Loading npm security reports…

kaijibot@2026.7.27-1: AI-agent control-surface risk | LPM Firewall

registry / kaijibot / 2026.7.27-1

kaijibot@2026.7.27-1

Proactive cognitive AI assistant with Feishu/WeChat integration — learns user interests, pushes cross-domain insights, evolves skills, self-corrects. 40+ LLM providers, runs on cloud/desktop/Android.

AI Security Review

scanned 20d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall automatically installs third-party Lark CLI skills into the user's global ~/.agents/skills directory. This mutates a broad AI-agent control surface and executes an external npx command without an explicit user command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install of kaijibot

Impact

Unconsented installation of third-party agent instructions/capabilities that other agents may discover and load.

Mechanism

postinstall-driven global AI-agent skill installation via npx

Policy narrative

Installing the package runs its postinstall hook. The hook calls npx to add all larksuite/cli skills globally, writing lark-* SKILL.md directories under ~/.agents/skills unless a user already set an opt-out variable. This changes a generic agent skill discovery surface outside the package without an explicit setup command.

Rationale

Source confirms an unconsented postinstall mutation of a foreign, broad AI-agent control surface. README disclosure and an opt-out do not change that automatic install-time behavior.

Evidence

package.jsonscripts/postinstall-bundled-plugins.mjsREADME.md~/.agents/skills/

Decision evidence

public snapshot

AI identified this as a at 99.0% confidence with false-positive risk.

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/launchd-Cm2E2m_1.jsView file

8import path from "node:path"; L9: import { spawn } from "node:child_process"; L10: import os from "node:os";

High

Child Process

Package source references child process execution.

dist/launchd-Cm2E2m_1.jsView on unpkg · L8

186const isWindows = process.platform === "win32"; L187: return await execFileUtf8(isWindows ? process.env.ComSpec ?? "cmd.exe" : "launchctl", isWindows ? [ L188: "/d",

High

Shell

Package source references shell execution.

dist/launchd-Cm2E2m_1.jsView on unpkg · L186

8import path from "node:path"; L9: import { spawn } from "node:child_process"; L10: import os from "node:os"; ... L44: } L45: function buildLaunchAgentPlist$1({ label, comment, programArguments, workingDirectory, stdoutPath, stderrPath, environment }) { L46: const argsXml = programArguments.map((arg) => `\n <string>${plistEscape(arg)}</string>`).join(""); ... L62: } L63: function resolveLaunchdRestartTarget(env = process.env) { L64: const domain = resolveGuiDomain$1(); L65: const label = resolveLaunchAgentLabel$1(env); L66: const home = normalizeOptionalString(env.HOME) || os.homedir(); L67: return {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/launchd-Cm2E2m_1.jsView on unpkg · L8

dist/lib-BzmkYLE-.jsView file

426`]; L427: if (k = new Function(...yb, zb)(...z), p = Object.defineProperty(k, "name", { value: p }), k = b - 1, !g.hasOwnProperty(l)) throw new Va("Replacing nonexistent public symbol"); L428: return g[l].F !== void 0 && k !== void 0 ? g[l].F[k] = p : (g[l] = p, g[l].J = k), [];

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/lib-BzmkYLE-.jsView on unpkg · L426

dist/control-ui/assets/index-APrZoXsA.jsView file

911contains invisible/control Unicode U+200D (zero width joiner) `}var Ug=50,Wg=class{constructor(){this.items=[],this.cursor=-1}push(e){let t=e.trim();t&&this.items[this.items.length-1]!==t&&(this.items.push(t),this.items.length>Ug&&this.items.shift(),this.cursor=-1)}up(){return this.items.length===0?

