --maxWorkers=1 src/plugins/contracts",

1118 "test:coverage": "node scripts/run-vitest.mjs run --config vitest/vitest.unit.config.ts --coverage",

1119 "test:coverage:changed": "node scripts/run-vitest.mjs run --config vitest/vitest.unit.config.ts --coverage --changed origin/main",

1120 "test:e2e": "node scripts/run-vitest.mjs run --config vitest/vitest.e2e.config.ts",

kaijibot.mjsView file

Lines 54-94javascript

54 if (!isModuleNotFoundError(err)) {

55 return false;

56 }

57

58 const expectedUrl = new URL(specifier,

dist/tui-BAZYymTj.jsView file

Lines 706-746javascript

706 this.addChild(new Text(theme.header(`BTW: ${params.question}`), 1, 0));

707 if (params.isError) this.addChild

skills/video-frames/scripts/frame.shView file

•path = skills/video-frames/scripts/frame.sh kind = build_helper sizeBytes = 1347 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/video-frames/scripts/frame.shView on unpkg

dist/extensions/diffs/assets/viewer-runtime.jsView file

•path = [redacted]-runtime.js kind = oversized_source_file sizeBytes = 9867326 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/extensions/diffs/assets/viewer-runtime.jsView on unpkg

docs/install/macos-vm.mdView file

Lines 199-239markdown

199---

200

201## Bonus: iMessage integration

202

203This is the killer feature of running on macOS. Use [BlueBubbles](https://bluebubbles.app) to add iMessage to KaijiBot.

204

205Inside the VM:

206

2071. Download BlueBubbles from bluebubbles.app

2082. Sign in with your Apple ID

2093. Enable the Web API and set a password

2104. Point BlueBubbles webhooks at your gateway (example

docs/help/faq.mdView file

Lines 2671-2711markdown

2671

2672 </Accordion>

2673

2674 <Accordion title='What does "another gateway instance is already listening" mean?'>

2675 KaijiBot enforces a runtime lock by binding the WebSocket listener immediately on startup (default `ws://127.0.0.1:18789`). If the bind fails with `EADDRINUSE`, it throws `GatewayLockError` indicating another instance is already listening.

2676

2677 Fix: stop the other instance, free the port, or run with `kaijibot gateway --port <port>`.

2678

2679

docs/gateway/tailscale.mdView file

Lines 70-110markdown

70 bind: "tailnet",

71 auth: { mode: "token", token: "your-token" },

72 },

73}

74```

75

76Connect from another Tailnet device:

77

78- Control UI: `http://<tailscale-ip>:18789/`

79- WebSocket: `ws://<tailscale-ip>:18789`

80

81Note: loopback (`http://127.0.0.1:18789`) will **not** work in this mode.

docs/gateway/configuration-reference.mdView file

Lines 694-734markdown

694}

695```

696

697- Core key paths covered here: `channels.msteams`, `channels.msteams.configWrites`.

698- Full Teams config (credentials, webhook, DM/group policy, per-team/per-channel overrides) is documented in [Microsoft Teams](/channels/msteams).

699

700### IRC

701

702IRC is extension-backed and configured under `channels.irc`.

703

704```json5

705{

docs/channels/bluebubbles.mdView file

46patternName = generic_password severity = medium line = 46 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in docs/channels/bluebubbles.md

docs/channels/bluebubbles.mdView on unpkg · L46

docs/channels/matrix.mdView file

140patternName = generic_password severity = medium line = 140 matchedText = password...cret

Medium

Secret Pattern

Hardcoded password in docs/channels/matrix.md

docs/channels/matrix.mdView on unpkg · L140

docs/channels/irc.mdView file

203patternName = generic_password severity = medium line = 203 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in docs/channels/irc.md

docs/channels/irc.mdView on unpkg · L203