Loading npm security reports…

kaijibot@2026.8.9-3: AI-agent control-surface risk | LPM Firewall

registry / kaijibot / 2026.8.9-3

kaijibot@2026.8.9-3

Proactive cognitive AI assistant with Feishu/WeChat integration — learns user interests, pushes cross-domain insights, evolves skills, self-corrects. 40+ LLM providers, runs on cloud/desktop/Android.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall automatically installs third-party skills into the user's global ~/.agents/skills control surface. This is a foreign, broad AI-agent configuration mutation without an explicit user command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install

Impact

Modifies AI-agent skills and executes a remote package-manager command during installation.

Mechanism

postinstall invokes npx to globally add Lark CLI agent skills

Policy narrative

On installation, the postinstall script calls `npx -y skills add larksuite/cli -g --all` if ~/.agents/skills lacks matching entries. It thereby downloads and installs third-party skills into a global AI-agent control surface without a user-invoked setup action.

Rationale

Source confirms an unconsented postinstall mutation of ~/.agents/skills, a foreign/broad AI-agent control surface. This meets the blocking policy regardless of the unrelated CLI and Git-hook behavior.

Evidence

package.jsonscripts/postinstall-bundled-plugins.mjskaijibot.mjs~/.agents/skills/lark-*/SKILL.md

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 99.0% confidence with false-positive risk.

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/server.impl-BMvLAt4A.jsView file

215import path, { join } from "node:path"; L216: import { execFile, spawn } from "node:child_process"; L217: import os, { homedir, networkInterfaces } from "node:os";

High

Child Process

Package source references child process execution.

dist/server.impl-BMvLAt4A.jsView on unpkg · L215

67import { i as resolveAssistantAvatarUrl, n as buildControlUiAvatarUrl, r as normalizeControlUiBasePath, t as CONTROL_UI_AVATAR_PREFIX } from "./control-ui-shared-CRsHhyOY.js"; L68: import { $ as [redacted], Dt as validateSecretsResolveResult, Et as validateSecretsResolveParams, Q as validateExecApprovalGetParams, R as validateConnectPar... L69: import { o as verifyDeviceSignature, r as [redacted], t as deriveDeviceIdFromPublicKey } from "./device-identity-D81Ge-ss.js";

High

Shell

Package source references shell execution.

dist/server.impl-BMvLAt4A.jsView on unpkg · L67

52import { n as pickPrimaryTailnetIPv4, r as pickPrimaryTailnetIPv6 } from "./tailnet-CnNMeiA8.js"; L53: import { _ as resolveRequestClientIp, a as isLoopbackHost, g as resolveHostName, h as resolveGatewayListenHosts, i as isLoopbackAddress, l as isTrustedProxyAddress, m as resolveGat... L54: import { c as AUTH_RATE_LIMIT_SCOPE_DEVICE_TOKEN, d as createAuthRateLimiter, f as normalizeRateLimitClientIp, i as isLocalDirectRequest, l as AUTH_RATE_LIMIT_SCOPE_HOOK_AUTH, n as... ... L67: import { i as resolveAssistantAvatarUrl, n as buildControlUiAvatarUrl, r as normalizeControlUiBasePath, t as CONTROL_UI_AVATAR_PREFIX } from "./control-ui-shared-CRsHhyOY.js"; L68: import { $ as [redacted], Dt as validateSecretsResolveResult, Et as validateSecretsResolveParams, Q as validateExecApprovalGetPar

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/server.impl-BMvLAt4A.jsView on unpkg · L52

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.6 matchedPath = dist/server.impl-BWnczjab.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server.impl-BMvLAt4A.jsView on unpkg

233function [redacted]() { L234: [redacted] ??= import("./exec-approval-forwarder.runtime-B2-enGir.js"); L235: return [redacted];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server.impl-BMvLAt4A.jsView on unpkg · L233

dist/launchd-Cm2E2m_1.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.9-1 matchedPath = dist/launchd-Cm2E2m_1.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.9-1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/launchd-Cm2E2m_1.jsView on unpkg

8import path from "node:path"; L9: import { spawn } from "node:child_process"; L10: import os from "node:os"; ... L44: } L45: function buildLaunchAgentPlist$1({ label, comment, programArguments, workingDirectory, stdoutPath, stderrPath, environment }) { L46: const argsXml = programArguments.map((arg) => `\n <string>${plistEscape(arg)}</string>`).join(""); ... L62: } L63: function resolveLaunchdRestartTarget(env = process.env) { L64: const domain = resolveGuiDomain$1(); L65: const label = resolveLaunchAgentLabel$1(env); L66: const home = normalizeOptionalString(env.HOME) || os.homedir(); L67: return {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/launchd-Cm2E2m_1.jsView on unpkg · L8

dist/control-ui/assets/index-B2vTvM2B.jsView file

911contains invisible/control Unicode U+200D (zero width joiner) `}var Ug=50,Wg=class{constructor(){this.items=[],this.cursor=-1}push(e){let t=e.trim();t&&this.items[this.items.length-1]!==t&&(this.items.push(t),this.items.length>Ug&&this.items.shift(),this.cursor=-1)}up(){return this.items.length===0?

