Loading npm security reports…
skykoi@2026.3.424: Clean npm security report (Allow) | LPM Firewall
Allowed — no malicious behavior detected
No malicious behavior detected. 50 low-signal pattern(s) reviewed.
scanned 3mo ago · by lpm-firewall-ai Scanner claims of remote decoded execution and command-output exfiltration are not supported by the inspected gateway bundle. The package is a broad user-invoked gateway CLI, but the inspected network, filesystem, child-process, and companion-provisioning behavior is package-aligned and credential/configuration-gated.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs the `skykoi` or `koi` CLI and configures gateway/platform credentials.
Impact
Normal application functionality; no hidden payload execution, install-time mutation, or unconsented exfiltration confirmed.
Mechanism
Authenticated platform sync and local gateway RPC.
AI rationale
Scanner claims of remote decoded execution and command-output exfiltration are not supported by the inspected gateway bundle. The package is a broad user-invoked gateway CLI, but the inspected network, filesystem, child-process, and companion-provisioning behavior is package-aligned and credential/configuration-gated.
Evidence
package.json skykoi.mjs dist/entry.js dist/gateway-cli-BofVKTqv.js dist/companions-f0MGpOCr.js dist/photon_rs-BbRbndmx.js dist/utilities-_9Lu6-4_.js
public snapshot AI called this Clean at 86.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
Evidence against
`package.json` has no preinstall/install/postinstall lifecycle hook. `skykoi.mjs` only dynamically imports the packaged `dist/entry.js` launcher. `dist/gateway-cli-BofVKTqv.js` has no direct eval/new Function call; base64 handles attachments and file RPC data. `dist/photon_rs-BbRbndmx.js` new Function is WebAssembly-bindgen glue. `dist/companions-f0MGpOCr.js` fetches authenticated configured platform companions and writes only SkyKoi workspace `SOUL.md` files. `dist/gateway-cli-BofVKTqv.js` file RPC has configured path allowlists and gateway token/password checks. Behavioral surface
Source ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem NativeBindings Network Shell WebSocket
Supply chain HighEntropyStrings Minified Obfuscated
41 flagged · loading source 20273 patternName = aws_access_key
severity = critical
line = 20273
matchedText = var Q = ...==";
20273 patternName = aws_access_key
severity = critical
line = 20273
matchedText = var Q = ...==";
5 import { t as require_proxy_from_env } from "./proxy-from-env-CPMuWsox.js";
L6: import { n as __filename, r as init_esm_shims, t as __dirname } from "./esm-shims-BBkFLhcC.js";
L7: import { t as require_source_map } from "./source-map-Bc073EWW.js";
...
L240: this.requireSize = (k, v, size, sizeCalculation) => {
L241: if (this.isBackgroundFetch(v)) return 0;
L242: if (!isPosInt(size)) if (sizeCalculation) {
...
L818: const auth = `${decodeURIComponent(proxy.username)}:${decodeURIComponent(proxy.password)}`;
L819: headers["Proxy-Authorization"] = `Basic ${Buffer.from(auth).toString("base64")}`;
L820: }
...
L1910: else this._ensureWriteable(byteLength, offsetVal);
L1911: this._buff.write(value, offsetVal, byteLength, encodingVal);
L1912: if (isInsert) this._writeOffset += byteLength;
6 Critical 8 High 29 Medium 7 Low
Critical Critical Secret dist/dist-CTPEDd1f.js
Critical Command Output Exfiltration dist/gateway-cli-BofVKTqv.js
Critical Remote Asset Decode Execute dist/gateway-cli-BofVKTqv.js
Critical Trigger Reachable Dangerous Capability dist/gateway-cli-BofVKTqv.js
Critical Secret Pattern dist/dist-CTPEDd1f.js
Critical Secret Pattern dist/plugin-sdk/dist-C2SauqMb.js
High Child Process dist/ensure-local-gateway-BqgC1YXi.js
High Shell dist/capture-service-BmaZq_Gx.js
High Eval dist/photon_rs-BbRbndmx.js
High Sandbox Evasion Gated Capability dist/daemon-runtime-DOyIH1Pi.js
High Cloud Metadata Access dist/dist-cjs-_te9LIV5.js
Affected versions and remediation This report applies to skykoi@2026.3.424 .
See all versions of skykoi for other recorded verdicts.
Review the evidence and your use of skykoi@2026.3.424 before allowing it. Restrict the permissions described in this report. Choose an independently verified alternative or release. This report does not establish that other versions are safe. Evidence last updated: 2026-07-11 05:12:43.353Z (UTC) .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced .
Telemetry
UrlStrings
Manifest No manifest risk signals triggered.
