Loading npm security reports…

kaijibot@2026.8.1-1: AI-agent control-surface risk | LPM Firewall

registry / kaijibot / 2026.8.1-1

kaijibot@2026.8.1-1

Proactive cognitive AI assistant with Feishu/WeChat integration — learns user interests, pushes cross-domain insights, evolves skills, self-corrects. 40+ LLM providers, runs on cloud/desktop/Android.

AI Security Review

scanned 14d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation automatically fetches and installs Lark CLI skills into the user's global AI-agent skills directory. This is external code/configuration mutation beyond the package's own directory.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall

Impact

Adds third-party skills to ~/.agents/skills, affecting compatible AI-agent behavior.

Mechanism

unconsented npx global AI-agent skill installation

Policy narrative

On npm postinstall, the package runs scripts/postinstall-bundled-plugins.mjs. Its main-module block unconditionally calls installLarkCliSkills(), unless an opt-out environment variable is already set. That function runs npx to fetch and globally add all larksuite/cli skills to ~/.agents/skills, mutating a foreign, broad AI-agent control surface without an explicit user command or consent.

Rationale

Source confirms an unconsented postinstall mutation of a foreign AI-agent control surface via externally fetched code. This meets the install-control-surface blocking boundary.

Evidence

package.jsonscripts/postinstall-bundled-plugins.mjs

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/server.impl-t90hAoEA.jsView file

52import { n as pickPrimaryTailnetIPv4, r as pickPrimaryTailnetIPv6 } from "./tailnet-CnNMeiA8.js"; L53: import { _ as resolveRequestClientIp, a as isLoopbackHost, g as resolveHostName, h as resolveGatewayListenHosts, i as isLoopbackAddress, l as isTrustedProxyAddress, m as resolveGat... L54: import { c as AUTH_RATE_LIMIT_SCOPE_DEVICE_TOKEN, d as createAuthRateLimiter, f as normalizeRateLimitClientIp, i as isLocalDirectRequest, l as AUTH_RATE_LIMIT_SCOPE_HOOK_AUTH, n as... ... L67: import { i as resolveAssistantAvatarUrl, n as buildControlUiAvatarUrl, r as normalizeControlUiBasePath, t as CONTROL_UI_AVATAR_PREFIX } from "./control-ui-shared-CRsHhyOY.js"; L68: import { $ as [redacted], Dt as validateSecretsResolveResult, Et as validateSecretsResolveParams, Q as validateExecApprovalGetPar

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/server.impl-t90hAoEA.jsView on unpkg · L52

215import path, { join } from "node:path"; L216: import { execFile, spawn } from "node:child_process"; L217: import os, { homedir, networkInterfaces } from "node:os";

High

Child Process

Package source references child process execution.

dist/server.impl-t90hAoEA.jsView on unpkg · L215

67import { i as resolveAssistantAvatarUrl, n as buildControlUiAvatarUrl, r as normalizeControlUiBasePath, t as CONTROL_UI_AVATAR_PREFIX } from "./control-ui-shared-CRsHhyOY.js"; L68: import { $ as [redacted], Dt as validateSecretsResolveResult, Et as validateSecretsResolveParams, Q as validateExecApprovalGetParams, R as validateConnectPar... L69: import { o as verifyDeviceSignature, r as [redacted], t as deriveDeviceIdFromPublicKey } from "./device-identity-D81Ge-ss.js";

High

Shell

Package source references shell execution.

dist/server.impl-t90hAoEA.jsView on unpkg · L67

52Cross-file remote execution chain: dist/server.impl-t90hAoEA.js spawns dist/pi-embedded-runner-CX-Eq8M_.js; helper contains network access plus dynamic code execution. L52: import { n as pickPrimaryTailnetIPv4, r as pickPrimaryTailnetIPv6 } from "./tailnet-CnNMeiA8.js"; L53: import { _ as resolveRequestClientIp, a as isLoopbackHost, g as resolveHostName, h as resolveGatewayListenHosts, i as isLoopbackAddress, l as isTrustedProxyAddress, m as resolveGat... L54: import { c as AUTH_RATE_LIMIT_SCOPE_DEVICE_TOKEN, d as createAuthRateLimiter, f as normalizeRateLimitClientIp, i as isLocalDirectRequest, l as AUTH_RATE_LIMIT_SCOPE_HOOK_AUTH, n as... ... L67: import { i as resolveAssistantAvatarUrl, n as buildControlUiAvatarUrl, r as normalizeControlUiBasePath, t as CONTROL_UI_AVATAR_PREFIX } from "

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/server.impl-t90hAoEA.jsView on unpkg · L52

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.1 matchedPath = dist/server.impl-t90hAoEA.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server.impl-t90hAoEA.jsView on unpkg