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-B2vTvM2B.jsView on unpkg · L911

skills/video-frames/scripts/frame.shView file

•path = skills/video-frames/scripts/frame.sh kind = build_helper sizeBytes = 1347 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/video-frames/scripts/frame.shView on unpkg

dist/extensions/diffs/assets/viewer-runtime.jsView file

•path = [redacted]-runtime.js kind = oversized_source_file sizeBytes = 9867326 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/extensions/diffs/assets/viewer-runtime.jsView on unpkg

dist/prompt-select-styled-kyrClKbc.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.7-1 matchedPath = dist/prompt-select-styled-C-UYdPrP.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.7-1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/prompt-select-styled-kyrClKbc.jsView on unpkg

dist/clawhub-Br81or9N.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.9-1 matchedPath = dist/clawhub-Br81or9N.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.9-1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/clawhub-Br81or9N.jsView on unpkg

dist/runner-jvYZHMjd.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.9-1 matchedPath = dist/runner-jvYZHMjd.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.9-1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runner-jvYZHMjd.jsView on unpkg

Source & flagged code

14 flagged

package.jsonView file

Lines 1084-1124json

1084 "lint:fix": "node scripts/run-oxlint.mjs --fix && pnpm format",

1085 "lint:plugins:no-extension-imports": "node scripts/check-plugin-extension-import-boundary.mjs",

1086 "lint:plugins:no-extension-src-imports": "node --import tsx scripts/check-no-extension-src-imports.ts",

1087 "lint:plugins:no-extension-test-core-imports": "node --import tsx scripts/check-no-extension-test-core-imports.ts",

1088 "lint:plugins:no-monolithic-plugin-sdk-entry-imports": "node --import tsx scripts/check-no-monolithic-plugin-sdk-entry-imports.ts",

1089 "lint:plugins:no-register-http-handler": "node scripts/check-no-register-http-handler.mjs",

1090 "lint:plugins:plugin-sdk-subpaths-exported": "node scripts/check-plugin-sdk-subpath-exports.mjs",

1091 "lint:tmp:channel-agnostic-boundaries": "node scripts/check-channel-agnostic-boundaries.mjs",

1092 "lint:tmp:no-random-messaging": "node scripts/check-no-random-messaging-tmp.mjs",

1093 "lint:tmp:no-raw-channel-fetch": "node scripts/check-no-raw-channel-fetch.mjs",

1094 "lint:ui:no-raw-window-open": "node scripts/check-no-raw-window-open.mjs",

1095 "lint:web-fetch-provider-boundaries": "node scripts/check-web-fetch-provider-boundaries.mjs",

1096 "lint:web-search-provider-boundaries": "node scripts/check-web-search-provider-boundaries.mjs",

1097 "lint:webhook:no-low-level-body-read": "node scripts/check-webhook-auth-body-order.mjs",

1098 "plugin-sdk:api:check": "node --import tsx scripts/generate-plugin-sdk-api-baseline.ts --check",

1099 "plugin-sdk:api:gen": "node --import tsx scripts/generate-plugin-sdk-api-baseline.ts --write",

1100 "plugin-sdk:check-exports": "node scripts/sync-plugin-sdk-exports.mjs --check",

1101 "plugin-sdk:sync-exports": "node scripts/sync-plugin-sdk-exports.mjs",

1102 "plugin-sdk:usage": "node --import tsx scripts/analyze-plugin-sdk-usage.ts",

1103 "plugins:sync": "node --import tsx scripts/sync-plugin-versions.ts",

1104 "postinstall": "node scripts/postinstall-bundled-plugins.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L1104

1105 "prepack": "node --import tsx scripts/kaijibot-prepack.ts",

1106 "prepare": "command -v git >/dev/null 2>&1 && git rev-parse --is-inside-work-tree >/dev/null 2>&1 && git config core.hooksPath git-hooks || exit 0",

1107 "protocol:gen": "node --import tsx scripts/protocol-gen.ts",

1108 "runtime-sidecars:check": "node --import tsx scripts/generate-runtime-sidecar-paths-baseline.ts --check",

1109 "runtime-sidecars:gen": "node --import tsx scripts/generate-runtime-sidecar-paths-baseline.ts --write",

1110 "stage:bundled-plugin-runtime-deps": "node scripts/stage-bundled-plugin-runtime-deps.mjs",

1111 "start": "node scripts/run-node.mjs",

1112 "test": "node scripts/test-projects.mjs",

1113 "test:auth:compat": "node scripts/run-vitest.mjs run --config vitest/vitest.gateway.config.ts src/gateway/server.auth.compat-baseline.test.ts src/gateway/client.test.ts src/gateway/reconnect-gating.test.ts src/gateway/protocol/connect-error-details.test.ts",

1114 "test:build:singleton": "node scripts/test-built-plugin-singleton.mjs",

1115 "test:bundled": "node scripts/run-vitest.mjs run --config vitest/vitest.bundled.config.ts",

1116 "test:changed": "node scripts/test-projects.mjs --changed origin/main",

1117 "test:changed:max": "KAIJIBOT_VITEST_MAX_WORKERS=8 node scripts/test-projects.mjs --changed origin/main",

