kixparadigm@1.1.3: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

kixparadigm@1.1.3: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-lib.js --quiet

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install-lib.js --quiet

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

plugins/kix-guards.jsView file

40const { join } = require('node:path') L41: const { execFile } = require('node:child_process') L42: const { promisify } = require('node:util')

High

Child Process

Package source references child process execution.

plugins/kix-guards.jsView on unpkg · L40

skills/fetch-webpage/scripts/fetch-webpage.mjsView file

67// so go through ComSpec. L68: const out = execFileSync(process.env.ComSpec ?? 'cmd.exe', ['/c', 'npm root -g'], { encoding: 'utf8', windowsHide: true }); L69: paths.push(out.trim());

High

Shell

Package source references shell execution.

skills/fetch-webpage/scripts/fetch-webpage.mjsView on unpkg · L67

bin/kixparadigm.jsView file

3// kixparadigm CLI — npm 全局安装后的命令入口 L4: require('../scripts/install-lib.js').cli(process.argv.slice(2))

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kixparadigm.jsView on unpkg · L3

plugins/kix-guards.test.js#virtual:string-array:round1View file

118// ══ 3. 控制平面保护（v3：home 限定，项目级同名文件不误伤）════════════ L119: const HOME = (process.env.USERPROFILE || os.homedir()).replace(/\\/g, "/") L120: check(`pwsh: 读 ${HOME}/.dsh/settings.yaml → deny`, await dispatch("pwsh", { command: `Get-Content ${HOME}\\.dsh\\settings.yaml` }), true) ... L127: // ══ 4. run_code 代码体受限能力（v3 补 fs 直写）════════════════════════ L128: check("run_code: import(\"node:child_process\") → deny", await dispatch("run_code", { code: "const cp = await import(\"node:child_process\"); return 1" }), true) L129: check("run_code: fetch( 网络 → deny", await dispatch("run_code", { code: "const r = await fetch(\"https://x\"); return r" }), true) L130: check("run_code: process.env 访问 → deny", await dispatch("run_code", { code: "return process.env.HOME" }), true)

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

plugins/kix-guards.test.js#virtual:string-array:round1View on unpkg · L118

install.shView file

•path = install.sh kind = build_helper sizeBytes = 8105 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

dsh/preset/skills/kixpower/tests/run-contract-regression.ps1View file

•path = [redacted]-contract-regression.ps1 kind = payload_in_excluded_dir sizeBytes = 56539 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dsh/preset/skills/kixpower/tests/run-contract-regression.ps1View on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 19-56json

19 "bin": {

20 "kixparadigm": "bin/kixparadigm.js"

21 },

22 "files": [

23 "bin/",

24 "scripts/",

25 "dsh/",

26 "skills/",

27 "agents/",

28 "instructions/",

29 "prompts/",

30 "memories/",

31 "plugins/",

32 "INSTALL.md",

33 "install.ps1",

34 "install.sh",

35 "README.md",

36 "LICENSE"

37 ],

38 "scripts": {

39 "postinstall": "node scripts/install-lib.js --quiet",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L39

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L39

40 "test": "node dsh/preset/plugins/kix-guards.test.js && node dsh/preset/plugins/kix-commands.test.js && node dsh/preset/plugins/kix-cost.test.js && node dsh/preset/plugins/kix-route.test.js",

41 "verify:vision": "node scripts/verify-vision-bridge-resolution.cjs",

42 "verify:guards": "node scripts/verify-guards.js"

43 },

44 "engines": {

45 "node": ">=18"

46 },

47 "repository": {

48 "type": "git",

49 "url": "https://github.com/olicesx/kixparadigm.git"

50 },

51 "bugs": {

52 "url": "https://github.com/olicesx/kixparadigm/issues"

53 },

54 "homepage": "https://github.com/olicesx/kixparadigm#readme"

55}

56

plugins/kix-guards.jsView file

Lines 20-60javascript

20// 不再误拦

21// - SQL 工具（sql/sql_execute/run_sql）加入 KNOWN_SAFE_TOOLS（消除门禁 1 死代码，

22// 门禁 4 可达）；run_code 1b 补 require('fs')/import('fs')/writeFileSync 检查

23// - 保留（按 kix 0% 误报纪律 + 规则是负债）：角色边界门禁不接（exec.agent 无角色

24// 标记）、预算一致性软警告不接（建议类不进机械层）、SQL 文件引用检查不接

25// （psql -f 场景，文本纪律覆盖，见 capability map §3）

26//

27// 挂载方式：preset agent.cordis.yml 中一行：

28// - id: kix-guards

29// name: ./plugins/kix-guards.js

30

skills/fetch-webpage/scripts/fetch-webpage.mjsView file

Lines 47-87javascript

47 if (positional.length === 0) return fail('missing URL');

48 if (!/^https?:\/\//i

bin/kixparadigm.jsView file

Lines 1-5javascript

1#!/usr/bin/env node

2'use strict'

3// kixparadigm CLI — npm 全局安装后的命令入口

4require('../scripts/install-lib.js').cli(process.argv.slice(2))

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kixparadigm.jsView on unpkg · L3

5

plugins/kix-guards.test.js#virtual:string-array:round1View file

118// ══ 3. 控制平面保护（v3：home 限定，项目级同名文件不误伤）════════════ L119: const HOME = (process.env.USERPROFILE || os.homedir()).replace(/\\/g, "/") L120: check(`pwsh: 读 ${HOME}/.dsh/settings.yaml → deny`, await dispatch("pwsh", { command: `Get-Content ${HOME}\\.dsh\\settings.yaml` }), true) ... L127: // ══ 4. run_code 代码体受限能力（v3 补 fs 直写）════════════════════════ L128: check("run_code: import(\"node:child_process\") → deny", await dispatch("run_code", { code: "const cp = await import(\"node:child_process\"); return 1" }), true) L129: check("run_code: fetch( 网络 → deny", await dispatch("run_code", { code: "const r = await fetch(\"https://x\"); return r" }), true) L130: check("run_code: process.env 访问 → deny", await dispatch("run_code", { code: "return process.env.HOME" }), true)

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

plugins/kix-guards.test.js#virtual:string-array:round1View on unpkg · L118

install.shView file

•path = install.sh kind = build_helper sizeBytes = 8105 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

dsh/preset/skills/kixpower/tests/run-contract-regression.ps1View file

•path = [redacted]-contract-regression.ps1 kind = payload_in_excluded_dir sizeBytes = 56539 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dsh/preset/skills/kixpower/tests/run-contract-regression.ps1View on unpkg