kyokao@0.1.1: Suspicious npm security report (Warn)

Static Scan Results

scanned 21h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

Manifest

NoLicense

scanned 2 file(s), 967 KB of source, external domains: api.cerebras.ai, api.deepinfra.com, api.fireworks.ai, api.groq.com, api.mistral.ai, api.openai.com, api.sambanova.ai, api.together.xyz, api.x.ai, github.com, help.openai.com, integrate.api.nvidia.com, openrouter.ai, platform.openai.com

Source & flagged code

2 flagged

dist/kyokao.cjsView file

41* Constructs the CommanderError class L42: * @param {number} exitCode suggested exit code which could be used with process.exit L43: * @param {string} code an id string representing the error ... L967: var EventEmitter = require("node:events").EventEmitter; L968: var childProcess = require("node:child_process"); L969: var path = require("node:path"); ... L1016: this._outputConfiguration = { L1017: writeOut: (str2) => process2.stdout.write(str2), L1018: writeErr: (str2) => process2.stderr.write(str2), ... L1052: * @returns {Command[]} L1053: * @private L1054: */

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/kyokao.cjsView on unpkg · L41

11}; L12: var __commonJS = (cb, mod) => function __require() { L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/kyokao.cjsView on unpkg · L11

Source & flagged code

2 flagged · loading source

dist/kyokao.cjsView file

41* Constructs the CommanderError class L42: * @param {number} exitCode suggested exit code which could be used with process.exit L43: * @param {string} code an id string representing the error ... L967: var EventEmitter = require("node:events").EventEmitter; L968: var childProcess = require("node:child_process"); L969: var path = require("node:path"); ... L1016: this._outputConfiguration = { L1017: writeOut: (str2) => process2.stdout.write(str2), L1018: writeErr: (str2) => process2.stderr.write(str2), ... L1052: * @returns {Command[]} L1053: * @private L1054: */

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/kyokao.cjsView on unpkg · L41

11}; L12: var __commonJS = (cb, mod) => function __require() { L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/kyokao.cjsView on unpkg · L11

Findings

1 High4 Medium6 Low

HighSandbox Evasion Gated Capabilitydist/kyokao.cjs

MediumDynamic Requiredist/kyokao.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License