kaijibot@2026.8.21-1: AI-agent control-surface risk

Loading npm security reports…

kaijibot@2026.8.21-1: AI-agent control-surface risk | LPM Firewall

Source & flagged code

15 flagged

package.jsonView file

Lines 1084-1124json

1084 "lint:fix": "node scripts/run-oxlint.mjs --fix && pnpm format",

1085 "lint:plugins:no-extension-imports": "node scripts/check-plugin-extension-import-boundary.mjs",

1086 "lint:plugins:no-extension-src-imports": "node --import tsx scripts/check-no-extension-src-imports.ts",

1087 "lint:plugins:no-extension-test-core-imports": "node --import tsx scripts/check-no-extension-test-core-imports.ts",

1088 "lint:plugins:no-monolithic-plugin-sdk-entry-imports": "node --import tsx scripts/check-no-monolithic-plugin-sdk-entry-imports.ts",

1089 "lint:plugins:no-register-http-handler": "node scripts/check-no-register-http-handler.mjs",

1090 "lint:plugins:plugin-sdk-subpaths-exported": "node scripts/check-plugin-sdk-subpath-exports.mjs",

1091 "lint:tmp:channel-agnostic-boundaries": "node scripts/check-channel-agnostic-boundaries.mjs",

1092 "lint:tmp:no-random-messaging": "node scripts/check-no-random-messaging-tmp.mjs",

1093 "lint:tmp:no-raw-channel-fetch": "node scripts/check-no-raw-channel-fetch.mjs",

1094 "lint:ui:no-raw-window-open": "node scripts/check-no-raw-window-open.mjs",

1095 "lint:web-fetch-provider-boundaries": "node scripts/check-web-fetch-provider-boundaries.mjs",

1096 "lint:web-search-provider-boundaries": "node scripts/check-web-search-provider-boundaries.mjs",

1097 "lint:webhook:no-low-level-body-read": "node scripts/check-webhook-auth-body-order.mjs",

1098 "plugin-sdk:api:check": "node --import tsx scripts/generate-plugin-sdk-api-baseline.ts --check",

1099 "plugin-sdk:api:gen": "node --import tsx scripts/generate-plugin-sdk-api-baseline.ts --write",

1100 "plugin-sdk:check-exports": "node scripts/sync-plugin-sdk-exports.mjs --check",

1101 "plugin-sdk:sync-exports": "node scripts/sync-plugin-sdk-exports.mjs",

1102 "plugin-sdk:usage": "node --import tsx scripts/analyze-plugin-sdk-usage.ts",

1103 "plugins:sync": "node --import tsx scripts/sync-plugin-versions.ts",

1104 "postinstall": "node scripts/postinstall-bundled-plugins.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L1104

1105 "prepack": "node --import tsx scripts/kaijibot-prepack.ts",

1106 "prepare": "command -v git >/dev/null 2>&1 && git rev-parse --is-inside-work-tree >/dev/null 2>&1 && git config core.hooksPath git-hooks || exit 0",

1107 "protocol:gen": "node --import tsx scripts/protocol-gen.ts",

1108 "runtime-sidecars:check": "node --import tsx scripts/generate-runtime-sidecar-paths-baseline.ts --check",

1109 "runtime-sidecars:gen": "node --import tsx scripts/generate-runtime-sidecar-paths-baseline.ts --write",

1110 "stage:bundled-plugin-runtime-deps": "node scripts/stage-bundled-plugin-runtime-deps.mjs",

1111 "start": "node scripts/run-node.mjs",

1112 "test": "node scripts/test-projects.mjs",

1113 "test:auth:compat": "node scripts/run-vitest.mjs run --config vitest/vitest.gateway.config.ts src/gateway/server.auth.compat-baseline.test.ts src/gateway/client.test.ts src/gateway/reconnect-gating.test.ts src/gateway/protocol/connect-error-details.test.ts",

1114 "test:build:singleton": "node scripts/test-built-plugin-singleton.mjs",

1115 "test:bundled": "node scripts/run-vitest.mjs run --config vitest/vitest.bundled.config.ts",

1116 "test:changed": "node scripts/test-projects.mjs --changed origin/main",

1117 "test:changed:max": "KAIJIBOT_VITEST_MAX_WORKERS=8 node scripts/test-projects.mjs --changed origin/main",

1118 "test:channels": "node scripts/run-vitest.mjs run --config vitest/vitest.channels.config.ts",

1119 "test:contracts": "pnpm test:contracts:channels && pnpm test:contracts:plugins",

1120 "test:contracts:channels": "node scripts/run-vitest.mjs run --config vitest/vitest.contracts.config.ts --maxWorkers=1 src/channels/plugins/contracts",

1121 "test:contracts:plugins": "node scripts/run-vitest.mjs run --config vitest/vitest.contracts.config.ts --maxWorkers=1 src/plugins/contracts",