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-APrZoXsA.jsView on unpkg · L911

912`);return M(t,-1)?``:e.slice(t)}function LS(e){return e.replace(/^[ \t\r\f\v]+/,``)}function RS(e){let t=LS(e);return t.startsWith(NS)?RS(FS(t.slice(2))):t.startsWith(MS)?RS(IS(t.s... L913: `)?BS(e,RS(t)):e.startsWith(` `)?BS(e,t):BS(e,zS(t))}[...[...AS,`_`,`$`],...jS],[...jS];function HS(e){return M(e,``)?[]:[e.slice(0,1),e.slice(1)]}function US(e,t){return N(e,(e,n)... L914: \r `.includes(e[o]);)o++};return l()};e.parse=o}))(),rj=new Set([`"`,`\\`,`/`,`b`,`f`,`n`,`r`,`t`,`u`]);function ij(e){let t=e.codePointAt(0);return t!==void 0&&t>=0&&t<=31}functio...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/control-ui/assets/index-APrZoXsA.jsView on unpkg · L912

dist/send-media-B83jl2SG.jsView file

12import fs$1 from "node:fs/promises"; L13: import crypto, { createCipheriv, createDecipheriv } from "node:crypto"; L14: //#region [redacted]-dir.ts ... L16: function resolveStateDir() { L17: return process.env.KAIJIBOT_STATE_DIR?.trim() || path.join(os.homedir(), ".kaijibot"); L18: } ... L29: const RUNTIME_VERSION = process.versions.node; L30: const HOSTNAME = os.hostname() || "unknown"; L31: const PARENT_NAMES = ["kaijibot", "node"]; ... L166: //#region [redacted].ts L167: const DEFAULT_BASE_URL = "https://ilinkai.weixin.qq.com"; L168: /**

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/send-media-B83jl2SG.jsView on unpkg · L12

dist/server.impl-DH6C17b7.jsView file

52Cross-file remote execution chain: dist/server.impl-DH6C17b7.js spawns dist/pi-embedded-runner-s_MvmYBn.js; helper contains network access plus dynamic code execution. L52: import { n as pickPrimaryTailnetIPv4, r as pickPrimaryTailnetIPv6 } from "./tailnet-CnNMeiA8.js"; L53: import { _ as resolveRequestClientIp, a as isLoopbackHost, g as resolveHostName, h as resolveGatewayListenHosts, i as isLoopbackAddress, l as isTrustedProxyAddress, m as resolveGat... L54: import { c as AUTH_RATE_LIMIT_SCOPE_DEVICE_TOKEN, d as createAuthRateLimiter, f as normalizeRateLimitClientIp, i as isLocalDirectRequest, l as AUTH_RATE_LIMIT_SCOPE_HOOK_AUTH, n as... ... L67: import { i as resolveAssistantAvatarUrl, n as buildControlUiAvatarUrl, r as normalizeControlUiBasePath, t as CONTROL_UI_AVATAR_PREFIX } from "

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/server.impl-DH6C17b7.jsView on unpkg · L52

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.7.23-3 matchedPath = dist/server.impl-CSdog55U.js matchedIdentity = npm:a2Fpamlib3Q:2026.7.23-3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server.impl-DH6C17b7.jsView on unpkg

skills/video-frames/scripts/frame.shView file

•path = skills/video-frames/scripts/frame.sh kind = build_helper sizeBytes = 1347 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/video-frames/scripts/frame.shView on unpkg

dist/extensions/diffs/assets/viewer-runtime.jsView file

•path = [redacted]-runtime.js kind = oversized_source_file sizeBytes = 9867326 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/extensions/diffs/assets/viewer-runtime.jsView on unpkg

dist/lancedb-runtime-Dg2oHA5N.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.7.25 matchedPath = dist/lancedb-runtime-Dg2oHA5N.js matchedIdentity = npm:a2Fpamlib3Q:2026.7.25 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lancedb-runtime-Dg2oHA5N.jsView on unpkg

dist/node-cli-DjwBjZC9.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.7.25 matchedPath = dist/node-cli-CK_agxH5.js matchedIdentity = npm:a2Fpamlib3Q:2026.7.25 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/node-cli-DjwBjZC9.jsView on unpkg

dist/audit.nondeep.runtime-B3wdTKZu.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.7.23-3 matchedPath = dist/audit.nondeep.runtime-DjqTpQ13.js matchedIdentity = npm:a2Fpamlib3Q:2026.7.23-3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/audit.nondeep.runtime-B3wdTKZu.jsView on unpkg

dist/skill-scanner-DKAsyxUz.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.7.25 matchedPath = dist/sk[redacted] matchedIdentity = npm:a2Fpamlib3Q:2026.7.25 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/skill-scanner-DKAsyxUz.jsView on unpkg