1118 "test:channels": "node scripts/run-vitest.mjs run --config vitest/vitest.channels.config.ts",

1119 "test:contracts": "pnpm test:contracts:channels && pnpm test:contracts:plugins",

1120 "test:contracts:channels": "node scripts/run-vitest.mjs run --config vitest/vitest.contracts.config.ts --maxWorkers=1 src/channels/plugins/contracts",

1121 "test:contracts:plugins": "node scripts/run-vitest.mjs run --config vitest/vitest.contracts.config.ts --maxWorkers=1 src/plugins/contracts",

1122 "test:coverage": "node scripts/run-vitest.mjs run --config vitest/vitest.unit.config.ts --coverage",

1123 "test:coverage:changed": "node scripts/run-vitest.mjs run --config vitest/vitest.unit.config.ts --coverage --changed origin/main",

1124 "test:e2e": "node scripts/run-vitest.mjs run --config vitest/vitest.e2e.config.ts",

dist/server.impl-BMvLAt4A.jsView file

215import path, { join } from "node:path"; L216: import { execFile, spawn } from "node:child_process"; L217: import os, { homedir, networkInterfaces } from "node:os";

High

Child Process

Package source references child process execution.

dist/server.impl-BMvLAt4A.jsView on unpkg · L215

67import { i as resolveAssistantAvatarUrl, n as buildControlUiAvatarUrl, r as normalizeControlUiBasePath, t as CONTROL_UI_AVATAR_PREFIX } from "./control-ui-shared-CRsHhyOY.js"; L68: import { $ as [redacted], Dt as validateSecretsResolveResult, Et as validateSecretsResolveParams, Q as validateExecApprovalGetParams, R as validateConnectPar... L69: import { o as verifyDeviceSignature, r as [redacted], t as deriveDeviceIdFromPublicKey } from "./device-identity-D81Ge-ss.js";

High

Shell

Package source references shell execution.

dist/server.impl-BMvLAt4A.jsView on unpkg · L67

52import { n as pickPrimaryTailnetIPv4, r as pickPrimaryTailnetIPv6 } from "./tailnet-CnNMeiA8.js"; L53: import { _ as resolveRequestClientIp, a as isLoopbackHost, g as resolveHostName, h as resolveGatewayListenHosts, i as isLoopbackAddress, l as isTrustedProxyAddress, m as resolveGat... L54: import { c as AUTH_RATE_LIMIT_SCOPE_DEVICE_TOKEN, d as createAuthRateLimiter, f as normalizeRateLimitClientIp, i as isLocalDirectRequest, l as AUTH_RATE_LIMIT_SCOPE_HOOK_AUTH, n as... ... L67: import { i as resolveAssistantAvatarUrl, n as buildControlUiAvatarUrl, r as normalizeControlUiBasePath, t as CONTROL_UI_AVATAR_PREFIX } from "./control-ui-shared-CRsHhyOY.js"; L68: import { $ as [redacted], Dt as validateSecretsResolveResult, Et as validateSecretsResolveParams, Q as validateExecApprovalGetPar

dist/launchd-Cm2E2m_1.jsView file

Lines 1-28javascript

1import { r as formatErrorMessage } from "./errors-CGMew-1w.js";

2import { i as normalizeLowercaseStringOrEmpty, s as normalizeOptionalString } from "./string-coerce-CIT1-v_a.js";

3import { d as resolveGatewayLaunchAgentLabel, f as resolveGatewayServiceDescription, g

dist/control-ui/assets/index-B2vTvM2B.jsView file

911contains invisible/control Unicode U+200D (zero width joiner) `}var Ug=50,Wg=class{constructor(){this.items=[],this.cursor=-1}push(e){let t=e.trim();t&&this.items[this.items.length-1]!==t&&(this.items.push(t),this.items.length>Ug&&this.items.shift(),this.cursor=-1)}up(){return this.items.length===0?

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-B2vTvM2B.jsView on unpkg · L911

skills/video-frames/scripts/frame.shView file

•path = skills/video-frames/scripts/frame.sh kind = build_helper sizeBytes = 1347 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/video-frames/scripts/frame.shView on unpkg

dist/extensions/diffs/assets/viewer-runtime.jsView file

•path = [redacted]-runtime.js kind = oversized_source_file sizeBytes = 9867326 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/extensions/diffs/assets/viewer-runtime.jsView on unpkg

dist/prompt-select-styled-kyrClKbc.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.7-1 matchedPath = dist/prompt-select-styled-C-UYdPrP.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.7-1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/prompt-select-styled-kyrClKbc.jsView on unpkg

dist/clawhub-Br81or9N.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.9-1 matchedPath = dist/clawhub-Br81or9N.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.9-1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/clawhub-Br81or9N.jsView on unpkg

dist/runner-jvYZHMjd.jsView file

•matchType = normalized_sha256 matchedPackage = kaijibot@2026.8.9-1 matchedPath = dist/runner-jvYZHMjd.js matchedIdentity = npm:a2Fpamlib3Q:2026.8.9-1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runner-jvYZHMjd.jsView on unpkg