scanned 810 file(s), 21.7 MB of source, external domains: 127.0.0.1, 169.254.169.254, 169.254.170.2, 192.168.1.100, a.co, accounts.google.com, admin.googleapis.com, aistudio.google.com, albumart.url, api.anthropic.com, api.botframework.com, api.cerebras.ai, api.chutes.ai, api.deepgram.com, api.elevenlabs.io, api.firecrawl.dev, api.github.com, api.groq.com, api.individual.githubcopilot.com, api.kimi.com, api.minimax.chat, api.minimax.io, api.minimaxi.com, api.mistral.ai, api.moonshot.ai, api.moonshot.cn, api.openai.com, api.perplexity.ai, api.plivo.com, api.slack.com, api.synthetic.new, api.telnyx.com, api.twilio.com, api.us.nylas.com, api.venice.ai, api.voyageai.com, api.x.ai, api.xiaomimimo.com, attacker.azureedge.net, auth.openai.com, aws.amazon.com, bedrock-runtime.us-east-1.amazonaws.com, bot-api.zaloplatforms.com, bot.zaloplatforms.com, bun.sh, cfg.example.org, chat.example.com, chat.googleapis.com, chat.qwen.ai, chatgpt.com
Oversized source lightweight scan
dist/dist-BB9C-urG.js 2.01 MB file, sampled 256 KB
Filesystem Network ChildProcess EnvironmentVars WebSocket HighEntropyStrings UrlStrings 127.0.0.1 accounts.google.com api.anthropic.com api.cerebras.ai api.groq.com api.individual.githubcopilot.com api.kimi.com api.minimax.io api.minimaxi.com api.mistral.ai api.openai.com auth.openai.com bedrock-runtime.us-east-1.amazonaws.com chatgpt.com claude.ai cloudcode-pa.googleapis.com console.anthropic.com daily-cloudcode-pa.sandbox.googleapis.com generativelanguage.googleapis.com goo.gle oauth2.googleapis.com opencode.ai router.huggingface.co www.googleapis.com
dist/dist-BHxPTbTg.js 4.45 MB file, sampled 256 KB
Filesystem ChildProcess EnvironmentVars Crypto Shell HighEntropyStrings UrlStrings cli.github.com github.com pi.dev
dist/login-qr-Ds3L6uic.js 3.90 MB file, sampled 256 KB
Filesystem ChildProcess Eval Crypto Shell WebSocket
dist/opus-ml-BhooZTPW.js 3.91 MB file, sampled 256 KB
HighEntropyStrings
dist/plugin-sdk/index.js 8.06 MB file, sampled 256 KB
Filesystem Network ChildProcess EnvironmentVars Crypto Shell WebSocket HighEntropyStrings UrlStrings skykoi.com
dist/plugin-sdk/opus-ml-0BycUTjo.js 3.91 MB file, sampled 256 KB
HighEntropyStrings
dist/plugin-sdk/pi-model-discovery-JuZszmXp.js 5.87 MB file, sampled 256 KB
Filesystem Network ChildProcess EnvironmentVars Crypto Shell WebSocket HighEntropyStrings UrlStrings api.anthropic.com api.cerebras.ai api.github.com api.groq.com api.individual.githubcopilot.com api.kimi.com api.minimax.io api.minimaxi.com api.mistral.ai api.openai.com bedrock-runtime.us-east-1.amazonaws.com chatgpt.com cloudcode-pa.googleapis.com codeload.github.com daily-cloudcode-pa.sandbox.googleapis.com
dist/pw-ai-CtfL5yyZ.js 4.20 MB file, sampled 256 KB
Filesystem Network ChildProcess EnvironmentVars Eval Crypto DynamicRequire HighEntropyStrings UrlStrings dotenvx.com www.apache.org
dist/reply-CZqE0tz_.js 5.34 MB file, sampled 256 KB
Filesystem Network ChildProcess EnvironmentVars NativeBindings Crypto Shell HighEntropyStrings UrlStrings api.deepgram.com api.groq.com api.openai.com example.com generativelanguage.googleapis.com
Weak Crypto
Package source references weak cryptographic algorithms.
dist/dist-CTPEDd1f.js View on unpkg · L5 dist/ensure-local-gateway-BqgC1YXi.js View file 9 import { mkdirSync, openSync } from "node:fs";
L10: import { spawn } from "node:child_process";
L11: import { Writable } from "node:stream";
High Child Process
Package source references child process execution.
dist/ensure-local-gateway-BqgC1YXi.js View on unpkg · L9 1224 //#region src/capture/notification-capture.ts
L1225: const execAsync = promisify(exec);
L1226: const EXEC_TIMEOUT$1 = 5e3;
4179 module.exports.__wbg_newnoargs_e643855c6572a4a8 = function(arg0, arg1) {
L4180: return new Function(getStringFromWasm0(arg0, arg1));
L4181: };
283 */
L284: const URL$1 = __require("url");
L285: const VM = __require("vm");
Medium Dynamic Require
Package source references dynamic require/import behavior.
dist/utilities-_9Lu6-4_.js View on unpkg · L283 17 let t = (e + 42) % 256;
L18: 0 === t || 10 === t || 13 === t || 61 === t ? n.push("=" + String.fromCharCode((t + 64) % 256)) : n.push(String.fromCharCode(t));
L19: }
...
L77: const n = "Decode failed crc32 validation";
L78: throw console.error("`simple-yenc`\n", n + "\n", "Expected: " + l + "; Got: " + t + "\n", "Visit https://github.com/eshaz/simple-yenc for more information"), Error(n);
L79: }
...
L328: module.exports = threads.isMainThread ? mainThread() : workerThread();
L329: const baseUrl = URL$1.pathToFileURL(process.cwd() + "/");
L330: function mainThread() {
...
L348: let mod;
L349: if (/^data:/.test(url)) mod = url;
L350: else mod = URL$1.fileURLToPath(new URL$1.URL(url, baseUrl));
Medium Unsafe Vm Context
Package source executes code through a VM context API.
dist/utilities-_9Lu6-4_.js View on unpkg · L17 7 import fs from "node:fs/promises";
L8: import { execFile } from "node:child_process";
L9:
...