233function [redacted]() { L234: [redacted] ??= import("./exec-approval-forwarder.runtime-DfWfZR8H.js"); L235: return [redacted];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server.impl-t90hAoEA.jsView on unpkg · L233

skills/video-frames/scripts/frame.shView file

•path = skills/video-frames/scripts/frame.sh kind = build_helper sizeBytes = 1347 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/video-frames/scripts/frame.shView on unpkg

dist/extensions/diffs/assets/viewer-runtime.jsView file

•path = [redacted]-runtime.js kind = oversized_source_file sizeBytes = 9867326 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/extensions/diffs/assets/viewer-runtime.jsView on unpkg

dist/launchd-Cm2E2m_1.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.1 matchedPath = dist/launchd-Cm2E2m_1.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/launchd-Cm2E2m_1.jsView on unpkg

dist/prompt-select-styled-BsbR3Yn-.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.1 matchedPath = dist/prompt-select-styled-BsbR3Yn-.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/prompt-select-styled-BsbR3Yn-.jsView on unpkg

dist/clawhub-Br81or9N.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.1 matchedPath = dist/clawhub-Br81or9N.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/clawhub-Br81or9N.jsView on unpkg

dist/schtasks-B69xcxhh.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.1 matchedPath = dist/schtasks-B69xcxhh.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/schtasks-B69xcxhh.jsView on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 1084-1124json

1084 "lint:fix": "node scripts/run-oxlint.mjs --fix && pnpm format",

1085 "lint:plugins:no-extension-imports": "node scripts/check-plugin-extension-import-boundary.mjs",

1086 "lint:plugins:no-extension-src-imports": "node --import tsx scripts/check-no-extension-src-imports.ts",

1087 "lint:plugins:no-extension-test-core-imports": "node --import tsx scripts/check-no-extension-test-core-imports.ts",

1088 "lint:plugins:no-monolithic-plugin-sdk-entry-imports": "node --import tsx scripts/check-no-monolithic-plugin-sdk-entry-imports.ts",

1089 "lint:plugins:no-register-http-handler": "node scripts/check-no-register-http-handler.mjs",

1090 "lint:plugins:plugin-sdk-subpaths-exported": "node scripts/check-plugin-sdk-subpath-exports.mjs",

1091 "lint:tmp:channel-agnostic-boundaries": "node scripts/check-channel-agnostic-boundaries.mjs",

1092 "lint:tmp:no-random-messaging": "node scripts/check-no-random-messaging-tmp.mjs",

1093 "lint:tmp:no-raw-channel-fetch": "node scripts/check-no-raw-channel-fetch.mjs",

1094 "lint:ui:no-raw-window-open": "node scripts/check-no-raw-window-open.mjs",

1095 "lint:web-fetch-provider-boundaries": "node scripts/check-web-fetch-provider-boundaries.mjs",

1096 "lint:web-search-provider-boundaries": "node scripts/check-web-search-provider-boundaries.mjs",

1097 "lint:webhook:no-low-level-body-read": "node scripts/check-webhook-auth-body-order.mjs",

1098 "plugin-sdk:api:check": "node --import tsx scripts/generate-plugin-sdk-api-baseline.ts --check",

1099 "plugin-sdk:api:gen": "node --import tsx scripts/generate-plugin-sdk-api-baseline.ts --write",

1100 "plugin-sdk:check-exports": "node scripts/sync-plugin-sdk-exports.mjs --check",

1101 "plugin-sdk:sync-exports": "node scripts/sync-plugin-sdk-exports.mjs",

1102 "plugin-sdk:usage": "node --import tsx scripts/analyze-plugin-sdk-usage.ts",

1103 "plugins:sync": "node --import tsx scripts/sync-plugin-versions.ts",

1104 "postinstall": "node scripts/postinstall-bundled-plugins.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L1104

1105 "prepack": "node --import tsx scripts/kaijibot-prepack.ts",

1106 "prepare": "command -v git >/dev/null 2>&1 && git rev-parse --is-inside-work-tree >/dev/null 2>&1 && git config core.hooksPath git-hooks || exit 0",

1107 "protocol:gen": "node --import tsx scripts/protocol-gen.ts",

1108 "runtime-sidecars:check": "node --import tsx scripts/generate-runtime-sidecar-paths-baseline.ts --check",

1109 "runtime-sidecars:gen": "node --import tsx scripts/generate-runtime-sidecar-paths-baseline.ts --write",

1110 "stage:bundled-plugin-runtime-deps": "node scripts/stage-bundled-plugin-runtime-deps.mjs",

1111 "start": "node scripts/run-node.mjs",

1112 "test": "node scripts/test-projects.mjs",

1113 "test:auth:compat": "node scripts/run-vitest.mjs run --config vitest/vitest.gateway.config.ts src/gateway/server.auth.compat-baseline.test.ts src/gateway/client.test.ts src/gateway/reconnect-gating.test.ts src/gateway/protocol/connect-error-details.test.ts",

