Loading npm security reports…

kixparadigm-en@1.2.15: AI-agent control-surface risk | LPM Firewall

registry / kixparadigm-en / 1.2.15

kixparadigm-en@1.2.15

kixparadigm-en — English edition of the kix paradigm preset for DeepSeek Harness: resident cognition layer (EN) + kixpower multi-agent orchestration, one-command import (preset + vision-bridge + guard plugins)

AI Security Review

scanned 5h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies the external DSH agent control surface. The installed bridge can read a DSH credential and transmit attached images to its fixed vision API.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm postinstall; later DSH image submission

Impact

Unconsented agent-control-surface mutation and third-party transmission of user image data.

Mechanism

automatic DSH preset/plugin installation and credentialed image relay

Policy narrative

On installation, the postinstall hook copies this package's agent preset into DSH, installs a bridge plugin, creates a loader link, and modifies DSH's patch configuration without an explicit user command. At runtime, that bridge reads ZAI_CODING_CN_API_KEY from DSH configuration and sends image payloads with the credential to open.bigmodel.cn.

Rationale

This is a concrete unconsented postinstall mutation of a foreign AI-agent control surface, meeting the blocking policy. The declared vision feature does not remove the lifecycle-control risk.

Evidence

package.jsonscripts/install-lib.jsbridge/index.js$DSH_HOME/.agent-presets/kixparadigm-en/$DSH_HOME/profiles/web/plugins/dsh-vision-bridge/$DSH_HOME/profiles/web/node_modules/dsh-vision-bridge$DSH_HOME/profiles/web/cordis.patch.yml$DSH_HOME/.credentials.yaml

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-lib.js --quiet

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install-lib.js --quiet

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

preset/plugins/kix-guards.jsView file

104const { randomUUID } = require('node:crypto') L105: const { execFile } = require('node:child_process') L106: const { promisify } = require('node:util')

High

Child Process

Package source references child process execution.

preset/plugins/kix-guards.jsView on unpkg · L104

•matchType = previous_version_dangerous_delta matchedPackage = kixparadigm-en@1.2.14 matchedIdentity = npm:a2l4cGFyYWRpZ20tZW4:1.2.14 similarity = 0.788 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

preset/plugins/kix-guards.jsView on unpkg

bin/kixparadigm-en.jsView file

3// kixparadigm-en CLI — English edition, installs the kixparadigm-en preset L4: require('../scripts/install-lib.js').cli(process.argv.slice(2))

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kixparadigm-en.jsView on unpkg · L3

preset/plugins/kix-guards.test.js#virtual:string-array:round1View file

187check("pwsh: cp 外部 → 控制平面 → allow（v12 remind）", await dispatch("pwsh", { command: `cp /tmp/settings.yaml ${HOME}/.dsh/settings.yaml` }), false) L188: check(`pwsh: curl -o ${HOME}/.dsh/settings.yaml URL → allow（v12 remind）`, await dispatch("pwsh", { command: `curl -o ${HOME}/.dsh/settings.yaml https://example.com/x` }), false) L189: check(`pwsh: curl -o /tmp/x URL → allow（v8 下载目标非控制平面）`, await dispatch("pwsh", { command: "curl -o /tmp/x https://example.com/x" }), false) ... L196: // ══ 4. run_code 代码体受限能力（v3 补 fs 直写）════════════════════════ L197: check("run_code: import(\"node:child_process\") → deny", await dispatch("run_code", { code: "const cp = await import(\"node:child_process\"); return 1" }), true) L198: check("run_code: fetch( 网络 → deny", await dispatch("run_code", { code: "co

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

preset/plugins/kix-guards.test.js#virtual:string-array:round1View on unpkg · L187

preset/skills/kixpower/tests/run-contract-regression.ps1View file

•path = [redacted]-contract-regression.ps1 kind = payload_in_excluded_dir sizeBytes = 56539 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

preset/skills/kixpower/tests/run-contract-regression.ps1View on unpkg

•path = [redacted]-contract-regression.ps1 kind = build_helper sizeBytes = 56539 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

preset/skills/kixpower/tests/run-contract-regression.ps1View on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 12-52json

12 "ai-agent",

13 "deepseek-harness",

14 "dsh",

15 "agent-preset",

16 "multi-agent",

17 "coding-agent",

18 "english"