L58: try {
L59: return os.userInfo().username;
L60: } catch {
...
L67: try {
L68: const { stdout } = await runExec("loginctl", [
L69: "show-user",
...
L341: ]);
L342: if (enable.code !== 0) throw new Error(`systemctl enable failed: ${enable.stderr || enable.stdout}`.trim());
L343: const restart = await execSystemctl([
Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/systemd-CFgGi3SV.js View on unpkg · L7 68 import { a as resolveOutboundTarget, o as resolveSessionDeliveryTarget, u as normalizePollInput } from "./message-GwFjutZ2.js";
L69: import { i as [redacted], s as verifyDeviceSignature, t as deriveDeviceIdFromPublicKey } from "./device-identity-DshxI9ao.js";
L70: import { n as pickPrimaryTailnetIPv6, t as pickPrimaryTailnetIPv4 } from "./tailnet-BPpiicLt.js";
L71: import { $ as validateNodePairListParams, A as [redacted], At as ErrorCodes, B as validateKoiIdentityParams, C as validateCronUpdateParams, Ct as validateWeb...
L72: import { n as callGateway, s as loadGatewayTlsRuntime$1 } from "./call-Dxths_Q9.js";
...
L99: import "./rich-x2B2FhD6.js";
L100: import { g as isPrivateMode, h as isAudioMuted, v as setAudioMuted, y as setPrivateMode } from "./identify-B2tu_GKS.js";
L101: impor
Critical Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
dist/gateway-cli-BofVKTqv.js View on unpkg · L68 68 import { a as resolveOutboundTarget, o as resolveSessionDeliveryTarget, u as normalizePollInput } from "./message-GwFjutZ2.js";
L69: import { i as [redacted], s as verifyDeviceSignature, t as deriveDeviceIdFromPublicKey } from "./device-identity-DshxI9ao.js";
L70: import { n as pickPrimaryTailnetIPv6, t as pickPrimaryTailnetIPv4 } from "./tailnet-BPpiicLt.js";
L71: import { $ as validateNodePairListParams, A as [redacted], At as ErrorCodes, B as validateKoiIdentityParams, C as validateCronUpdateParams, Ct as validateWeb...
L72: import { n as callGateway, s as loadGatewayTlsRuntime$1 } from "./call-Dxths_Q9.js";
...
L99: import "./rich-x2B2FhD6.js";
L100: import { g as isPrivateMode, h as isAudioMuted, v as setAudioMuted, y as setPrivateMode } from "./identify-B2tu_GKS.js";
L101: impor
Critical Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/gateway-cli-BofVKTqv.js View on unpkg · L68 68 Trigger-reachable chain: manifest.main -> dist/index.js -> dist/register.subclis-BLq8-Isp.js -> dist/gateway-cli-BofVKTqv.js
L68: import { a as resolveOutboundTarget, o as resolveSessionDeliveryTarget, u as normalizePollInput } from "./message-GwFjutZ2.js";
L69: import { i as [redacted], s as verifyDeviceSignature, t as deriveDeviceIdFromPublicKey } from "./device-identity-DshxI9ao.js";
L70: import { n as pickPrimaryTailnetIPv6, t as pickPrimaryTailnetIPv4 } from "./tailnet-BPpiicLt.js";
L71: import { $ as validateNodePairListParams, A as [redacted], At as ErrorCodes, B as validateKoiIdentityParams, C as validateCronUpdateParams, Ct as validateWeb...
L72: import { n as callGateway, s as loadGatewayTlsRuntime$1 } from "./call-Dxths_Q9.js";
...
L99: import "./rich-x2B2FhD6.js";
L100: import
Critical Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/gateway-cli-BofVKTqv.js View on unpkg · L68 8 import fs from "node:fs/promises";
L9: import { execFile } from "node:child_process";
L10:
...
L97: const { execFileSync } = await import("node:child_process");
L98: const cmd = process.platform === "win32" ? "where" : "which";
L99: try {
...
L107: } catch {
L108: if (binary === "bun") throw new Error("Bun not found in PATH. Install bun: https://bun.sh");
L109: throw new Error("Node not found in PATH. Install Node 22+.");
...
L240: try {
L241: const { stdout } = await execFileImpl(nodePath, ["-p", "process.versions.node"], { encoding: "utf8" });
L242: const value = stdout.trim();
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/daemon-runtime-DOyIH1Pi.js View on unpkg · L8 64 if (response.statusCode === 200) {
L65: const parsed = JSON.parse(str);
L66: if (typeof parsed.AccessKeyId !== "string" || typeof parsed.SecretAccessKey !== "string" || typeof parsed.Token !== "string" || typeof parsed.Expiration !== "string") throw new pro...
...
L119: const AWS_CONTAINER_CREDENTIALS_RELATIVE_URI = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI";
L120: const DEFAULT_LINK_LOCAL_HOST = "http://169.254.170.2";
L121: const AWS_CONTAINER_CREDENTIALS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI";
...
L126: let host;
L127: const relative = options.[redacted] ?? process.env[AWS_CONTAINER_CREDENTIALS_RELATIVE_URI];
L128: const full = options.awsContainerCredentialsFullUri ?? process.env[AWS_CONTAINER_CREDENTIALS_FULL_URI];
High Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
dist/dist-cjs-_te9LIV5.js View on unpkg · L64 34 import os, { homedir, tmpdir } from "node:os";
L35: import { execFile, spawn } from "node:child_process";
L36: import { randomUUID } from "node:crypto";
...
