kixparadigm@1.2.14: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

kixparadigm@1.2.14: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-lib.js --quiet

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install-lib.js --quiet

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

plugins/kix-guards.jsView file

104const { randomUUID } = require('node:crypto') L105: const { execFile } = require('node:child_process') L106: const { promisify } = require('node:util')

High

Child Process

Package source references child process execution.

plugins/kix-guards.jsView on unpkg · L104

skills/fetch-webpage/scripts/fetch-webpage.mjsView file

67// so go through ComSpec. L68: const out = execFileSync(process.env.ComSpec ?? 'cmd.exe', ['/c', 'npm root -g'], { encoding: 'utf8', windowsHide: true }); L69: paths.push(out.trim());

High

Shell

Package source references shell execution.

skills/fetch-webpage/scripts/fetch-webpage.mjsView on unpkg · L67

bin/kixparadigm.jsView file

3// kixparadigm CLI — npm 全局安装后的命令入口 L4: require('../scripts/install-lib.js').cli(process.argv.slice(2))

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kixparadigm.jsView on unpkg · L3

plugins/kix-guards.test.js#virtual:string-array:round1View file

180check("pwsh: cp 外部 → 控制平面 → allow（v12 remind）", await dispatch("pwsh", { command: `cp /tmp/settings.yaml ${HOME}/.dsh/settings.yaml` }), false) L181: check(`pwsh: curl -o ${HOME}/.dsh/settings.yaml URL → allow（v12 remind）`, await dispatch("pwsh", { command: `curl -o ${HOME}/.dsh/settings.yaml https://example.com/x` }), false) L182: check(`pwsh: curl -o /tmp/x URL → allow（v8 下载目标非控制平面）`, await dispatch("pwsh", { command: "curl -o /tmp/x https://example.com/x" }), false) ... L189: // ══ 4. run_code 代码体受限能力（v3 补 fs 直写）════════════════════════ L190: check("run_code: import(\"node:child_process\") → deny", await dispatch("run_code", { code: "const cp = await import(\"node:child_process\"); return 1" }), true) L191: check("run_code: fetch( 网络 → deny", await dispatch("run_code", { code: "co

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

plugins/kix-guards.test.js#virtual:string-array:round1View on unpkg · L180

install.shView file

•path = install.sh kind = build_helper sizeBytes = 8105 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

dsh/preset/skills/kixpower/tests/run-contract-regression.ps1View file

•path = [redacted]-contract-regression.ps1 kind = payload_in_excluded_dir sizeBytes = 56539 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dsh/preset/skills/kixpower/tests/run-contract-regression.ps1View on unpkg

dsh/preset/plugins/kix-guards.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = kixparadigm@1.2.13 matchedIdentity = npm:a2l4cGFyYWRpZ20:1.2.13 similarity = 0.880 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dsh/preset/plugins/kix-guards.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 21-61json

21 },

22 "files": [

23 "kix-vscode-mechanism-audit.md",

24 "bin/",

25 "scripts/",

26 "dsh/",

27 "skills/",

28 "agents/",

29 "instructions/",

30 "prompts/",

31 "memories/",

32 "plugins/",

33 "INSTALL.md",

34 "install.ps1",

35 "install.sh",

36 "README.md",

37 "README.en.md",

38 "LICENSE"

39 ],

40 "scripts": {

41 "postinstall": "node scripts/install-lib.js --quiet",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L41

42 "test:installer": "node --test scripts/install-lib.test.js",

43 "test:consistency": "node scripts/check-dsh-consistency.cjs",

44 "test:vision": "node --test dsh/vision-bridge/test.js",

45 "test": "npm run test:installer && node scripts/check-dsh-consistency.cjs && node --test dsh/vision-bridge/test.js && node dsh/preset/plugins/kix-guards.test.js && node dsh/preset/plugins/kix-commands.test.js && node dsh/preset/plugins/kix-cost.test.js && node dsh/preset/plugins/kix-route.test.js && node dsh/preset/plugins/kix-discipline.test.js && node dsh/preset/plugins/kix-orchestration.test.js && node dsh/preset/plugins/kix-focus.test.js && node dsh/preset/plugins/kix-consistency.test.js",