19 ],

20 "bin": {

21 "kixparadigm-en": "bin/kixparadigm-en.js"

22 },

23 "files": [

24 "bin/",

25 "scripts/",

26 "preset/",

27 "bridge/",

28 "README.md",

29 "LICENSE"

30 ],

31 "scripts": {

32 "postinstall": "node scripts/install-lib.js --quiet",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L32

33 "test:installer": "node --test scripts/install-lib.test.js",

34 "test:consistency": "node scripts/check-consistency.cjs",

35 "test:vision": "node --test bridge/test.js",

36 "test": "npm run test:installer && node scripts/check-consistency.cjs && node --test bridge/test.js && node preset/plugins/kix-guards.test.js && node preset/plugins/kix-commands.test.js && node preset/plugins/kix-cost.test.js && node preset/plugins/kix-route.test.js && node preset/plugins/kix-discipline.test.js && node preset/plugins/kix-orchestration.test.js && node preset/plugins/kix-focus.test.js && node preset/plugins/kix-consistency.test.js"

37 },

38 "engines": {

39 "node": ">=20.16.0"

40 },

41 "kixparadigm": {

42 "presetId": "kixparadigm-en",

43 "presetDir": "preset",

44 "bridgeDir": "bridge"

45 },

46 "repository": {

47 "type": "git",

48 "url": "git+https://github.com/olicesx/kixparadigm.git"

49 },

50 "bugs": {

51 "url": "https://github.com/olicesx/kixparadigm/issues"

52 },

preset/plugins/kix-guards.jsView file

Lines 84-124javascript

84// - 修复「预算兜底缺口 + 静默冷启动」：plan.md 增读 blast_radius.max_commits

85// （ps1 同源字段）；优先级 progress.commit_budget > plan.task_sizing.

86// derived_commit_budget > plan.blast_radius.max_commits > 冷启动 3，

87// 落冷启动必须 warn；deny 消息注明预算来源与 sprint 目录，移除误导性

88// 的「按 DAG 重算」措辞（任务 DAG 是规划文档，不做拦截）。

89//

90// 挂载方式：preset agent.cordis.yml 中一行：

91// - id: kix-guards

92// name: ./plugins/kix-guards.js

93// 说明：本监听器按 agent scope 挂载，只拦本 preset 的会话；deny 返回 reason 由

bin/kixparadigm-en.jsView file

Lines 1-5javascript

1#!/usr/bin/env node

2'use strict'

3// kixparadigm-en CLI — English edition, installs the kixparadigm-en preset

4require('../scripts/install-lib.js').cli(process.argv.slice(2))

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kixparadigm-en.jsView on unpkg · L3

5

preset/plugins/kix-guards.test.js#virtual:string-array:round1View file

187check("pwsh: cp 外部 → 控制平面 → allow（v12 remind）", await dispatch("pwsh", { command: `cp /tmp/settings.yaml ${HOME}/.dsh/settings.yaml` }), false) L188: check(`pwsh: curl -o ${HOME}/.dsh/settings.yaml URL → allow（v12 remind）`, await dispatch("pwsh", { command: `curl -o ${HOME}/.dsh/settings.yaml https://example.com/x` }), false) L189: check(`pwsh: curl -o /tmp/x URL → allow（v8 下载目标非控制平面）`, await dispatch("pwsh", { command: "curl -o /tmp/x https://example.com/x" }), false) ... L196: // ══ 4. run_code 代码体受限能力（v3 补 fs 直写）════════════════════════ L197: check("run_code: import(\"node:child_process\") → deny", await dispatch("run_code", { code: "const cp = await import(\"node:child_process\"); return 1" }), true) L198: check("run_code: fetch( 网络 → deny", await dispatch("run_code", { code: "co

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

preset/plugins/kix-guards.test.js#virtual:string-array:round1View on unpkg · L187

preset/skills/kixpower/tests/run-contract-regression.ps1View file

•path = [redacted]-contract-regression.ps1 kind = payload_in_excluded_dir sizeBytes = 56539 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

preset/skills/kixpower/tests/run-contract-regression.ps1View on unpkg

•path = [redacted]-contract-regression.ps1 kind = build_helper sizeBytes = 56539 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

preset/skills/kixpower/tests/run-contract-regression.ps1View on unpkg