L56: try {
L57: if (process.platform === "win32") {
L58: const line = `timeout /t 3 /nobreak >nul & (npm rm -g ${pkg} || pnpm rm -g ${pkg} || bun rm -g ${pkg})`;
L59: spawn(process.env.ComSpec || "cmd.exe", [
L60: "/d",
...
L109: function terminalColumns() {
L110: const cols = process.stdout?.columns;
L111: if (typeof cols === "number" && Number.isFinite(cols) && cols > 0) return Math.floor(cols);
...
L227: const stack = err instanceof Error ? err.stack ?? err.message : String(err);
High Obfuscated Payload Loader
Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.
dist/tui-D8hbxp-z.js View on unpkg · L34 21 Cross-file remote execution chain: dist/model-selection-D1Mmnjj-.js spawns dist/dist-cjs-k8wvL33J.js; helper contains network access plus dynamic code execution.
L21: import path from "node:path";
L22: import { execFileSync, execSync } from "node:child_process";
L23: import lockfile from "proper-lockfile";
...
L99: const shell = env.SHELL?.trim();
L100: return shell && shell.length > 0 ? shell : "/bin/sh";
L101: }
L102: function parseShellEnv(stdout) {
L103: const shellEnv = /* @__PURE__ */ new Map();
L104: const parts = stdout.toString("utf8").split("\0");
L105: for (const part of parts) {
...
L194: if (cachedShellPath !== void 0) return cachedShellPath;
L195: if (process.platform === "win32") {
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/model-selection-D1Mmnjj-.js View on unpkg · L21 skills/model-usage/scripts/model_usage.py View file • path = skills/model-usage/scripts/model_usage.py
kind = build_helper
sizeBytes = 10483
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
skills/model-usage/scripts/model_usage.py View on unpkg • path = dist/login-qr-Ds3L6uic.js
kind = oversized_source_file
sizeBytes = 4092116
magicHex = [redacted]
High Oversized Source File
Package contains source files above the static scanner size ceiling.
dist/login-qr-Ds3L6uic.js View on unpkg 22264 patternName = aws_access_key
severity = critical
line = 22264
matchedText = var Q = ...==";
Critical Secret Pattern
AWS access key ID in dist/plugin-sdk/dist-C2SauqMb.js
dist/plugin-sdk/dist-C2SauqMb.js View on unpkg · L22264 5594 patternName = generic_password
severity = medium
line = 5594
matchedText = password...d]",
2191 patternName = generic_password
severity = medium
line = 2191
matchedText = password...rd",
80 patternName = generic_password
severity = medium
line = 80
matchedText = auth: { ..." },
Medium Secret Pattern
Hardcoded password in docs/zh-CN/gateway/tailscale.md
docs/zh-CN/gateway/tailscale.md View on unpkg · L80 2967 patternName = generic_password
severity = medium
line = 2967
matchedText = password...rd",
Medium Secret Pattern
Hardcoded password in docs/zh-CN/gateway/configuration.md
docs/zh-CN/gateway/configuration.md View on unpkg · L2967 43 patternName = generic_password
severity = medium
line = 43
matchedText = password...rd",
Medium Secret Pattern
Hardcoded password in docs/zh-CN/channels/bluebubbles.md
docs/zh-CN/channels/bluebubbles.md View on unpkg · L43 2387 patternName = generic_password
severity = medium
line = 2387
matchedText = password...rd",
81 patternName = generic_password
severity = medium
line = 81
matchedText = auth: { ..." },
Medium Secret Pattern
Hardcoded password in docs/gateway/tailscale.md
docs/gateway/tailscale.md View on unpkg · L81 3050 patternName = generic_password
severity = medium
line = 3050
matchedText = password...rd",
Medium Secret Pattern
Hardcoded password in docs/gateway/configuration.md
docs/gateway/configuration.md View on unpkg · L3050 37 patternName = generic_password
severity = medium
line = 37
matchedText = password...rd",
Medium Secret Pattern
Hardcoded password in docs/channels/bluebubbles.md
docs/channels/bluebubbles.md View on unpkg · L37 extensions/bluebubbles/src/attachments.test.ts View file 34 patternName = generic_password
severity = medium
line = 34
matchedText = password...rd",
Medium Secret Pattern
Hardcoded password in extensions/bluebubbles/src/attachments.test.ts
extensions/bluebubbles/src/attachments.test.ts View on unpkg · L34 44 patternName = generic_password
severity = medium
line = 44
matchedText = password...rd",
Medium Secret Pattern
Hardcoded password in extensions/bluebubbles/src/attachments.test.ts
extensions/bluebubbles/src/attachments.test.ts View on unpkg · L44 76 patternName = generic_password
severity = medium
line = 76
matchedText = password...rd",
Medium Secret Pattern
Hardcoded password in extensions/bluebubbles/src/attachments.test.ts
extensions/bluebubbles/src/attachments.test.ts View on unpkg · L76 98 patternName = generic_password
severity = medium
line = 98
matchedText = password...rd",
Medium Secret Pattern
Hardcoded password in extensions/bluebubbles/src/attachments.test.ts
extensions/bluebubbles/src/attachments.test.ts View on unpkg · L98 228 patternName = generic_password
severity = medium
line = 228
matchedText = password...rd",
Medium Secret Pattern
