kixparadigm-en@1.2.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

kixparadigm-en@1.2.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-lib.js --quiet

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install-lib.js --quiet

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

preset/plugins/kix-guards.jsView file

48const { join } = require('node:path') L49: const { execFile } = require('node:child_process') L50: const { promisify } = require('node:util')

High

Child Process

Package source references child process execution.

preset/plugins/kix-guards.jsView on unpkg · L48

•matchType = previous_version_dangerous_delta matchedPackage = kixparadigm-en@1.1.5 matchedIdentity = npm:a2l4cGFyYWRpZ20tZW4:1.1.5 similarity = 0.900 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

preset/plugins/kix-guards.jsView on unpkg

bin/kixparadigm-en.jsView file

3// kixparadigm-en CLI — English edition, installs the kixparadigm-en preset L4: require('../scripts/install-lib.js').cli(process.argv.slice(2))

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kixparadigm-en.jsView on unpkg · L3

preset/plugins/kix-guards.test.js#virtual:string-array:round1View file

155// ══ 3. 控制平面保护（v3：home 限定，项目级同名文件不误伤）════════════ L156: const HOME = (process.env.USERPROFILE || os.homedir()).replace(/\\/g, "/") L157: check(`pwsh: 读 ${HOME}/.dsh/settings.yaml → deny`, await dispatch("pwsh", { command: `Get-Content ${HOME}\\.dsh\\settings.yaml` }), true) ... L164: // ══ 4. run_code 代码体受限能力（v3 补 fs 直写）════════════════════════ L165: check("run_code: import(\"node:child_process\") → deny", await dispatch("run_code", { code: "const cp = await import(\"node:child_process\"); return 1" }), true) L166: check("run_code: fetch( 网络 → deny", await dispatch("run_code", { code: "const r = await fetch(\"https://x\"); return r" }), true) L167: check("run_code: process.env 访问 → deny", await dispatch("run_code", { code: "return process.env.HOME" }), true)

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

preset/plugins/kix-guards.test.js#virtual:string-array:round1View on unpkg · L155

preset/skills/kixpower/tests/run-contract-regression.ps1View file

•path = [redacted]-contract-regression.ps1 kind = payload_in_excluded_dir sizeBytes = 56539 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

preset/skills/kixpower/tests/run-contract-regression.ps1View on unpkg

•path = [redacted]-contract-regression.ps1 kind = build_helper sizeBytes = 56539 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

preset/skills/kixpower/tests/run-contract-regression.ps1View on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 12-52json

12 "ai-agent",

13 "deepseek-harness",

14 "dsh",

15 "agent-preset",

16 "multi-agent",

17 "coding-agent",

18 "english"

19 ],

20 "bin": {

21 "kixparadigm-en": "bin/kixparadigm-en.js"

22 },

23 "files": [

24 "bin/",

25 "scripts/",

26 "preset/",

27 "bridge/",

28 "README.md",

29 "LICENSE"

30 ],

31 "scripts": {

32 "postinstall": "node scripts/install-lib.js --quiet",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L32

33 "test": "node preset/plugins/kix-guards.test.js && node preset/plugins/kix-commands.test.js && node preset/plugins/kix-cost.test.js && node preset/plugins/kix-route.test.js && node preset/plugins/kix-discipline.test.js && node preset/plugins/kix-orchestration.test.js && node preset/plugins/kix-focus.test.js"

34 },

35 "engines": {

36 "node": ">=18"

37 },

38 "kixparadigm": {

39 "presetId": "kixparadigm-en",

40 "presetDir": "preset",

41 "bridgeDir": "bridge"

42 },

43 "repository": {

44 "type": "git",

45 "url": "git+https://github.com/olicesx/kixparadigm.git"

46 },

47 "bugs": {

48 "url": "https://github.com/olicesx/kixparadigm/issues"

49 },

50 "homepage": "https://github.com/olicesx/kixparadigm#readme"

51}

52

preset/plugins/kix-guards.jsView file

Lines 28-68javascript

28// danger-full-access 已恢复 approval: never（全自动、零审批弹窗）；需人类确认

29// 的门禁（普通 git push / 本地破坏性 Git 操作 / GitHub 写）在聊天里问

30// 「允许执行/拒绝」，用户回答决定放行。硬 deny（force push / main 分支 /

31// 控制平面 / 破坏性 SQL / 未知执行工具 / commit budget）不变。

32// 降级（fail-safe）：无 userQuestions 服务 / exec 无 agent / 提问被中止或

33// 抛错（子代理 DELEGATED_CALLER、无 provider 等）→ 自动拒绝（deny）。

34//

35// 挂载方式：preset agent.cordis.yml 中一行：

36// - id: kix-guards

37// name: ./plugins/kix-guards.js

bin/kixparadigm-en.jsView file

Lines 1-5javascript

1#!/usr/bin/env node

2'use strict'

3// kixparadigm-en CLI — English edition, installs the kixparadigm-en preset

4require('../scripts/install-lib.js').cli(process.argv.slice(2))

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kixparadigm-en.jsView on unpkg · L3

5

preset/plugins/kix-guards.test.js#virtual:string-array:round1View file

155// ══ 3. 控制平面保护（v3：home 限定，项目级同名文件不误伤）════════════ L156: const HOME = (process.env.USERPROFILE || os.homedir()).replace(/\\/g, "/") L157: check(`pwsh: 读 ${HOME}/.dsh/settings.yaml → deny`, await dispatch("pwsh", { command: `Get-Content ${HOME}\\.dsh\\settings.yaml` }), true) ... L164: // ══ 4. run_code 代码体受限能力（v3 补 fs 直写）════════════════════════ L165: check("run_code: import(\"node:child_process\") → deny", await dispatch("run_code", { code: "const cp = await import(\"node:child_process\"); return 1" }), true) L166: check("run_code: fetch( 网络 → deny", await dispatch("run_code", { code: "const r = await fetch(\"https://x\"); return r" }), true) L167: check("run_code: process.env 访问 → deny", await dispatch("run_code", { code: "return process.env.HOME" }), true)

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

preset/plugins/kix-guards.test.js#virtual:string-array:round1View on unpkg · L155

preset/skills/kixpower/tests/run-contract-regression.ps1View file

•path = [redacted]-contract-regression.ps1 kind = payload_in_excluded_dir sizeBytes = 56539 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

preset/skills/kixpower/tests/run-contract-regression.ps1View on unpkg

•path = [redacted]-contract-regression.ps1 kind = build_helper sizeBytes = 56539 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

preset/skills/kixpower/tests/run-contract-regression.ps1View on unpkg