1114 "test:build:singleton": "node scripts/test-built-plugin-singleton.mjs",

1115 "test:bundled": "node scripts/run-vitest.mjs run --config vitest/vitest.bundled.config.ts",

1116 "test:changed": "node scripts/test-projects.mjs --changed origin/main",

1117 "test:changed:max": "KAIJIBOT_VITEST_MAX_WORKERS=8 node scripts/test-projects.mjs --changed origin/main",

1118 "test:channels": "node scripts/run-vitest.mjs run --config vitest/vitest.channels.config.ts",

1119 "test:contracts": "pnpm test:contracts:channels && pnpm test:contracts:plugins",

1120 "test:contracts:channels": "node scripts/run-vitest.mjs run --config vitest/vitest.contracts.config.ts --maxWorkers=1 src/channels/plugins/contracts",

1121 "test:contracts:plugins": "node scripts/run-vitest.mjs run --config vitest/vitest.contracts.config.ts --maxWorkers=1 src/plugins/contracts",

1122 "test:coverage": "node scripts/run-vitest.mjs run --config vitest/vitest.unit.config.ts --coverage",

1123 "test:coverage:changed": "node scripts/run-vitest.mjs run --config vitest/vitest.unit.config.ts --coverage --changed origin/main",

1124 "test:e2e": "node scripts/run-vitest.mjs run --config vitest/vitest.e2e.config.ts",

dist/server.impl-t90hAoEA.jsView file

52import { n as pickPrimaryTailnetIPv4, r as pickPrimaryTailnetIPv6 } from "./tailnet-CnNMeiA8.js"; L53: import { _ as resolveRequestClientIp, a as isLoopbackHost, g as resolveHostName, h as resolveGatewayListenHosts, i as isLoopbackAddress, l as isTrustedProxyAddress, m as resolveGat... L54: import { c as AUTH_RATE_LIMIT_SCOPE_DEVICE_TOKEN, d as createAuthRateLimiter, f as normalizeRateLimitClientIp, i as isLocalDirectRequest, l as AUTH_RATE_LIMIT_SCOPE_HOOK_AUTH, n as... ... L67: import { i as resolveAssistantAvatarUrl, n as buildControlUiAvatarUrl, r as normalizeControlUiBasePath, t as CONTROL_UI_AVATAR_PREFIX } from "./control-ui-shared-CRsHhyOY.js"; L68: import { $ as [redacted], Dt as validateSecretsResolveResult, Et as validateSecretsResolveParams, Q as validateExecApprovalGetPar

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/server.impl-t90hAoEA.jsView on unpkg · L52

215import path, { join } from "node:path"; L216: import { execFile, spawn } from "node:child_process"; L217: import os, { homedir, networkInterfaces } from "node:os";

High

Child Process

Package source references child process execution.

dist/server.impl-t90hAoEA.jsView on unpkg · L215

67import { i as resolveAssistantAvatarUrl, n as buildControlUiAvatarUrl, r as normalizeControlUiBasePath, t as CONTROL_UI_AVATAR_PREFIX } from "./control-ui-shared-CRsHhyOY.js"; L68: import { $ as [redacted], Dt as validateSecretsResolveResult, Et as validateSecretsResolveParams, Q as validateExecApprovalGetParams, R as validateConnectPar... L69: import { o as verifyDeviceSignature, r as [redacted], t as deriveDeviceIdFromPublicKey } from "./device-identity-D81Ge-ss.js";

skills/video-frames/scripts/frame.shView file

•path = skills/video-frames/scripts/frame.sh kind = build_helper sizeBytes = 1347 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/video-frames/scripts/frame.shView on unpkg

dist/extensions/diffs/assets/viewer-runtime.jsView file

•path = [redacted]-runtime.js kind = oversized_source_file sizeBytes = 9867326 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/extensions/diffs/assets/viewer-runtime.jsView on unpkg

dist/launchd-Cm2E2m_1.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.1 matchedPath = dist/launchd-Cm2E2m_1.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/launchd-Cm2E2m_1.jsView on unpkg

dist/prompt-select-styled-BsbR3Yn-.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.1 matchedPath = dist/prompt-select-styled-BsbR3Yn-.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/prompt-select-styled-BsbR3Yn-.jsView on unpkg

dist/clawhub-Br81or9N.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.1 matchedPath = dist/clawhub-Br81or9N.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/clawhub-Br81or9N.jsView on unpkg

dist/schtasks-B69xcxhh.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.1 matchedPath = dist/schtasks-B69xcxhh.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/schtasks-B69xcxhh.jsView on unpkg