Hardcoded password in extensions/bluebubbles/src/attachments.test.ts
extensions/bluebubbles/src/attachments.test.ts View on unpkg · L228 extensions/bluebubbles/src/send.test.ts View file 847 patternName = generic_password
severity = medium
line = 847
matchedText = password...ss",
Medium Secret Pattern
Hardcoded password in extensions/bluebubbles/src/send.test.ts
extensions/bluebubbles/src/send.test.ts View on unpkg · L847 extensions/bluebubbles/src/monitor.test.ts View file 241 patternName = generic_password
severity = medium
line = 241
matchedText = password...rd",
Medium Secret Pattern
Hardcoded password in extensions/bluebubbles/src/monitor.test.ts
extensions/bluebubbles/src/monitor.test.ts View on unpkg · L241 439 patternName = generic_password
severity = medium
line = 439
matchedText = const ac... });
Medium Secret Pattern
Hardcoded password in extensions/bluebubbles/src/monitor.test.ts
extensions/bluebubbles/src/monitor.test.ts View on unpkg · L439 475 patternName = generic_password
severity = medium
line = 475
matchedText = const ac... });
Medium Secret Pattern
Hardcoded password in extensions/bluebubbles/src/monitor.test.ts
extensions/bluebubbles/src/monitor.test.ts View on unpkg · L475 515 patternName = generic_password
severity = medium
line = 515
matchedText = const ac... });
Medium Secret Pattern
Hardcoded password in extensions/bluebubbles/src/monitor.test.ts
extensions/bluebubbles/src/monitor.test.ts View on unpkg · L515 550 patternName = generic_password
severity = medium
line = 550
matchedText = const ac... });
Medium Secret Pattern
Hardcoded password in extensions/bluebubbles/src/monitor.test.ts
extensions/bluebubbles/src/monitor.test.ts View on unpkg · L550 extensions/bluebubbles/src/actions.test.ts View file 72 patternName = generic_password
severity = medium
line = 72
matchedText = password...rd",
Medium Secret Pattern
Hardcoded password in extensions/bluebubbles/src/actions.test.ts
extensions/bluebubbles/src/actions.test.ts View on unpkg · L72 86 patternName = generic_password
severity = medium
line = 86
matchedText = password...rd",
Medium Secret Pattern
Hardcoded password in extensions/bluebubbles/src/actions.test.ts
extensions/bluebubbles/src/actions.test.ts View on unpkg · L86 High Obfuscated Payload Loader dist/tui-D8hbxp-z.js
High Cross File Remote Execution Context dist/model-selection-D1Mmnjj-.js
High Oversized Source File dist/login-qr-Ds3L6uic.js
Medium Dynamic Require dist/utilities-_9Lu6-4_.js
Medium Unsafe Vm Context dist/utilities-_9Lu6-4_.js
Medium Install Persistence dist/systemd-CFgGi3SV.js
Medium Ships Build Helper skills/model-usage/scripts/model_usage.py
Medium Structural Risk Force Deep Review
Medium Secret Pattern dist/esm-BWVLPcrG.js
Medium Secret Pattern docs/zh-CN/help/faq.md
Medium Secret Pattern docs/zh-CN/gateway/tailscale.md
Medium Secret Pattern docs/zh-CN/gateway/configuration.md
Medium Secret Pattern docs/zh-CN/channels/bluebubbles.md
Medium Secret Pattern docs/help/faq.md
Medium Secret Pattern docs/gateway/tailscale.md
Medium Secret Pattern docs/gateway/configuration.md
Medium Secret Pattern docs/channels/bluebubbles.md
Medium Secret Pattern extensions/bluebubbles/src/attachments.test.ts
Medium Secret Pattern extensions/bluebubbles/src/attachments.test.ts
Medium Secret Pattern extensions/bluebubbles/src/attachments.test.ts
Medium Secret Pattern extensions/bluebubbles/src/attachments.test.ts
Medium Secret Pattern extensions/bluebubbles/src/attachments.test.ts
Medium Secret Pattern extensions/bluebubbles/src/send.test.ts
Medium Secret Pattern extensions/bluebubbles/src/monitor.test.ts
Medium Secret Pattern extensions/bluebubbles/src/monitor.test.ts
Medium Secret Pattern extensions/bluebubbles/src/monitor.test.ts
Medium Secret Pattern extensions/bluebubbles/src/monitor.test.ts
Medium Secret Pattern extensions/bluebubbles/src/monitor.test.ts
Medium Secret Pattern extensions/bluebubbles/src/actions.test.ts
Medium Secret Pattern extensions/bluebubbles/src/actions.test.ts
Low Weak Crypto dist/dist-CTPEDd1f.js
Entrypoints
main → dist/index.js exports map bin → koi, skykoi
Artifact 77.4 MB · 2,996 files 1 signature(s)
Install lifecycle No install hooks · other: android:assemble, android:install, android:run, android:test +8
Behavioral surface ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem NativeBindings Network Shell WebSocket HighEntropyStrings Minified Obfuscated Telemetry UrlStrings Manifest: clean
generativelanguage.googleapis.com
gist.githubusercontent.com
github.com
opencode.ai
router.huggingface.co
41 flagged 20273 patternName = aws_access_key
severity = critical
line = 20273
matchedText = var Q = ...==";
20273 patternName = aws_access_key
severity = critical
line = 20273
matchedText = var Q = ...==";
5 import { t as require_proxy_from_env } from "./proxy-from-env-CPMuWsox.js";
L6: import { n as __filename, r as init_esm_shims, t as __dirname } from "./esm-shims-BBkFLhcC.js";
L7: import { t as require_source_map } from "./source-map-Bc073EWW.js";
...
