kyokao: Suspicious npm security report (Warn)

Static Scan Results

scanned 8h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

Manifest

NoLicense

scanned 2 file(s), 1022 KB of source, external domains: api.cerebras.ai, api.deepinfra.com, api.fireworks.ai, api.groq.com, api.mistral.ai, api.openai.com, api.sambanova.ai, api.together.xyz, api.x.ai, github.com, help.openai.com, integrate.api.nvidia.com, openrouter.ai, platform.openai.com

Source & flagged code

3 flagged

dist/kyokao.cjsView file

41* Constructs the CommanderError class L42: * @param {number} exitCode suggested exit code which could be used with process.exit L43: * @param {string} code an id string representing the error ... L967: var EventEmitter = require("node:events").EventEmitter; L968: var childProcess = require("node:child_process"); L969: var path = require("node:path"); ... L1016: this._outputConfiguration = { L1017: writeOut: (str2) => process2.stdout.write(str2), L1018: writeErr: (str2) => process2.stderr.write(str2), ... L1052: * @returns {Command[]} L1053: * @private L1054: */

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/kyokao.cjsView on unpkg · L41

11}; L12: var __commonJS = (cb, mod) => function __require() { L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/kyokao.cjsView on unpkg · L11

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = kyokao@0.3.0 matchedIdentity = npm:a3lva2Fv:0.3.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/kyokao.cjsView file

41* Constructs the CommanderError class L42: * @param {number} exitCode suggested exit code which could be used with process.exit L43: * @param {string} code an id string representing the error ... L967: var EventEmitter = require("node:events").EventEmitter; L968: var childProcess = require("node:child_process"); L969: var path = require("node:path"); ... L1016: this._outputConfiguration = { L1017: writeOut: (str2) => process2.stdout.write(str2), L1018: writeErr: (str2) => process2.stderr.write(str2), ... L1052: * @returns {Command[]} L1053: * @private L1054: */

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/kyokao.cjsView on unpkg · L41

11}; L12: var __commonJS = (cb, mod) => function __require() { L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/kyokao.cjsView on unpkg · L11

dist/index.jsView file

•

Findings

2 High4 Medium6 Low

HighSandbox Evasion Gated Capabilitydist/kyokao.cjs

HighPrevious Version Dangerous Deltadist/index.js

MediumDynamic Requiredist/kyokao.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License