kixparadigm@1.3.8

⚠ Under review

kixparadigm — AI 自编排最小范式（认知层常驻）+ kixpower 多智能体编排 + DSH 一键导入（preset + vision-bridge + 门禁插件）

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 0.0% confidence. No malicious behavior was detected; 28 low-signal pattern(s) were surfaced and cleared.

Static reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 97 file(s), 2.42 MB of source, external domains: 127.0.0.1, a.b, api.github.com, evil.example.com, example.com, github.com, open.bigmodel.cn, x.example

Source & flagged code

20 flagged

package.jsonView file

Lines 20-60json

20 "kixparadigm": "bin/kixparadigm.js"

21 },

22 "files": [

23 "kix-vscode-mechanism-audit.md",

24 "bin/",

25 "scripts/",

26 "dsh/",

27 "skills/",

28 "agents/",

29 "instructions/",

30 "prompts/",

31 "memories/",

32 "INSTALL.md",

33 "install.ps1",

34 "install.sh",

35 "README.md",

36 "README.en.md",

37 "LICENSE"

38 ],

39 "scripts": {

40 "postinstall": "node scripts/install-lib.js --quiet",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 "test:installer": "node --test scripts/install-lib.test.js scripts/sync-dsh-preset.test.js",

42 "test:consistency": "node scripts/check-dsh-consistency.cjs",

43 "test:vision": "node --test dsh/vision-bridge/test.js",

44 "test": "npm run test:installer && node scripts/check-dsh-consistency.cjs && node --test dsh/vision-bridge/test.js && cd dsh/preset/plugins && node --test",

45 "verify:vision": "node scripts/verify-vision-bridge-resolution.cjs",

46 "verify:guards": "node scripts/verify-guards.js"

47 },

48 "engines": {

49 "node": ">=20.16.0"

50 },

51 "kixparadigm": {

52 "variants": [

53 { "id": "kixparadigm", "dir": "dsh/preset" },

54 { "id": "kixparadigm-classic", "dir": "dsh/preset-classic" }

55 ]

56 },

57 "repository": {

58 "type": "git",

59 "url": "https://github.com/olicesx/kixparadigm.git"

60 },

dsh/preset-classic/plugins/kix-guards.jsView file

Lines 132-172javascript

132// - 修复「预算兜底缺口 + 静默冷启动」：plan.md 增读 blast_radius.max_commits

133// （ps1 同源字段）；优先级 progress.commit_budget > plan.task_sizing.

134// derived_commit_budget > plan.blast_radius.max_commits > 冷启动 3，

135// 落冷启动必须 warn；deny 消息注明预算来源与 sprint 目录，移除误导性

136// 的「按 DAG 重算」措辞（任务 DAG 是规划文档，不做拦截）。

137//

138// 挂载方式：preset agent.cordis.yml 中一行：

139// - id: kix-guards

140// name: ./plugins/kix-guards.js

141// 说明：本监听器按 agent scope 挂载，只拦本 preset 的会话；deny 返回 reason 由

bin/kixparadigm.jsView file

Lines 1-5javascript

1#!/usr/bin/env node

2'use strict'

3// kixparadigm CLI — npm 全局安装后的命令入口

4require('../scripts/install-lib.js').cli(process.argv.slice(2))

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kixparadigm.jsView on unpkg · L3

scripts/install-lib.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

2'use strict'

3// kixparadigm — 跨平台安装器（preset 同步 + vision-bridge 挂载 + 卸载/自检）

4//

5// 由 npm postinstall 自动调用（--quiet），也可手动执行：

6// kixparadigm install [--preset-only] 一键导入（preset + vision-bridge）

7// kixparadigm uninstall 卸载本包安装的全部内容

8// kixparadigm doctor 自检安装状态

9// kixparadigm copilot （可选）导入 VS Code Copilot 侧

10//

install.shView file

•path = install.sh kind = build_helper sizeBytes = 8368 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

dsh/preset-classic/skills/kixpower/tests/run-contract-regression.ps1View file

•path = dsh/preset-[redacted]-contract-regression.ps1 kind = payload_in_excluded_dir sizeBytes = 55675 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dsh/preset-classic/skills/kixpower/tests/run-contract-regression.ps1View on unpkg

dsh/preset-classic/plugins/kix-discipline.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 10

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dsh/preset-classic/plugins/kix-discipline.js#virtual:normalized:round1View on unpkg

dsh/preset-classic/plugins/kix-focus.jsView file

•matchType = normalized_sha256 matchedPackage = kixparadigm-en@1.3.9 matchedPath = preset-classic-en/plugins/kix-focus.js matchedIdentity = npm:a2l4cGFyYWRpZ20tZW4:1.3.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High