1122 "test:coverage": "node scripts/run-vitest.mjs run --config vitest/vitest.unit.config.ts --coverage",

1123 "test:coverage:changed": "node scripts/run-vitest.mjs run --config vitest/vitest.unit.config.ts --coverage --changed origin/main",

1124 "test:e2e": "node scripts/run-vitest.mjs run --config vitest/vitest.e2e.config.ts",

dist/resolve-B-YGj7MS.jsView file

Lines 1-23javascript

1import { i as __require } from "./chunk-CrysgU_F.js";

2import { existsSync } from "node:fs";

3import { basename, dirname, join } from "node:path";

4import { execSync } from

dist/extensions/diffs/node_modules/playwright-core/lib/tools/cli-client/program.jsView file

Lines 187-227javascript

187 cwd: process.cwd()

188 });

189 child.on("close", (code) => {

190 if (code === 0)

dist/extensions/diffs/node_modules/playwright-core/lib/generated/utilityScriptSource.js#virtual:normalized:round1View file

30/* virtual alias projection */ L31: eval("virtual")

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/extensions/diffs/node_modules/playwright-core/lib/generated/utilityScriptSource.js#virtual:normalized:round1View on unpkg · L30

dist/git-commit-C0NqDaJx.jsView file

Lines 68-108javascript

68 try {

69 const commonDir = safeReadFilePrefix(path.join(gitDir, "commondir")).trim();

70 if (commonDir) return path.resolve(gitDir, commonDir);

dist/extensions/diffs/node_modules/playwright-core/lib/utilsBundleImpl/index.jsView file

Lines 1-24javascript

1"use strict";var o_=Object.create;var bs=Object.defineProperty;var a_=Object.getOwnPropertyDescriptor;var l_=Object.getOwnPropertyNames;var c_=Object.getPrototypeOf,u_=Object.prototype

dist/control-ui/assets/index-BtNFbQhY.jsView file

923contains invisible/control Unicode U+200D (zero width joiner) `}var f_=50,p_=class{constructor(){this.items=[],this.cursor=-1}push(e){let t=e.trim();t&&this.items[this.items.length-1]!==t&&(this.items.push(t),this.items.length>f_&&this.items.shift(),this.cursor=-1)}up(){return this.items.length===0?

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-BtNFbQhY.jsView on unpkg · L923

dist/compact-DEsHFhEL.jsView file

32Cross-file remote execution chain: dist/compact-DEsHFhEL.js spawns dist/anthropic-vertex-stream-CrF-fPgb.js; helper contains network access plus dynamic code execution. L32: import { n as createInternalHookEvent, p as triggerInternalHook } from "./internal-hooks-kuG4QrrP.js"; L33: import { F as resolveProviderRuntimePlugin, G as [redacted], H as [redacted], J as validateProviderReplayTurnsWith... L34: import { c as updateSessionStore } from "./store-D_vXZ7m9.js"; ... L61: import { c as extractToolCallsFromAssistant, d as [redacted], f as downgradeOpenAIReasoningBlocks, h as ensureSessionHeader, l as extractToolResultId... L62: import { M as formatExecDeniedUserMessage, N as isExecDeniedResultText, P as parseExecApprovalResultText, S as sanitizeUserFacingText } from "./errors-CVtNPIIv.js";

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/compact-DEsHFhEL.jsView on unpkg · L32

dist/extensions/kindle-portal/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3View file

•path = dist/extensions/kindle-portal/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3 kind = native_binary sizeBytes = 16645008 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/extensions/kindle-portal/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3View on unpkg

dist/extensions/diffs/node_modules/shiki/dist/onig.wasmView file

•path = dist/extensions/diffs/node_modules/shiki/dist/onig.wasm kind = wasm_module sizeBytes = 466610 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/extensions/diffs/node_modules/shiki/dist/onig.wasmView on unpkg

skills/video-frames/scripts/frame.shView file

•path = skills/video-frames/scripts/frame.sh kind = build_helper sizeBytes = 1347 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/video-frames/scripts/frame.shView on unpkg

dist/extensions/diffs/assets/viewer-runtime.jsView file

•path = [redacted]-runtime.js kind = oversized_source_file sizeBytes = 9867326 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/extensions/diffs/assets/viewer-runtime.jsView on unpkg

dist/extensions/diffs/node_modules/diff/dist/diff.min.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 34

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/extensions/diffs/node_modules/diff/dist/diff.min.js#virtual:normalized:round1View on unpkg

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/resolve-B-YGj7MS.jsView file

3import { basename, dirname, join } from "node:path"; L4: import { execSync } from "node:child_process"; L5: //#region src/infra/lark-cli/resolve.ts

High

Child Process

Package source references child process execution.

dist/resolve-B-YGj7MS.jsView on unpkg · L3

dist/extensions/diffs/node_modules/playwright-core/lib/tools/cli-client/program.jsView file

