kaijibot@2026.7.5-6: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

kaijibot@2026.7.5-6: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/control-ui/assets/index-T9pDybqW.jsView file

973contains invisible/control Unicode U+200D (zero width joiner) `}var Ky=50,qy=class{constructor(){this.items=[],this.cursor=-1}push(e){let t=e.trim();t&&this.items[this.items.length-1]!==t&&(this.items.push(t),this.items.length>Ky&&this.items.shift(),this.cursor=-1)}up(){return this.items.length===0?

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-T9pDybqW.jsView on unpkg · L973

974`);return F(t,-1)?``:e.slice(t)}function BT(e){return e.replace(/^[ \t\r\f\v]+/,``)}function VT(e){let t=BT(e);return t.startsWith(IT)?VT(RT(t.slice(2))):t.startsWith(FT)?VT(zT(t.s... L975: `)?UT(e,VT(t)):e.startsWith(` `)?UT(e,t):UT(e,HT(t))}[...[...NT,`_`,`$`],...PT],[...PT];function GT(e){return F(e,``)?[]:[e.slice(0,1),e.slice(1)]}function KT(e,t){return I(e,(e,n)... L976: \r `.includes(e[o]);)o++};return l()};e.parse=o}))(),cP=new Set([`"`,`\\`,`/`,`b`,`f`,`n`,`r`,`t`,`u`]);function lP(e){let t=e.codePointAt(0);return t!==void 0&&t>=0&&t<=31}functio...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/control-ui/assets/index-T9pDybqW.jsView on unpkg · L974

skills/video-frames/scripts/frame.shView file

•path = skills/video-frames/scripts/frame.sh kind = build_helper sizeBytes = 1347 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/video-frames/scripts/frame.shView on unpkg

dist/extensions/diffs/assets/viewer-runtime.jsView file

•path = [redacted]-runtime.js kind = oversized_source_file sizeBytes = 9867326 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/extensions/diffs/assets/viewer-runtime.jsView on unpkg

docs/install/macos-vm.mdView file

219patternName = generic_password severity = medium line = 219 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in docs/install/macos-vm.md

docs/install/macos-vm.mdView on unpkg · L219

docs/help/faq.mdView file

2691patternName = generic_password severity = medium line = 2691 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in docs/help/faq.md

docs/help/faq.mdView on unpkg · L2691

docs/gateway/tailscale.mdView file

90patternName = generic_password severity = medium line = 90 matchedText = auth: { ..." },

Medium

Secret Pattern

Hardcoded password in docs/gateway/tailscale.md

docs/gateway/tailscale.mdView on unpkg · L90

docs/gateway/configuration-reference.mdView file

714patternName = generic_password severity = medium line = 714 matchedText = password...D}",

Medium

Secret Pattern

Hardcoded password in docs/gateway/configuration-reference.md

docs/gateway/configuration-reference.mdView on unpkg · L714

2843patternName = generic_password severity = medium line = 2843 matchedText = // passw...WORD

Medium

Secret Pattern

Hardcoded password in docs/gateway/configuration-reference.md

docs/gateway/configuration-reference.mdView on unpkg · L2843

2870patternName = generic_password severity = medium line = 2870 matchedText = // passw...rd",

Medium

Secret Pattern

Hardcoded password in docs/gateway/configuration-reference.md

docs/gateway/configuration-reference.mdView on unpkg · L2870

docs/channels/bluebubbles.mdView file

44patternName = generic_password severity = medium line = 44 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in docs/channels/bluebubbles.md

docs/channels/bluebubbles.mdView on unpkg · L44

docs/channels/matrix.mdView file

140patternName = generic_password severity = medium line = 140 matchedText = password...cret

Medium

Secret Pattern

Hardcoded password in docs/channels/matrix.md

docs/channels/matrix.mdView on unpkg · L140

docs/channels/irc.mdView file

203patternName = generic_password severity = medium line = 203 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in docs/channels/irc.md

docs/channels/irc.mdView on unpkg · L203

Source & flagged code

14 flagged

package.jsonView file

Lines 1080-1120json

1080 "lint:fix": "node scripts/run-oxlint.mjs --fix && pnpm format",

1081 "lint:plugins:no-extension-imports": "node scripts/check-plugin-extension-import-boundary.mjs",

1082 "lint:plugins:no-extension-src-imports": "node --import tsx scripts/check-no-extension-src-imports.ts",

1083 "lint:plugins:no-extension-test-core-imports": "node --import tsx scripts/check-no-extension-test-core-imports.ts",