L240: this.requireSize = (k, v, size, sizeCalculation) => {
L241: if (this.isBackgroundFetch(v)) return 0;
L242: if (!isPosInt(size)) if (sizeCalculation) {
...
L818: const auth = `${decodeURIComponent(proxy.username)}:${decodeURIComponent(proxy.password)}`;
L819: headers["Proxy-Authorization"] = `Basic ${Buffer.from(auth).toString("base64")}`;
L820: }
...
L1910: else this._ensureWriteable(byteLength, offsetVal);
L1911: this._buff.write(value, offsetVal, byteLength, encodingVal);
L1912: if (isInsert) this._writeOffset += byteLength;
Low Weak Crypto
Package source references weak cryptographic algorithms.
dist/dist-CTPEDd1f.js View on unpkg · L5 dist/ensure-local-gateway-BqgC1YXi.js View file 9 import { mkdirSync, openSync } from "node:fs";
L10: import { spawn } from "node:child_process";
L11: import { Writable } from "node:stream";
High Child Process
Package source references child process execution.
dist/ensure-local-gateway-BqgC1YXi.js View on unpkg · L9 1224 //#region src/capture/notification-capture.ts
L1225: const execAsync = promisify(exec);
L1226: const EXEC_TIMEOUT$1 = 5e3;
4179 module.exports.__wbg_newnoargs_e643855c6572a4a8 = function(arg0, arg1) {
L4180: return new Function(getStringFromWasm0(arg0, arg1));
L4181: };
283 */
L284: const URL$1 = __require("url");
L285: const VM = __require("vm");
Medium Dynamic Require
Package source references dynamic require/import behavior.
dist/utilities-_9Lu6-4_.js View on unpkg · L283 17 let t = (e + 42) % 256;
L18: 0 === t || 10 === t || 13 === t || 61 === t ? n.push("=" + String.fromCharCode((t + 64) % 256)) : n.push(String.fromCharCode(t));
L19: }
...
L77: const n = "Decode failed crc32 validation";
L78: throw console.error("`simple-yenc`\n", n + "\n", "Expected: " + l + "; Got: " + t + "\n", "Visit https://github.com/eshaz/simple-yenc for more information"), Error(n);
L79: }
...
L328: module.exports = threads.isMainThread ? mainThread() : workerThread();
L329: const baseUrl = URL$1.pathToFileURL(process.cwd() + "/");
L330: function mainThread() {
...
L348: let mod;
L349: if (/^data:/.test(url)) mod = url;
L350: else mod = URL$1.fileURLToPath(new URL$1.URL(url, baseUrl));
Medium Unsafe Vm Context
Package source executes code through a VM context API.
dist/utilities-_9Lu6-4_.js View on unpkg · L17 7 import fs from "node:fs/promises";
L8: import { execFile } from "node:child_process";
L9:
...
L58: try {
L59: return os.userInfo().username;
L60: } catch {
...
L67: try {
L68: const { stdout } = await runExec("loginctl", [
L69: "show-user",
...
L341: ]);
L342: if (enable.code !== 0) throw new Error(`systemctl enable failed: ${enable.stderr || enable.stdout}`.trim());
L343: const restart = await execSystemctl([
Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/systemd-CFgGi3SV.js View on unpkg · L7 68 import { a as resolveOutboundTarget, o as resolveSessionDeliveryTarget, u as normalizePollInput } from "./message-GwFjutZ2.js";
L69: import { i as [redacted], s as verifyDeviceSignature, t as deriveDeviceIdFromPublicKey } from "./device-identity-DshxI9ao.js";
L70: import { n as pickPrimaryTailnetIPv6, t as pickPrimaryTailnetIPv4 } from "./tailnet-BPpiicLt.js";
L71: import { $ as validateNodePairListParams, A as [redacted], At as ErrorCodes, B as validateKoiIdentityParams, C as validateCronUpdateParams, Ct as validateWeb...
L72: import { n as callGateway, s as loadGatewayTlsRuntime$1 } from "./call-Dxths_Q9.js";
...
L99: import "./rich-x2B2FhD6.js";
L100: import { g as isPrivateMode, h as isAudioMuted, v as setAudioMuted, y as setPrivateMode } from "./identify-B2tu_GKS.js";
L101: impor
Critical Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
dist/gateway-cli-BofVKTqv.js View on unpkg · L68 68 import { a as resolveOutboundTarget, o as resolveSessionDeliveryTarget, u as normalizePollInput } from "./message-GwFjutZ2.js";
L69: import { i as [redacted], s as verifyDeviceSignature, t as deriveDeviceIdFromPublicKey } from "./device-identity-DshxI9ao.js";
L70: import { n as pickPrimaryTailnetIPv6, t as pickPrimaryTailnetIPv4 } from "./tailnet-BPpiicLt.js";
L71: import { $ as validateNodePairListParams, A as [redacted], At as ErrorCodes, B as validateKoiIdentityParams, C as validateCronUpdateParams, Ct as validateWeb...
L72: import { n as callGateway, s as loadGatewayTlsRuntime$1 } from "./call-Dxths_Q9.js";
...
