kixparadigm-en@1.3.20: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

kixparadigm-en@1.3.20: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-lib.js --quiet

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install-lib.js --quiet

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/patch-dsh-runtime.jsView file

45const path = require('node:path') L46: const { execFileSync } = require('node:child_process') L47: const { resolveRuntime } = require('./dsh-runtime-resolve.js')

High

Child Process

Package source references child process execution.

scripts/patch-dsh-runtime.jsView on unpkg · L45

bin/kixparadigm-en.jsView file

3// kixparadigm-en CLI — English edition, installs the kixparadigm-en preset L4: require('../scripts/install-lib.js').cli(process.argv.slice(2))

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kixparadigm-en.jsView on unpkg · L3

scripts/install-lib.jsView file

18Cross-file remote execution chain: scripts/install-lib.js spawns preset-classic-en/plugins/kix-guards.test.js; helper contains network access plus dynamic code execution. L18: const { pathToFileURL } = require('node:url') L19: const { spawnSync } = require('node:child_process') L20: L21: const PKG_ROOT = path.join(__dirname, '..') L22: // 各语言包的安装目标由各自 package.json 的 "kixparadigm" 段声明： L23: // { variants: [{ id, dir }, ...], bridgeDir } —— 缺省 = 中文主包行为 L24: // 旧字段 presetId/presetDir 仍受支持（等价于单元素 variants）。 L25: const PKG = JSON.parse(fs.readFileSync(path.join(PKG_ROOT, 'package.json'), 'utf8')) L26: const CFG = PKG.kixparadigm || {} ... L147: function flatRuntime() { L148: const fromEnv = process.env.KIX_DSH_PREFIX L149: if (!fromEnv) return null

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/install-lib.jsView on unpkg · L18

preset-classic-en/skills/kixpower/tests/run-contract-regression.ps1View file

•path = preset-classic-en/skills/kixpower/tests/run-contract-regression.ps1 kind = payload_in_excluded_dir sizeBytes = 55675 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

preset-classic-en/skills/kixpower/tests/run-contract-regression.ps1View on unpkg

•matchType = normalized_sha256 matchedPackage = kixparadigm-en@1.3.9 matchedPath = preset-classic-en/skills/kixpower/tests/run-contract-regression.ps1 matchedIdentity = npm:a2l4cGFyYWRpZ20tZW4:1.3.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

preset-classic-en/skills/kixpower/tests/run-contract-regression.ps1View on unpkg

•path = preset-classic-en/skills/kixpower/tests/run-contract-regression.ps1 kind = build_helper sizeBytes = 55675 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

preset-classic-en/skills/kixpower/tests/run-contract-regression.ps1

preset-classic-en/plugins/kix-discipline.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

preset-classic-en/plugins/kix-discipline.js#virtual:normalized:round1View on unpkg

preset-classic-en/plugins/kix-browser.test.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = kixparadigm-en@1.3.13 matchedIdentity = npm:a2l4cGFyYWRpZ20tZW4:1.3.13 similarity = 0.375 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

preset-classic-en/plugins/kix-browser.test.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = kixparadigm@1.3.16 matchedPath = dsh/preset-classic/plugins/kix-browser.test.js matchedIdentity = npm:a2l4cGFyYWRpZ20:1.3.16 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

preset-classic-en/plugins/kix-browser.test.jsView on unpkg

bridge/index.jsView file

•matchType = normalized_sha256 matchedPackage = kixparadigm@1.3.16 matchedPath = dsh/vision-bridge/index.js matchedIdentity = npm:a2l4cGFyYWRpZ20:1.3.16 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bridge/index.jsView on unpkg

preset-classic-en/plugins/kix-browser.jsView file

•matchType = normalized_sha256 matchedPackage = kixparadigm@1.3.16 matchedPath = dsh/preset-classic/plugins/kix-browser.js matchedIdentity = npm:a2l4cGFyYWRpZ20:1.3.16 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

preset-classic-en/plugins/kix-browser.jsView on unpkg

preset-classic-en/plugins/kix-guards.test.jsView file

•matchType = normalized_sha256 matchedPackage = kixparadigm@1.3.16 matchedPath = dsh/preset-classic/plugins/kix-guards.test.js matchedIdentity = npm:a2l4cGFyYWRpZ20:1.3.16 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

preset-classic-en/plugins/kix-guards.test.jsView on unpkg

preset-classic-en/plugins/kix-commands.jsView file

•matchType = normalized_sha256 matchedPackage = kixparadigm-en@1.3.9 matchedPath = preset-classic-en/plugins/kix-commands.js matchedIdentity = npm:a2l4cGFyYWRpZ20tZW4:1.3.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

preset-classic-en/plugins/kix-commands.jsView on unpkg