1084 "lint:plugins:no-monolithic-plugin-sdk-entry-imports": "node --import tsx scripts/check-no-monolithic-plugin-sdk-entry-imports.ts",

1085 "lint:plugins:no-register-http-handler": "node scripts/check-no-register-http-handler.mjs",

1086 "lint:plugins:plugin-sdk-subpaths-exported": "node scripts/check-plugin-sdk-subpath-exports.mjs",

1087 "lint:tmp:channel-agnostic-boundaries": "node scripts/check-channel-agnostic-boundaries.mjs",

1088 "lint:tmp:no-random-messaging": "node scripts/check-no-random-messaging-tmp.mjs",

1089 "lint:tmp:no-raw-channel-fetch": "node scripts/check-no-raw-channel-fetch.mjs",

1090 "lint:ui:no-raw-window-open": "node scripts/check-no-raw-window-open.mjs",

1091 "lint:web-fetch-provider-boundaries": "node scripts/check-web-fetch-provider-boundaries.mjs",

1092 "lint:web-search-provider-boundaries": "node scripts/check-web-search-provider-boundaries.mjs",

1093 "lint:webhook:no-low-level-body-read": "node scripts/check-webhook-auth-body-order.mjs",

1094 "plugin-sdk:api:check": "node --import tsx scripts/generate-plugin-sdk-api-baseline.ts --check",

1095 "plugin-sdk:api:gen": "node --import tsx scripts/generate-plugin-sdk-api-baseline.ts --write",

1096 "plugin-sdk:check-exports": "node scripts/sync-plugin-sdk-exports.mjs --check",

1097 "plugin-sdk:sync-exports": "node scripts/sync-plugin-sdk-exports.mjs",

1098 "plugin-sdk:usage": "node --import tsx scripts/analyze-plugin-sdk-usage.ts",

1099 "plugins:sync": "node --import tsx scripts/sync-plugin-versions.ts",

1100 "postinstall": "node scripts/postinstall-bundled-plugins.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L1100

1101 "prepack": "node --import tsx scripts/kaijibot-prepack.ts",

1102 "prepare": "command -v git >/dev/null 2>&1 && git rev-parse --is-inside-work-tree >/dev/null 2>&1 && git config core.hooksPath git-hooks || exit 0",

1103 "protocol:gen": "node --import tsx scripts/protocol-gen.ts",

1104 "runtime-sidecars:check": "node --import tsx scripts/generate-runtime-sidecar-paths-baseline.ts --check",

1105 "runtime-sidecars:gen": "node --import tsx scripts/generate-runtime-sidecar-paths-baseline.ts --write",

1106 "stage:bundled-plugin-runtime-deps": "node scripts/stage-bundled-plugin-runtime-deps.mjs",

1107 "start": "node scripts/run-node.mjs",

1108 "test": "node scripts/test-projects.mjs",

1109 "test:auth:compat": "node scripts/run-vitest.mjs run --config vitest/vitest.gateway.config.ts src/gateway/server.auth.compat-baseline.test.ts src/gateway/client.test.ts src/gateway/reconnect-gating.test.ts src/gateway/protocol/connect-error-details.test.ts",

1110 "test:build:singleton": "node scripts/test-built-plugin-singleton.mjs",

1111 "test:bundled": "node scripts/run-vitest.mjs run --config vitest/vitest.bundled.config.ts",

1112 "test:changed": "node scripts/test-projects.mjs --changed origin/main",

1113 "test:changed:max": "KAIJIBOT_VITEST_MAX_WORKERS=8 node scripts/test-projects.mjs --changed origin/main",

1114 "test:channels": "node scripts/run-vitest.mjs run --config vitest/vitest.channels.config.ts",

1115 "test:contracts": "pnpm test:contracts:channels && pnpm test:contracts:plugins",

1116 "test:contracts:channels": "node scripts/run-vitest.mjs run --config vitest/vitest.contracts.config.ts --maxWorkers=1 src/channels/plugins/contracts",

1117 "test:contracts:plugins": "node scripts/run-vitest.mjs run --config vitest/vitest.contracts.config.ts --maxWorkers=1 src/plugins/contracts",

1118 "test:coverage": "node scripts/run-vitest.mjs run --config vitest/vitest.unit.config.ts --coverage",

1119 "test:coverage:changed": "node scripts/run-vitest.mjs run --config vitest/vitest.unit.config.ts --coverage --changed origin/main",

1120 "test:e2e": "node scripts/run-vitest.mjs run --config vitest/vitest.e2e.config.ts",

dist/control-ui/assets/index-T9pDybqW.jsView file

973contains invisible/control Unicode U+200D (zero width joiner) `}var Ky=50,qy=class{constructor(){this.items=[],this.cursor=-1}push(e){let t=e.trim();t&&this.items[this.items.length-1]!==t&&(this.items.push(t),this.items.length>Ky&&this.items.shift(),this.cursor=-1)}up(){return this.items.length===0?