L99: import "./rich-x2B2FhD6.js";
L100: import { g as isPrivateMode, h as isAudioMuted, v as setAudioMuted, y as setPrivateMode } from "./identify-B2tu_GKS.js";
L101: impor
Critical Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/gateway-cli-BofVKTqv.js 8 import fs from "node:fs/promises";
L9: import { execFile } from "node:child_process";
L10:
...
L97: const { execFileSync } = await import("node:child_process");
L98: const cmd = process.platform === "win32" ? "where" : "which";
L99: try {
...
L107: } catch {
L108: if (binary === "bun") throw new Error("Bun not found in PATH. Install bun: https://bun.sh");
L109: throw new Error("Node not found in PATH. Install Node 22+.");
...
L240: try {
L241: const { stdout } = await execFileImpl(nodePath, ["-p", "process.versions.node"], { encoding: "utf8" });
L242: const value = stdout.trim();
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/daemon-runtime-DOyIH1Pi.js View on unpkg · L8 64 if (response.statusCode === 200) {
L65: const parsed = JSON.parse(str);
L66: if (typeof parsed.AccessKeyId !== "string" || typeof parsed.SecretAccessKey !== "string" || typeof parsed.Token !== "string" || typeof parsed.Expiration !== "string") throw new pro...
...
L119: const AWS_CONTAINER_CREDENTIALS_RELATIVE_URI = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI";
L120: const DEFAULT_LINK_LOCAL_HOST = "http://169.254.170.2";
L121: const AWS_CONTAINER_CREDENTIALS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI";
...
L126: let host;
L127: const relative = options.[redacted] ?? process.env[AWS_CONTAINER_CREDENTIALS_RELATIVE_URI];
L128: const full = options.awsContainerCredentialsFullUri ?? process.env[AWS_CONTAINER_CREDENTIALS_FULL_URI];
High Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
dist/dist-cjs-_te9LIV5.js View on unpkg · L64 34 import os, { homedir, tmpdir } from "node:os";
L35: import { execFile, spawn } from "node:child_process";
L36: import { randomUUID } from "node:crypto";
...
L56: try {
L57: if (process.platform === "win32") {
L58: const line = `timeout /t 3 /nobreak >nul & (npm rm -g ${pkg} || pnpm rm -g ${pkg} || bun rm -g ${pkg})`;
L59: spawn(process.env.ComSpec || "cmd.exe", [
L60: "/d",
...
L109: function terminalColumns() {
L110: const cols = process.stdout?.columns;
L111: if (typeof cols === "number" && Number.isFinite(cols) && cols > 0) return Math.floor(cols);
...
L227: const stack = err instanceof Error ? err.stack ?? err.message : String(err);
High Obfuscated Payload Loader
Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.
dist/tui-D8hbxp-z.js View on unpkg · L34 21 Cross-file remote execution chain: dist/model-selection-D1Mmnjj-.js spawns dist/dist-cjs-k8wvL33J.js; helper contains network access plus dynamic code execution.
L21: import path from "node:path";
L22: import { execFileSync, execSync } from "node:child_process";
L23: import lockfile from "proper-lockfile";
...
L99: const shell = env.SHELL?.trim();
L100: return shell && shell.length > 0 ? shell : "/bin/sh";
L101: }
L102: function parseShellEnv(stdout) {
L103: const shellEnv = /* @__PURE__ */ new Map();
L104: const parts = stdout.toString("utf8").split("\0");
L105: for (const part of parts) {
...
L194: if (cachedShellPath !== void 0) return cachedShellPath;
L195: if (process.platform === "win32") {
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/model-selection-D1Mmnjj-.js View on unpkg · L21 skills/model-usage/scripts/model_usage.py View file • path = skills/model-usage/scripts/model_usage.py
kind = build_helper
sizeBytes = 10483
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
skills/model-usage/scripts/model_usage.py View on unpkg • path = dist/login-qr-Ds3L6uic.js
kind = oversized_source_file
sizeBytes = 4092116
magicHex = [redacted]
High Oversized Source File
Package contains source files above the static scanner size ceiling.
