Loading npm security reports…

kaijibot@2026.8.23: AI-agent control-surface risk | LPM Firewall

registry / kaijibot / 2026.8.23

kaijibot@2026.8.23

Proactive cognitive AI assistant with Feishu/WeChat integration — learns user interests, pushes cross-domain insights, evolves skills, self-corrects. 40+ LLM providers, runs on cloud/desktop/Android.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall automatically installs third-party skills into the user’s global AI-agent skills directory. This is an unconsented mutation of a broad agent control surface.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation of kaijibot@2026.8.23

Impact

Adds up to all lark-cli skill files under the user’s AI-agent configuration without an explicit user command.

Mechanism

postinstall spawns npx to globally add larksuite/cli skills

Policy narrative

Installing the package triggers its postinstall script. Unless an opt-out environment variable is already set or matching skills exist, the script runs `npx` with a global all-skills install command and targets `~/.agents/skills/`. That changes a user-wide AI-agent skill/control surface without an explicit setup command.

Rationale

The package’s postinstall performs an unconsented global AI-agent skills installation, meeting the install-control-surface blocking boundary. No additional exfiltration is required for this concrete install-time control-surface mutation.

Evidence

package.jsonscripts/postinstall-bundled-plugins.mjs~/.agents/skills/

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 99.0% confidence with false-positive risk.

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/git-commit-C0NqDaJx.jsView file

88try { L89: const pkg = createRequire(import.meta.url)("../../package.json"); L90: return formatCommit(pkg.gitHead ?? pkg.githead ?? null);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/git-commit-C0NqDaJx.jsView on unpkg · L88

dist/control-ui/assets/index-BtNFbQhY.jsView file

923contains invisible/control Unicode U+200D (zero width joiner) `}var f_=50,p_=class{constructor(){this.items=[],this.cursor=-1}push(e){let t=e.trim();t&&this.items[this.items.length-1]!==t&&(this.items.push(t),this.items.length>f_&&this.items.shift(),this.cursor=-1)}up(){return this.items.length===0?

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-BtNFbQhY.jsView on unpkg · L923

skills/video-frames/scripts/frame.shView file

•path = skills/video-frames/scripts/frame.sh kind = build_helper sizeBytes = 1347 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/video-frames/scripts/frame.shView on unpkg

dist/extensions/diffs/assets/viewer-runtime.jsView file

•path = [redacted]-runtime.js kind = oversized_source_file sizeBytes = 9867326 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/extensions/diffs/assets/viewer-runtime.jsView on unpkg

dist/schtasks-CL3tJAH5.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.14-1 matchedPath = dist/schtasks-B69xcxhh.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.14-1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/schtasks-CL3tJAH5.jsView on unpkg

dist/audit.nondeep.runtime-BNrDSb24.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.7.27-1 matchedPath = dist/audit.nondeep.runtime-B3wdTKZu.js matchedIdentity = npm:a2Fpamlib3Q:2026.7.27-1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/audit.nondeep.runtime-BNrDSb24.jsView on unpkg

dist/control-ui/assets/anthropic-DlOZcqqy.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.14-1 matchedPath = dist/control-ui/assets/anthropic-CJRRuMgc.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.14-1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/control-ui/assets/anthropic-DlOZcqqy.jsView on unpkg

dist/control-ui/assets/openai-BR_xAflc.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.14-1 matchedPath = dist/control-ui/assets/openai-BR_xAflc.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.14-1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/control-ui/assets/openai-BR_xAflc.jsView on unpkg

dist/secrets-cli-CDO_S3rr.jsView file

•matchType = token_shingles matchedPackage = kaijibot@2026.7.27-1 matchedPath = dist/secrets-cli-D-WXM5m6.js matchedIdentity = npm:a2Fpamlib3Q:2026.7.27-1 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/secrets-cli-CDO_S3rr.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 1084-1124json

1084 "lint:fix": "node scripts/run-oxlint.mjs --fix && pnpm format",

1085 "lint:plugins:no-extension-imports": "node scripts/check-plugin-extension-import-boundary.mjs",

1086 "lint:plugins:no-extension-src-imports": "node --import tsx scripts/check-no-extension-src-imports.ts",

1087 "lint:plugins:no-extension-test-core-imports": "node --import tsx scripts/check-no-extension-test-core-imports.ts",

1088 "lint:plugins:no-monolithic-plugin-sdk-entry-imports": "node --import tsx scripts/check-no-monolithic-plugin-sdk-entry-imports.ts",

1089 "lint:plugins:no-register-http-handler": "node scripts/check-no-register-http-handler.mjs",

1090 "lint:plugins:plugin-sdk-subpaths-exported": "node scripts/check-plugin-sdk-subpath-exports.mjs",

1091 "lint:tmp:channel-agnostic-boundaries": "node scripts/check-channel-agnostic-boundaries.mjs",

1092 "lint:tmp:no-random-messaging": "node scripts/check-no-random-messaging-tmp.mjs",

1093 "lint:tmp:no-raw-channel-fetch": "node scripts/check-no-raw-channel-fetch.mjs",

1094 "lint:ui:no-raw-window-open": "node scripts/check-no-raw-window-open.mjs",

1095 "lint:web-fetch-provider-boundaries": "node scripts/check-web-fetch-provider-boundaries.mjs",

1096 "lint:web-search-provider-boundaries": "node scripts/check-web-search-provider-boundaries.mjs",

1097 "lint:webhook:no-low-level-body-read": "node scripts/check-webhook-auth-body-order.mjs",

1098 "plugin-sdk:api:check": "node --import tsx scripts/generate-plugin-sdk-api-baseline.ts --check",