46 "verify:vision": "node scripts/verify-vision-bridge-resolution.cjs",

47 "verify:guards": "node scripts/verify-guards.js"

48 },

49 "engines": {

50 "node": ">=20.16.0"

51 },

52 "repository": {

53 "type": "git",

54 "url": "https://github.com/olicesx/kixparadigm.git"

55 },

56 "bugs": {

57 "url": "https://github.com/olicesx/kixparadigm/issues"

58 },

59 "homepage": "https://github.com/olicesx/kixparadigm#readme"

60}

61

plugins/kix-guards.jsView file

Lines 84-124javascript

84// - 修复「预算兜底缺口 + 静默冷启动」：plan.md 增读 blast_radius.max_commits

85// （ps1 同源字段）；优先级 progress.commit_budget > plan.task_sizing.

86// derived_commit_budget > plan.blast_radius.max_commits > 冷启动 3，

87// 落冷启动必须 warn；deny 消息注明预算来源与 sprint 目录，移除误导性

88// 的「按 DAG 重算」措辞（任务 DAG 是规划文档，不做拦截）。

89//

90// 挂载方式：preset agent.cordis.yml 中一行：

91// - id: kix-guards

92// name: ./plugins/kix-guards.js

93// 说明：本监听器按 agent scope 挂载，只拦本 preset 的会话；deny 返回 reason 由

skills/fetch-webpage/scripts/fetch-webpage.mjsView file

Lines 47-87javascript

47 if (positional.length === 0) return fail('missing URL');

48 if (!/^https?:\/\//i

bin/kixparadigm.jsView file

Lines 1-5javascript

1#!/usr/bin/env node

2'use strict'

3// kixparadigm CLI — npm 全局安装后的命令入口

4require('../scripts/install-lib.js').cli(process.argv.slice(2))

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kixparadigm.jsView on unpkg · L3

5

plugins/kix-guards.test.js#virtual:string-array:round1View file

180check("pwsh: cp 外部 → 控制平面 → allow（v12 remind）", await dispatch("pwsh", { command: `cp /tmp/settings.yaml ${HOME}/.dsh/settings.yaml` }), false) L181: check(`pwsh: curl -o ${HOME}/.dsh/settings.yaml URL → allow（v12 remind）`, await dispatch("pwsh", { command: `curl -o ${HOME}/.dsh/settings.yaml https://example.com/x` }), false) L182: check(`pwsh: curl -o /tmp/x URL → allow（v8 下载目标非控制平面）`, await dispatch("pwsh", { command: "curl -o /tmp/x https://example.com/x" }), false) ... L189: // ══ 4. run_code 代码体受限能力（v3 补 fs 直写）════════════════════════ L190: check("run_code: import(\"node:child_process\") → deny", await dispatch("run_code", { code: "const cp = await import(\"node:child_process\"); return 1" }), true) L191: check("run_code: fetch( 网络 → deny", await dispatch("run_code", { code: "co

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

plugins/kix-guards.test.js#virtual:string-array:round1View on unpkg · L180

install.shView file

•path = install.sh kind = build_helper sizeBytes = 8105 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

dsh/preset/skills/kixpower/tests/run-contract-regression.ps1View file

•path = [redacted]-contract-regression.ps1 kind = payload_in_excluded_dir sizeBytes = 56539 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dsh/preset/skills/kixpower/tests/run-contract-regression.ps1View on unpkg

dsh/preset/plugins/kix-guards.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = kixparadigm@1.2.13 matchedIdentity = npm:a2l4cGFyYWRpZ20:1.2.13 similarity = 0.880 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dsh/preset/plugins/kix-guards.jsView on unpkg