Loading npm security reports…

kaijibot@2026.8.7: AI-agent control-surface risk | LPM Firewall

registry / kaijibot / 2026.8.7

kaijibot@2026.8.7

Proactive cognitive AI assistant with Feishu/WeChat integration — learns user interests, pushes cross-domain insights, evolves skills, self-corrects. 40+ LLM providers, runs on cloud/desktop/Android.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation automatically invokes npx to add all Lark CLI skills to the user's global AI-agent skills directory. This mutates a foreign/broad agent control surface without an explicit user action.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall

Impact

Unconsented agent capability/configuration expansion under ~/.agents/skills/.

Mechanism

automatic global AI-agent skill installation via npx

Policy narrative

On installation, package.json executes scripts/postinstall-bundled-plugins.mjs. Unless disabled by an environment variable or preexisting lark skills, that script runs `npx -y skills add larksuite/cli -g --all` and verifies lark-* SKILL.md directories under ~/.agents/skills/. This unprompted postinstall mutation of a global AI-agent control surface meets the blocking policy.

Rationale

Source inspection confirms an unconsented postinstall operation that installs third-party skills globally into ~/.agents/skills/. Opt-out and non-fatal handling do not make the mutation user-invoked.

Evidence

package.jsonscripts/postinstall-bundled-plugins.mjs~/.agents/skills/

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 99.0% confidence with false-positive risk.

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/control-ui/assets/index-B2vTvM2B.jsView file

911contains invisible/control Unicode U+200D (zero width joiner) `}var Ug=50,Wg=class{constructor(){this.items=[],this.cursor=-1}push(e){let t=e.trim();t&&this.items[this.items.length-1]!==t&&(this.items.push(t),this.items.length>Ug&&this.items.shift(),this.cursor=-1)}up(){return this.items.length===0?

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-B2vTvM2B.jsView on unpkg · L911

912`);return M(t,-1)?``:e.slice(t)}function LS(e){return e.replace(/^[ \t\r\f\v]+/,``)}function RS(e){let t=LS(e);return t.startsWith(NS)?RS(FS(t.slice(2))):t.startsWith(MS)?RS(IS(t.s... L913: `)?BS(e,RS(t)):e.startsWith(` `)?BS(e,t):BS(e,zS(t))}[...[...AS,`_`,`$`],...jS],[...jS];function HS(e){return M(e,``)?[]:[e.slice(0,1),e.slice(1)]}function US(e,t){return N(e,(e,n)... L914: \r `.includes(e[o]);)o++};return l()};e.parse=o}))(),rj=new Set([`"`,`\\`,`/`,`b`,`f`,`n`,`r`,`t`,`u`]);function ij(e){let t=e.codePointAt(0);return t!==void 0&&t>=0&&t<=31}functio...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/control-ui/assets/index-B2vTvM2B.jsView on unpkg · L912

dist/update-cli-Cdj2DQ8v.jsView file

36import path from "node:path"; L37: import { spawn, spawnSync } from "node:child_process"; L38: import os from "node:os"; ... L51: } L52: const KAIJIBOT_REPO_URL = "https://gitee.com/kaiji1126/kaijibot.git"; L53: const MAX_LOG_CHARS = 8e3; ... L93: function resolveGitInstallDir() { L94: const override = process.env.KAIJIBOT_GIT_DIR?.trim(); L95: if (override) return path.resolve(override); ... L98: function resolveDefaultGitDir() { L99: const home = os.homedir(); L100: if (home.startsWith("/")) return path.posix.join(home, "kaijibot");

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/update-cli-Cdj2DQ8v.jsView on unpkg · L36

skills/video-frames/scripts/frame.shView file

•path = skills/video-frames/scripts/frame.sh kind = build_helper sizeBytes = 1347 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/video-frames/scripts/frame.shView on unpkg

dist/extensions/diffs/assets/viewer-runtime.jsView file

•path = [redacted]-runtime.js kind = oversized_source_file sizeBytes = 9867326 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/extensions/diffs/assets/viewer-runtime.jsView on unpkg

dist/launchd-Cm2E2m_1.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.1-2 matchedPath = dist/launchd-Cm2E2m_1.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.1-2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/launchd-Cm2E2m_1.jsView on unpkg

dist/clawhub-Br81or9N.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.1-2 matchedPath = dist/clawhub-Br81or9N.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.1-2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/clawhub-Br81or9N.jsView on unpkg

dist/schtasks-B69xcxhh.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.1-2 matchedPath = dist/schtasks-B69xcxhh.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.1-2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/schtasks-B69xcxhh.jsView on unpkg

dist/windows-spawn-zUnahlxC.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.1-2 matchedPath = dist/windows-spawn-zUnahlxC.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.1-2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/windows-spawn-zUnahlxC.jsView on unpkg

dist/anthropic-vertex-stream-Ce4FIZKv.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.7.27-1 matchedPath = dist/anthropic-vertex-stream-vdYAOI7y.js matchedIdentity = npm:a2Fpamlib3Q:2026.7.27-1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/anthropic-vertex-stream-Ce4FIZKv.jsView on unpkg