kixparadigm@1.3.7

kixparadigm — AI 自编排最小范式（认知层常驻）+ kixpower 多智能体编排 + DSH 一键导入（preset + vision-bridge + 门禁插件）

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is an automatic first-party AI-agent extension installation with meaningful code-execution capability, so it warrants a warning. The inspected source does not show a concrete malicious payload, covert credential theft, or unrelated network recipient.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm installation triggers postinstall.

Impact

A user receives a new DSH agent preset, plugin mount, shell tools, and a Python execution tool without an explicit setup command.

Mechanism

Automatic DSH preset and plugin registration with agent code-execution capabilities.

AI rationale

Evidence

package.jsonscripts/install-lib.jsdsh/preset/agent.cordis.ymldsh/preset/plugins/kix-probe.js$DSH_HOME/.agent-presets/kixparadigm$DSH_HOME/.agent-presets/kixparadigm-classic$DSH_HOME/profiles/web/plugins/dsh-vision-bridge$DSH_HOME/profiles/web/node_modules/dsh-vision-bridge$DSH_HOME/profiles/web/cordis.patch.yml

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The package runs its installer automatically through a postinstall hook.
The installer copies preset content into the DSH agent-preset directory and adds a plugin mount to the DSH web profile.
The installed preset enables shell tools and registers a probe tool that runs caller-provided Python in the active workspace.
The vision component reads a named DSH credential and sends image-description requests only to a fixed BigModel endpoint.

Evidence against

No hidden endpoint, encoded payload, self-dependency, or unrelated credential recipient was found in the inspected active paths.
The credential is used for the named vision service endpoint rather than an operator-configured destination.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

20 flagged

package.jsonView file

Lines 20-60json

20 "kixparadigm": "bin/kixparadigm.js"

21 },

22 "files": [

23 "kix-vscode-mechanism-audit.md",

24 "bin/",

25 "scripts/",

26 "dsh/",

27 "skills/",

28 "agents/",

29 "instructions/",

30 "prompts/",

31 "memories/",

32 "INSTALL.md",

33 "install.ps1",

34 "install.sh",

35 "README.md",

36 "README.en.md",

37 "LICENSE"

38 ],

39 "scripts": {

40 "postinstall": "node scripts/install-lib.js --quiet",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 "test:installer": "node --test scripts/install-lib.test.js",

42 "test:consistency": "node scripts/check-dsh-consistency.cjs",

43 "test:vision": "node --test dsh/vision-bridge/test.js",

44 "test": "npm run test:installer && node scripts/check-dsh-consistency.cjs && node --test dsh/vision-bridge/test.js && cd dsh/preset/plugins && node --test",

45 "verify:vision": "node scripts/verify-vision-bridge-resolution.cjs",

46 "verify:guards": "node scripts/verify-guards.js"

47 },

48 "engines": {

49 "node": ">=20.16.0"

50 },

51 "kixparadigm": {

52 "variants": [

53 { "id": "kixparadigm", "dir": "dsh/preset" },

54 { "id": "kixparadigm-classic", "dir": "dsh/preset-classic" }

55 ]

56 },

57 "repository": {

58 "type": "git",

59 "url": "https://github.com/olicesx/kixparadigm.git"

60 },

dsh/preset-classic/plugins/kix-guards.jsView file

Lines 132-172javascript

132// - 修复「预算兜底缺口 + 静默冷启动」：plan.md 增读 blast_radius.max_commits

133// （ps1 同源字段）；优先级 progress.commit_budget > plan.task_sizing.

134// derived_commit_budget > plan.blast_radius.max_commits > 冷启动 3，

135// 落冷启动必须 warn；deny 消息注明预算来源与 sprint 目录，移除误导性

136// 的「按 DAG 重算」措辞（任务 DAG 是规划文档，不做拦截）。

137//

138// 挂载方式：preset agent.cordis.yml 中一行：

139// - id: kix-guards

140// name: ./plugins/kix-guards.js

141// 说明：本监听器按 agent scope 挂载，只拦本 preset 的会话；deny 返回 reason 由

bin/kixparadigm.jsView file

Lines 1-5javascript

1#!/usr/bin/env node

2'use strict'

3// kixparadigm CLI — npm 全局安装后的命令入口

4require('../scripts/install-lib.js').cli(process.argv.slice(2))

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kixparadigm.jsView on unpkg · L3

scripts/install-lib.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

2'use strict'

3// kixparadigm — 跨平台安装器（preset 同步 + vision-bridge 挂载 + 卸载/自检）

4//

5// 由 npm postinstall 自动调用（--quiet），也可手动执行：

6// kixparadigm install [--preset-only] 一键导入（preset + vision-bridge）

7// kixparadigm uninstall 卸载本包安装的全部内容

8// kixparadigm doctor 自检安装状态

9// kixparadigm copilot （可选）导入 VS Code Copilot 侧

10//

install.shView file

•path = install.sh kind = build_helper sizeBytes = 8368 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

dsh/preset-classic/skills/kixpower/tests/run-contract-regression.ps1View file

•path = dsh/preset-[redacted]-contract-regression.ps1 kind = payload_in_excluded_dir sizeBytes = 55675 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dsh/preset-classic/skills/kixpower/tests/run-contract-regression.ps1View on unpkg

dsh/preset-classic/plugins/kix-discipline.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dsh/preset-classic/plugins/kix-discipline.js#virtual:normalized:round1View on unpkg

dsh/vision-bridge/index.jsView file

•matchType = normalized_sha256 matchedPackage = kixparadigm-en@1.3.9 matchedPath = bridge/index.js matchedIdentity = npm:a2l4cGFyYWRpZ20tZW4:1.3.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High