kixparadigm@1.3.11

kixparadigm — AI 自编排最小范式（认知层常驻）+ kixpower 多智能体编排 + DSH 一键导入（preset + vision-bridge + 门禁插件）

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package has a concrete automatic external AI-agent configuration mutation and a later credential-authenticated image transfer. Its source does not show a self-dependency, remote code loader, or covert broad exfiltration chain, so it warrants a warning rather than a block.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm installation triggers postinstall; later, submitting an image through the installed DSH bridge triggers the request.

Impact

A package installation changes an external AI-agent control surface, and later user-supplied images are disclosed to the vision provider.

Mechanism

Automatic DSH extension installation plus credential-authenticated image-description requests.

AI rationale

Evidence

package.jsonscripts/install-lib.jsdsh/vision-bridge/index.js$DSH_HOME/.agent-presets/kixparadigm/$DSH_HOME/.agent-presets/kixparadigm-classic/$DSH_HOME/profiles/web/plugins/dsh-vision-bridge/$DSH_HOME/profiles/web/node_modules/dsh-vision-bridge$DSH_HOME/profiles/web/cordis.patch.yml$DSH_HOME/.credentials.yaml

Network endpoints1

open.bigmodel.cn/api/coding/paas/v4/chat/completions

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The automatic postinstall runs the installer without a user command.
The installer copies full agent presets into the external DSH home directory and registers a plugin in its web profile.
The installed bridge reads a DSH API key and sends attached images with that key to a third-party endpoint.

Evidence against

No runtime self-dependency or downloaded executable payload was found.
The external request is limited to the declared image-description route, uses a fixed endpoint, and has image-size and model allow-list checks.
The package contains an uninstall path that removes its preset and bridge registration.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

Source & flagged code

22 flagged

package.jsonView file

Lines 20-60json

20 "kixparadigm": "bin/kixparadigm.js"

21 },

22 "files": [

23 "kix-vscode-mechanism-audit.md",

24 "bin/",

25 "scripts/",

26 "dsh/",

27 "skills/",

28 "agents/",

29 "instructions/",

30 "prompts/",

31 "memories/",

32 "INSTALL.md",

33 "install.ps1",

34 "install.sh",

35 "README.md",

36 "README.en.md",

37 "LICENSE"

38 ],

39 "scripts": {

40 "postinstall": "node scripts/install-lib.js --quiet",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 "test:installer": "node --test scripts/install-lib.test.js scripts/sync-dsh-preset.test.js",

42 "test:consistency": "node scripts/check-dsh-consistency.cjs",

43 "test:vision": "node --test dsh/vision-bridge/test.js",

44 "test:pressures": "node scripts/audit-selection-pressure-history.cjs --check && node --test scripts/audit-selection-pressure-history.test.js",

45 "test": "npm run test:installer && node scripts/check-dsh-consistency.cjs && npm run test:pressures && node --test dsh/vision-bridge/test.js && cd dsh/preset/plugins && node --test",

46 "audit:pressures": "node scripts/audit-selection-pressure-history.cjs",

47 "verify:vision": "node scripts/verify-vision-bridge-resolution.cjs",

48 "verify:guards": "node scripts/verify-guards.js"

49 },

50 "engines": {

51 "node": ">=20.16.0"

52 },

53 "kixparadigm": {

54 "variants": [

55 { "id": "kixparadigm", "dir": "dsh/preset" },

56 { "id": "kixparadigm-classic", "dir": "dsh/preset-classic" }

57 ]

58 },

59 "repository": {

60 "type": "git",

dsh/preset-classic/plugins/kix-guards.jsView file

Lines 1-29javascript

1// kix-guards — kixparadigm 机械门禁的 DSH 原生实现（v18，v1.3.10）

2//

3// v18（2026-08-29，用户裁决）：删除 run_code 门禁 1b 的代码体静态能力扫描。

4// DSH worker 的权威信任姿态本就是 bash-equivalent containment（每次新 worker、

5// env={}、CPU/墙钟/堆/输出上限、强制终止），而 1b 仅靠字符级 API 塑形：

6// 一边误拦安全内置模块、只读 fs.open(..., 'r') 与普通 constructor 内省，

7// 一边可被 computed property / globalThis / dynamic codegen 绕过；保护不可强制，

8// 限制却真实存在。run_code 现在完整保留 JS/TS/Node 原生能力；其 tools.* 子调用

9// 仍逐次经过完整 pre-execute 门禁，未知工具、终端 Git/SQL、控制平面与 GitHub

10// 门禁均不变。残余风险如实保留：原生 fs/network/child_process 不再逐动作审计，

skills/fetch-webpage/scripts/fetch-webpage.mjsView file

Lines 47-87javascript

47 if (positional.length === 0) return fail('missing URL');

48 if (!/^https?:\/\//i

dsh/preset-classic/plugins/kix-guards.test.jsView file

Lines 179-219javascript

179 check(`pwsh: 读 ${HOME}/.dsh/settings.yaml → allow（v8 只读放行）`, await dispatch('pwsh', { command: `Get-Content ${HOME}\\.dsh\\settings.yaml` }), false)

180 check

bin/kixparadigm.jsView file

Lines 1-5javascript

1#!/usr/bin/env node

2'use strict'

3// kixparadigm CLI — npm 全局安装后的命令入口

4require('../scripts/install-lib.js').cli(process.argv.slice(2))

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kixparadigm.jsView on unpkg · L3

scripts/install-lib.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

2'use strict'

3// kixparadigm — 跨平台安装器（preset 同步 + vision-bridge 挂载 + 卸载/自检）

4//

5// 由 npm postinstall 自动调用（--quiet），也可手动执行：

6// kixparadigm install [--preset-only] 一键导入（preset + vision-bridge）

7// kixparadigm uninstall 卸载本包安装的全部内容

8// kixparadigm doctor 自检安装状态

9// kixparadigm copilot （可选）导入 VS Code Copilot 侧

10//

install.shView file

•path = install.sh kind = build_helper sizeBytes = 8368 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

dsh/preset-classic/skills/kixpower/tests/run-contract-regression.ps1View file

•path = dsh/preset-[redacted]-contract-regression.ps1 kind = payload_in_excluded_dir sizeBytes = 55675 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dsh/preset-classic/skills/kixpower/tests/run-contract-regression.ps1View on unpkg

dsh/preset-classic/plugins/kix-discipline.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dsh/preset-classic/plugins/kix-discipline.js#virtual:normalized:round1View on unpkg

dsh/preset-classic/plugins/kix-focus.jsView file

•matchType = normalized_sha256 matchedPackage = kixparadigm@1.3.10 matchedPath = dsh/preset-classic/plugins/kix-focus.js matchedIdentity = npm:a2l4cGFyYWRpZ20:1.3.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High