Loading npm security reports…

kixparadigm@1.3.10: AI-agent control-surface risk | LPM Firewall

registry / kixparadigm / 1.3.10

kixparadigm@1.3.10

kixparadigm — AI 自编排最小范式（认知层常驻）+ kixpower 多智能体编排 + DSH 一键导入（preset + vision-bridge + 门禁插件）

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package silently changes the user's DSH agent configuration and activates an image-processing plugin. The plugin can read the DSH vision credential and transmit submitted images to a fixed external endpoint.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation triggers postinstall; later, submitting an image in the DSH web interface activates the plugin.

Impact

A package install can persist code in a broad AI-agent profile and route user image content through a third-party service.

Mechanism

Automatic DSH control-surface installation plus credentialed image forwarding.

Policy narrative

On installation, the postinstall script copies package-controlled presets into the user's DSH agent-preset directory, installs a web plugin, creates its loader link, and modifies the DSH patch configuration so the plugin loads. The loaded plugin reads the DSH vision API credential and, when a user submits images, posts those images with that credential to a third-party endpoint. This is unconsented persistence and mutation of a broad AI-agent control surface during package installation.

Rationale

The package has a concrete automatic postinstall chain that mutates DSH agent configuration and registers executable plugin code. Its later credentialed external image transmission compounds the risk.

Evidence

package.jsonscripts/install-lib.jsdsh/vision-bridge/index.js$DSH_HOME/.agent-presets/kixparadigm$DSH_HOME/.agent-presets/kixparadigm-classic

Source & flagged code

18 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-lib.js --quiet

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install-lib.js --quiet

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dsh/preset-classic/plugins/kix-guards.jsView file

9// 仍逐次经过完整 pre-execute 门禁，未知工具、终端 Git/SQL、控制平面与 GitHub L10: // 门禁均不变。残余风险如实保留：原生 fs/network/child_process 不再逐动作审计， L11: // 且 worker.terminate() 不保证回收程序派生的 OS 进程。

High

Child Process

Package source references child process execution.

dsh/preset-classic/plugins/kix-guards.jsView on unpkg · L9

skills/fetch-webpage/scripts/fetch-webpage.mjsView file

67// so go through ComSpec. L68: const out = execFileSync(process.env.ComSpec ?? 'cmd.exe', ['/c', 'npm root -g'], { encoding: 'utf8', windowsHide: true }); L69: paths.push(out.trim());

High

Shell

Package source references shell execution.

skills/fetch-webpage/scripts/fetch-webpage.mjsView on unpkg · L67

dsh/preset-classic/plugins/kix-guards.test.jsView file

199check('run_code v18: fs write API → allow', await dispatch('run_code', { code: 'const fs = await import("node:fs"); fs.writeFileSync("a","b"); return 1' }), false) L200: check('run_code v18: eval/Function/constructor → allow', await dispatch('run_code', { code: 'const a = eval("1+1"); const b = Function("return 2")(); return [a,b,new Map().construc... L201: check('run_code v18: computed capability access → allow', await dispatch('run_code', { code: 'return globalThis["process"]["env"]' }), false)

Low

Eval

Package source references a known benign dynamic code generation pattern.

dsh/preset-classic/plugins/kix-guards.test.jsView on unpkg · L199

bin/kixparadigm.jsView file

3// kixparadigm CLI — npm 全局安装后的命令入口 L4: require('../scripts/install-lib.js').cli(process.argv.slice(2))

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kixparadigm.jsView on unpkg · L3

scripts/install-lib.jsView file

17Cross-file remote execution chain: scripts/install-lib.js spawns dsh/preset/plugins/kix-guards.test.js; helper contains network access plus dynamic code execution. L17: const os = require('node:os') L18: const { spawnSync } = require('node:child_process') L19: L20: const PKG_ROOT = path.join(__dirname, '..') L21: // 各语言包的安装目标由各自 package.json 的 "kixparadigm" 段声明： L22: // { variants: [{ id, dir }, ...], bridgeDir } —— 缺省 = 中文主包行为 L23: // 旧字段 presetId/presetDir 仍受支持（等价于单元素 variants）。 L24: const PKG = JSON.parse(fs.readFileSync(path.join(PKG_ROOT, 'package.json'), 'utf8')) L25: const CFG = PKG.kixparadigm || {} ... L129: function dshHome() { L130: return process.env.DSH_HOME || path.join(os.homedir(), '.dsh') L131: }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/install-lib.jsView on unpkg · L17

install.shView file

•path = install.sh kind = build_helper sizeBytes = 8368 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

dsh/preset-classic/skills/kixpower/tests/run-contract-regression.ps1View file

•path = dsh/preset-[redacted]-contract-regression.ps1 kind = payload_in_excluded_dir sizeBytes = 55675 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dsh/preset-classic/skills/kixpower/tests/run-contract-regression.ps1View on unpkg

•matchType = normalized_sha256 matchedPackage = kixparadigm-en@1.2.20 matchedPath = [redacted]-contract-regression.ps1 matchedIdentity = npm:a2l4cGFyYWRpZ20tZW4:1.2.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dsh/preset-classic/skills/kixpower/tests/run-contract-regression.ps1View on unpkg

dsh/preset-classic/plugins/kix-discipline.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 10

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dsh/preset-classic/plugins/kix-discipline.js#virtual:normalized:round1View on unpkg

dsh/vision-bridge/index.jsView file

•matchType = normalized_sha256 matchedPackage = kixparadigm-en@1.2.20 matchedPath = bridge/index.js matchedIdentity = npm:a2l4cGFyYWRpZ20tZW4:1.2.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dsh/vision-bridge/index.jsView on unpkg

dsh/preset-classic/plugins/kix-commands.jsView file

•matchType = normalized_sha256 matchedPackage = kixparadigm-en@1.2.20 matchedPath = preset/plugins/kix-commands.js matchedIdentity = npm:a2l4cGFyYWRpZ20tZW4:1.2.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dsh/preset-classic/plugins/kix-commands.jsView on unpkg

dsh/preset-null/plugins/kix-commands.jsView file

•matchType = normalized_sha256 matchedPackage = kixparadigm-en@1.2.20 matchedPath = preset/plugins/kix-commands.js matchedIdentity = npm:a2l4cGFyYWRpZ20tZW4:1.2.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dsh/preset-null/plugins/kix-commands.jsView on unpkg

dsh/preset/plugins/kix-commands.jsView file

•matchType = normalized_sha256 matchedPackage = kixparadigm-en@1.2.20 matchedPath = preset/plugins/kix-commands.js matchedIdentity = npm:a2l4cGFyYWRpZ20tZW4:1.2.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dsh/preset/plugins/kix-commands.jsView on unpkg

dsh/vision-bridge/test.jsView file

•matchType = normalized_sha256 matchedPackage = kixparadigm-en@1.2.20 matchedPath = bridge/test.js matchedIdentity = npm:a2l4cGFyYWRpZ20tZW4:1.2.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dsh/vision-bridge/test.jsView on unpkg

skills/kixpower/tests/run-contract-regression.ps1View file

•matchType = normalized_sha256 matchedPackage = kixparadigm-en@1.2.20 matchedPath = [redacted]-contract-regression.ps1 matchedIdentity = npm:a2l4cGFyYWRpZ20tZW4:1.2.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/kixpower/tests/run-contract-regression.ps1View on unpkg

dsh/preset-classic/plugins/kix-focus.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = kixparadigm@1.2.20 matchedIdentity = npm:a2l4cGFyYWRpZ20:1.2.20 similarity = 0.630 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dsh/preset-classic/plugins/kix-focus.jsView on unpkg