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-T9pDybqW.jsView on unpkg · L973

974`);return F(t,-1)?``:e.slice(t)}function BT(e){return e.replace(/^[ \t\r\f\v]+/,``)}function VT(e){let t=BT(e);return t.startsWith(IT)?VT(RT(t.slice(2))):t.startsWith(FT)?VT(zT(t.s... L975: `)?UT(e,VT(t)):e.startsWith(` `)?UT(e,t):UT(e,HT(t))}[...[...NT,`_`,`$`],...PT],[...PT];function GT(e){return F(e,``)?[]:[e.slice(0,1),e.slice(1)]}function KT(e,t){return I(e,(e,n)... L976: \r `.includes(e[o]);)o++};return l()};e.parse=o}))(),cP=new Set([`"`,`\\`,`/`,`b`,`f`,`n`,`r`,`t`,`u`]);function lP(e){let t=e.codePointAt(0);return t!==void 0&&t>=0&&t<=31}functio...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/control-ui/assets/index-T9pDybqW.jsView on unpkg · L974

skills/video-frames/scripts/frame.shView file

•path = skills/video-frames/scripts/frame.sh kind = build_helper sizeBytes = 1347 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/video-frames/scripts/frame.shView on unpkg

dist/extensions/diffs/assets/viewer-runtime.jsView file

•path = [redacted]-runtime.js kind = oversized_source_file sizeBytes = 9867326 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/extensions/diffs/assets/viewer-runtime.jsView on unpkg

docs/install/macos-vm.mdView file

Lines 199-239markdown

199---

200

201## Bonus: iMessage integration

202

203This is the killer feature of running on macOS. Use [BlueBubbles](https://bluebubbles.app) to add iMessage to KaijiBot.

204

205Inside the VM:

206

2071. Download BlueBubbles from bluebubbles.app

2082. Sign in with your Apple ID

2093. Enable the Web API and set a password

2104. Point BlueBubbles webhooks at your gateway (example

docs/help/faq.mdView file

Lines 2671-2711markdown

2671

2672 </Accordion>

2673

2674 <Accordion title='What does "another gateway instance is already listening" mean?'>

2675 KaijiBot enforces a runtime lock by binding the WebSocket listener immediately on startup (default `ws://127.0.0.1:18789`). If the bind fails with `EADDRINUSE`, it throws `GatewayLockError` indicating another instance is already listening.

2676

2677 Fix: stop the other instance, free the port, or run with `kaijibot gateway --port <port>`.

2678

2679

docs/gateway/tailscale.mdView file

Lines 70-110markdown

70 bind: "tailnet",

71 auth: { mode: "token", token: "your-token" },

72 },

73}

74```

75

76Connect from another Tailnet device:

77

78- Control UI: `http://<tailscale-ip>:18789/`

79- WebSocket: `ws://<tailscale-ip>:18789`

80

81Note: loopback (`http://127.0.0.1:18789`) will **not** work in this mode.

docs/gateway/configuration-reference.mdView file

Lines 694-734markdown

694}

695```

696

697- Core key paths covered here: `channels.msteams`, `channels.msteams.configWrites`.

698- Full Teams config (credentials, webhook, DM/group policy, per-team/per-channel overrides) is documented in [Microsoft Teams](/channels/msteams).

699

700### IRC

701

702IRC is extension-backed and configured under `channels.irc`.

703

704```json5

705{

docs/channels/bluebubbles.mdView file

44patternName = generic_password severity = medium line = 44 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in docs/channels/bluebubbles.md

docs/channels/bluebubbles.mdView on unpkg · L44

docs/channels/matrix.mdView file

140patternName = generic_password severity = medium line = 140 matchedText = password...cret

Medium

Secret Pattern

Hardcoded password in docs/channels/matrix.md

docs/channels/matrix.mdView on unpkg · L140

docs/channels/irc.mdView file

203patternName = generic_password severity = medium line = 203 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in docs/channels/irc.md

docs/channels/irc.mdView on unpkg · L203