1099 "plugin-sdk:api:gen": "node --import tsx scripts/generate-plugin-sdk-api-baseline.ts --write",

1100 "plugin-sdk:check-exports": "node scripts/sync-plugin-sdk-exports.mjs --check",

1101 "plugin-sdk:sync-exports": "node scripts/sync-plugin-sdk-exports.mjs",

1102 "plugin-sdk:usage": "node --import tsx scripts/analyze-plugin-sdk-usage.ts",

1103 "plugins:sync": "node --import tsx scripts/sync-plugin-versions.ts",

1104 "postinstall": "node scripts/postinstall-bundled-plugins.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L1104

1105 "prepack": "node --import tsx scripts/kaijibot-prepack.ts",

1106 "prepare": "command -v git >/dev/null 2>&1 && git rev-parse --is-inside-work-tree >/dev/null 2>&1 && git config core.hooksPath git-hooks || exit 0",

1107 "protocol:gen": "node --import tsx scripts/protocol-gen.ts",

1108 "runtime-sidecars:check": "node --import tsx scripts/generate-runtime-sidecar-paths-baseline.ts --check",

1109 "runtime-sidecars:gen": "node --import tsx scripts/generate-runtime-sidecar-paths-baseline.ts --write",

1110 "stage:bundled-plugin-runtime-deps": "node scripts/stage-bundled-plugin-runtime-deps.mjs",

1111 "start": "node scripts/run-node.mjs",

1112 "test": "node scripts/test-projects.mjs",

1113 "test:auth:compat": "node scripts/run-vitest.mjs run --config vitest/vitest.gateway.config.ts src/gateway/server.auth.compat-baseline.test.ts src/gateway/client.test.ts src/gateway/reconnect-gating.test.ts src/gateway/protocol/connect-error-details.test.ts",

1114 "test:build:singleton": "node scripts/test-built-plugin-singleton.mjs",

1115 "test:bundled": "node scripts/run-vitest.mjs run --config vitest/vitest.bundled.config.ts",

1116 "test:changed": "node scripts/test-projects.mjs --changed origin/main",

1117 "test:changed:max": "KAIJIBOT_VITEST_MAX_WORKERS=8 node scripts/test-projects.mjs --changed origin/main",

1118 "test:channels": "node scripts/run-vitest.mjs run --config vitest/vitest.channels.config.ts",

1119 "test:contracts": "pnpm test:contracts:channels && pnpm test:contracts:plugins",

1120 "test:contracts:channels": "node scripts/run-vitest.mjs run --config vitest/vitest.contracts.config.ts --maxWorkers=1 src/channels/plugins/contracts",

1121 "test:contracts:plugins": "node scripts/run-vitest.mjs run --config vitest/vitest.contracts.config.ts --maxWorkers=1 src/plugins/contracts",

1122 "test:coverage": "node scripts/run-vitest.mjs run --config vitest/vitest.unit.config.ts --coverage",

1123 "test:coverage:changed": "node scripts/run-vitest.mjs run --config vitest/vitest.unit.config.ts --coverage --changed origin/main",

1124 "test:e2e": "node scripts/run-vitest.mjs run --config vitest/vitest.e2e.config.ts",

dist/git-commit-C0NqDaJx.jsView file

Lines 68-108javascript

68 try {

69 const commonDir = safeReadFilePrefix(path.join(gitDir, "commondir")).trim();

70 if (commonDir) return path.resolve(gitDir, commonDir);

dist/control-ui/assets/index-BtNFbQhY.jsView file

923contains invisible/control Unicode U+200D (zero width joiner) `}var f_=50,p_=class{constructor(){this.items=[],this.cursor=-1}push(e){let t=e.trim();t&&this.items[this.items.length-1]!==t&&(this.items.push(t),this.items.length>f_&&this.items.shift(),this.cursor=-1)}up(){return this.items.length===0?

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-BtNFbQhY.jsView on unpkg · L923

skills/video-frames/scripts/frame.shView file

•path = skills/video-frames/scripts/frame.sh kind = build_helper sizeBytes = 1347 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/video-frames/scripts/frame.shView on unpkg

dist/extensions/diffs/assets/viewer-runtime.jsView file

•path = [redacted]-runtime.js kind = oversized_source_file sizeBytes = 9867326 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/extensions/diffs/assets/viewer-runtime.jsView on unpkg

dist/schtasks-CL3tJAH5.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.14-1 matchedPath = dist/schtasks-B69xcxhh.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.14-1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/schtasks-CL3tJAH5.jsView on unpkg

dist/audit.nondeep.runtime-BNrDSb24.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.7.27-1 matchedPath = dist/audit.nondeep.runtime-B3wdTKZu.js matchedIdentity = npm:a2Fpamlib3Q:2026.7.27-1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/audit.nondeep.runtime-BNrDSb24.jsView on unpkg

dist/control-ui/assets/anthropic-DlOZcqqy.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.14-1 matchedPath = dist/control-ui/assets/anthropic-CJRRuMgc.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.14-1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/control-ui/assets/anthropic-DlOZcqqy.jsView on unpkg

dist/control-ui/assets/openai-BR_xAflc.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.14-1 matchedPath = dist/control-ui/assets/openai-BR_xAflc.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.14-1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/control-ui/assets/openai-BR_xAflc.jsView on unpkg

dist/secrets-cli-CDO_S3rr.jsView file

•matchType = token_shingles matchedPackage = kaijibot@2026.7.27-1 matchedPath = dist/secrets-cli-D-WXM5m6.js matchedIdentity = npm:a2Fpamlib3Q:2026.7.27-1 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/secrets-cli-CDO_S3rr.jsView on unpkg