dist/login-qr-Ds3L6uic.js View on unpkg 22264 patternName = aws_access_key
severity = critical
line = 22264
matchedText = var Q = ...==";
Critical Secret Pattern
AWS access key ID in dist/plugin-sdk/dist-C2SauqMb.js
dist/plugin-sdk/dist-C2SauqMb.js View on unpkg · L22264 5594 patternName = generic_password
severity = medium
line = 5594
matchedText = password...d]",
2191 patternName = generic_password
severity = medium
line = 2191
matchedText = password...rd",
80 patternName = generic_password
severity = medium
line = 80
matchedText = auth: { ..." },
Medium Secret Pattern
Hardcoded password in docs/zh-CN/gateway/tailscale.md
docs/zh-CN/gateway/tailscale.md View on unpkg · L80 2967 patternName = generic_password
severity = medium
line = 2967
matchedText = password...rd",
Medium Secret Pattern
Hardcoded password in docs/zh-CN/gateway/configuration.md
docs/zh-CN/gateway/configuration.md View on unpkg · L2967 43 patternName = generic_password
severity = medium
line = 43
matchedText = password...rd",
Medium Secret Pattern
Hardcoded password in docs/zh-CN/channels/bluebubbles.md
docs/zh-CN/channels/bluebubbles.md View on unpkg · L43 2387 patternName = generic_password
severity = medium
line = 2387
matchedText = password...rd",
81 patternName = generic_password
severity = medium
line = 81
matchedText = auth: { ..." },
Medium Secret Pattern
Hardcoded password in docs/gateway/tailscale.md
docs/gateway/tailscale.md View on unpkg · L81 3050 patternName = generic_password
severity = medium
line = 3050
matchedText = password...rd",
Medium Secret Pattern
Hardcoded password in docs/gateway/configuration.md
docs/gateway/configuration.md View on unpkg · L3050 37 patternName = generic_password
severity = medium
line = 37
matchedText = password...rd",
Medium Secret Pattern
Hardcoded password in docs/channels/bluebubbles.md
docs/channels/bluebubbles.md View on unpkg · L37 extensions/bluebubbles/src/attachments.test.ts View file 34 patternName = generic_password
severity = medium
line = 34
matchedText = password...rd",
Medium Secret Pattern
Hardcoded password in extensions/bluebubbles/src/attachments.test.ts
extensions/bluebubbles/src/attachments.test.ts View on unpkg · L34 44 patternName = generic_password
severity = medium
line = 44
matchedText = password...rd",
Medium Secret Pattern
Hardcoded password in extensions/bluebubbles/src/attachments.test.ts
extensions/bluebubbles/src/attachments.test.ts View on unpkg · L44 76 patternName = generic_password
severity = medium
line = 76
matchedText = password...rd",
Medium Secret Pattern
Hardcoded password in extensions/bluebubbles/src/attachments.test.ts
extensions/bluebubbles/src/attachments.test.ts View on unpkg · L76 98 patternName = generic_password
severity = medium
line = 98
matchedText = password...rd",
extensions/bluebubbles/src/send.test.ts View file 847 patternName = generic_password
severity = medium
line = 847
matchedText = password...ss",
Medium Secret Pattern
Hardcoded password in extensions/bluebubbles/src/send.test.ts
extensions/bluebubbles/src/send.test.ts View on unpkg · L847 extensions/bluebubbles/src/monitor.test.ts View file 241 patternName = generic_password
severity = medium
line = 241
matchedText = password...rd",
Medium Secret Pattern
Hardcoded password in extensions/bluebubbles/src/monitor.test.ts
extensions/bluebubbles/src/monitor.test.ts View on unpkg · L241 439 patternName = generic_password
severity = medium
line = 439
matchedText = const ac... });
Medium Secret Pattern
Hardcoded password in extensions/bluebubbles/src/monitor.test.ts
extensions/bluebubbles/src/monitor.test.ts View on unpkg · L439 475 patternName = generic_password
severity = medium
line = 475
matchedText = const ac... });
Medium Secret Pattern
Hardcoded password in extensions/bluebubbles/src/monitor.test.ts
extensions/bluebubbles/src/monitor.test.ts View on unpkg · L475 515 patternName = generic_password
severity = medium
line = 515
matchedText = const ac... });
extensions/bluebubbles/src/actions.test.ts View file 72 patternName = generic_password
severity = medium
line = 72
matchedText = password...rd",
Medium Secret Pattern
Hardcoded password in extensions/bluebubbles/src/actions.test.ts
extensions/bluebubbles/src/actions.test.ts View on unpkg · L72 86 patternName = generic_password
severity = medium
line = 86
matchedText = password...rd",
Medium Secret Pattern
Hardcoded password in extensions/bluebubbles/src/actions.test.ts
extensions/bluebubbles/src/actions.test.ts View on unpkg · L86 68 Trigger-reachable chain: manifest.main -> dist/index.js -> dist/register.subclis-BLq8-Isp.js -> dist/gateway-cli-BofVKTqv.js
L68: import { a as resolveOutboundTarget, o as resolveSessionDeliveryTarget, u as normalizePollInput } from "./message-GwFjutZ2.js";
L69: import { i as [redacted], s as verifyDeviceSignature, t as deriveDeviceIdFromPublicKey } from "./device-identity-DshxI9ao.js";
L70: import { n as pickPrimaryTailnetIPv6, t as pickPrimaryTailnetIPv4 } from "./tailnet-BPpiicLt.js";
L71: import { $ as validateNodePairListParams, A as [redacted], At as ErrorCodes, B as validateKoiIdentityParams, C as validateCronUpdateParams, Ct as validateWeb...
L72: import { n as callGateway, s as loadGatewayTlsRuntime$1 } from "./call-Dxths_Q9.js";
...
L99: import "./rich-x2B2FhD6.js";
L100: import
Critical Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/gateway-cli-BofVKTqv.js View on unpkg · L68 Hardcoded password in extensions/bluebubbles/src/attachments.test.ts
extensions/bluebubbles/src/attachments.test.ts
228 patternName = generic_password
severity = medium
line = 228
matchedText = password...rd",
Medium Secret Pattern
Hardcoded password in extensions/bluebubbles/src/attachments.test.ts
extensions/bluebubbles/src/attachments.test.ts View on unpkg · L228 Hardcoded password in extensions/bluebubbles/src/monitor.test.ts
extensions/bluebubbles/src/monitor.test.ts
550 patternName = generic_password
severity = medium
line = 550
matchedText = const ac... });
Medium Secret Pattern
Hardcoded password in extensions/bluebubbles/src/monitor.test.ts
extensions/bluebubbles/src/monitor.test.ts View on unpkg · L550