207const result = (0, import_child_process.execSync)( L208: `powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_Process | Where-Object { $_.CommandLine -like '*run-mcp-server*' -or $_.CommandLine -like '*run-cli-server*' ... L209: { encoding: "utf-8" }

High

Shell

Package source references shell execution.

dist/extensions/diffs/node_modules/playwright-core/lib/tools/cli-client/program.jsView on unpkg · L207

dist/extensions/diffs/node_modules/playwright-core/lib/generated/utilityScriptSource.js#virtual:normalized:round1View file

30/* virtual alias projection */ L31: eval("virtual")

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/extensions/diffs/node_modules/playwright-core/lib/generated/utilityScriptSource.js#virtual:normalized:round1View on unpkg · L30

dist/git-commit-C0NqDaJx.jsView file

88try { L89: const pkg = createRequire(import.meta.url)("../../package.json"); L90: return formatCommit(pkg.gitHead ?? pkg.githead ?? null);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/git-commit-C0NqDaJx.jsView on unpkg · L88

dist/extensions/diffs/node_modules/playwright-core/lib/utilsBundleImpl/index.jsView file

4`+s),i.push(n+"m+"+Es.exports.humanize(this.diff)+"\x1B[0m")}else i[0]=V_()+e+" "+i[0]}function V_(){return tt.inspectOpts.hideDate?"":new Date().toISOString()+" "}function H_(...i... L5: `)}function G_(i){i?process.env.DEBUG=i:delete process.env.DEBUG}function W_(){return process.env.DEBUG}function Y_(i){i.inspectOpts={};let e=Object.keys(tt.inspectOpts);for(let t=... L6: `).map(e=>e.trim()).join(" ")};Ah.O=function(i){return this.inspectOpts.colors=this.useColors,Ss.inspect(i,this.inspectOpts)}});var nn=O((NI,Na)=>{typeof process=="undefined"||proc... L7: `:` L8: `,r=e.whitespace?" = ":"=",n=[],s=e.sort?Object.keys(i).sort():Object.keys(i),o=0;e.align&&(o=oi(s.filter(c=>i[c]===null||Array.isArray(i[c])||typeof i[c]!="object").map(c=>Array.i... L9: `);let r;for(;(r=nw.exec(t))!=null;)

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/extensions/diffs/node_modules/playwright-core/lib/utilsBundleImpl/index.jsView on unpkg · L4

3`).join(` L4: `+s),i.push(n+"m+"+Es.exports.humanize(this.diff)+"\x1B[0m")}else i[0]=V_()+e+" "+i[0]}function V_(){return tt.inspectOpts.hideDate?"":new Date().toISOString()+" "}function H_(...i... L5: `)}function G_(i){i?process.env.DEBUG=i:delete process.env.DEBUG}function W_(){return process.env.DEBUG}function Y_(i){i.inspectOpts={};let e=Object.keys(tt.inspectOpts);for(let t=... ... L7: `:` L8: `,r=e.whitespace?" = ":"=",n=[],s=e.sort?Object.keys(i).sort():Object.keys(i),o=0;e.align&&(o=oi(s.filter(c=>i[c]===null||Array.isArray(i[c])||typeof i[c]!="object").map(c=>Array.i... L9: `);let r;for(;(r=nw.exec(t))!=null;){let n=r[1],s=r[2]||"";s=s.trim();let o=s[0];s=s.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),o==='"'&&(s=s.replace(/\\n/g,` ... L17: `);let{connect:c,buffered:u}=await l;if(e.

dist/control-ui/assets/index-BtNFbQhY.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-BtNFbQhY.jsView on unpkg · L923

dist/compact-DEsHFhEL.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/compact-DEsHFhEL.jsView on unpkg · L32

dist/extensions/kindle-portal/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3View file

•path = dist/extensions/kindle-portal/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3 kind = native_binary sizeBytes = 16645008 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/extensions/kindle-portal/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3View on unpkg

dist/extensions/diffs/node_modules/shiki/dist/onig.wasmView file

•path = dist/extensions/diffs/node_modules/shiki/dist/onig.wasm kind = wasm_module sizeBytes = 466610 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/extensions/diffs/node_modules/shiki/dist/onig.wasmView on unpkg

skills/video-frames/scripts/frame.shView file

•path = skills/video-frames/scripts/frame.sh kind = build_helper sizeBytes = 1347 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/video-frames/scripts/frame.shView on unpkg

dist/extensions/diffs/assets/viewer-runtime.jsView file

•path = [redacted]-runtime.js kind = oversized_source_file sizeBytes = 9867326 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/extensions/diffs/assets/viewer-runtime.jsView on unpkg

dist/extensions/diffs/node_modules/diff/dist/diff.min.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 34

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/extensions/diffs/node_modules/diff/dist/diff.min.js#virtual:normalized:round1View on unpkg