SkyKoi — Koi runtime. Multi-channel gateway CLI with RPC Koi.
AI Security Review
scanned 2mo ago · by lpm-firewall-ai
Static hints conflate bundled dependency primitives and intended gateway functionality with malicious behavior. Source inspection found no install hook or concrete unconsented attack chain.
No unconsented install-time execution, exfiltration chain, or persistence was established.
Mechanism
Configured AI and gateway service integration.
AI rationale
Static hints conflate bundled dependency primitives and intended gateway functionality with malicious behavior. Source inspection found no install hook or concrete unconsented attack chain.
5import { n as require_dist$9, t as require_dist$10 } from "./dist-L9D1u2Mi.js";
L6: import { n as __filename, r as init_esm_shims, t as __dirname } from "./esm-shims-o37Ji_s9.js";
L7:
...
L239: this.requireSize = (k, v, size, sizeCalculation) => {
L240: if (this.isBackgroundFetch(v)) return 0;
L241: if (!isPosInt(size)) if (sizeCalculation) {
...
L817: const auth = `${decodeURIComponent(proxy.username)}:${decodeURIComponent(proxy.password)}`;
L818: headers["Proxy-Authorization"] = `Basic ${Buffer.from(auth).toString("base64")}`;
L819: }
...
L1909: else this._ensureWriteable(byteLength, offsetVal);
L1910: this._buff.write(value, offsetVal, byteLength, encodingVal);
L1911: if (isInsert) this._writeOffset += byteLength;
75import { a as formatTokenCount$2, i as estimateUsageCost, o as formatUsd$1, s as resolveModelCostConfig } from "./transcript-tools-C-Fq_mL_.js";
L76: import { a as minSecurity, d as resolveExecApprovalsFromFile, i as maxAsk, l as resolveSafeBins, o as recordAllowlistUse, r as evaluateShellAllowlist, s as requiresExecApproval, t ...
L77: import { a as canvasSnapshotTempPath, c as parseCameraClipPayload, d as buildNodeShellCommand, i as parseEnvPairs, l as parseCameraSnapPayload, n as screenRecordTempPath, o as pars...
L78: import { a as browserSnapshot, c as browserStop, d as fetchBrowserJson, i as browserProfiles, l as browserTabs, n as browserFocusTab, o as browserStart, r as browserOpenTab, s as b...
...
L109: import { createInterface } from "node:readline";
L110: import { createSer
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
75import { a as formatTokenCount$2, i as estimateUsageCost, o as formatUsd$1, s as resolveModelCostConfig } from "./transcript-tools-C-Fq_mL_.js";
L76: import { a as minSecurity, d as resolveExecApprovalsFromFile, i as maxAsk, l as resolveSafeBins, o as recordAllowlistUse, r as evaluateShellAllowlist, s as requiresExecApproval, t ...
L77: import { a as canvasSnapshotTempPath, c as parseCameraClipPayload, d as buildNodeShellCommand, i as parseEnvPairs, l as parseCameraSnapPayload, n as screenRecordTempPath, o as pars...
L78: import { a as browserSnapshot, c as browserStop, d as fetchBrowserJson, i as browserProfiles, l as browserTabs, n as browserFocusTab, o as browserStart, r as browserOpenTab, s as b...
...
L109: import { createInterface } from "node:readline";
L110: import { createSer
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
75Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js -> dist/reply-CIcC0unK.js
L75: import { a as formatTokenCount$2, i as estimateUsageCost, o as formatUsd$1, s as resolveModelCostConfig } from "./transcript-tools-C-Fq_mL_.js";
L76: import { a as minSecurity, d as resolveExecApprovalsFromFile, i as maxAsk, l as resolveSafeBins, o as recordAllowlistUse, r as evaluateShellAllowlist, s as requiresExecApproval, t ...
L77: import { a as canvasSnapshotTempPath, c as parseCameraClipPayload, d as buildNodeShellCommand, i as parseEnvPairs, l as parseCameraSnapPayload, n as screenRecordTempPath, o as pars...
L78: import { a as browserSnapshot, c as browserStop, d as fetchBrowserJson, i as browserProfiles, l as browserTabs, n as browserFocusTab, o as browserStart, r as bro
High
Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
11import { r as resolveWhatsAppAccount } from "./accounts-K_IsE0KT.js";
L12: import { r as init_esm_shims, t as __dirname } from "./esm-shims-BICYbQBM.js";
L13: import fs from "node:fs";
L14: import { exec } from "child_process";
L15: import { createReadStream as createReadStream$1, createWriteStream as createWriteStream$1, promises as promises$1 } from "fs";
...
L21: import * as Crypto from "crypto";
L22: import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from "crypto";
L23: import { mkdir, readFile, stat, unlink, writeFile } from "fs/promises";
L24: import WebSocket from "ws";
L25: import { randomUUID as randomUUID$1 } from "node:crypto";
...
L39: * @constructor
L40: * @private
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
•Remote response is passed to a worker and executed with Node capabilities.
dist/login-qr-DUBMdkkL.js:
import { i as __require, o as __toESM, r as __exportAll, t as __commonJSMin } from "./chunk-D_gEzPfs.js";
var require_eventemitter3 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
var require_aspromise = /* @__PURE__ */ __commonJSMin(((exports, module) => {
var require_base64 = /* @__PURE__ */ __commonJSMin(((exports) => {
var require_eventemitter = /* @__PURE__ */ __commonJSMin(((exports, module) => {
var require_float = /* @__PURE__ */ __commonJSMin(((exports, module) => {
var require_inquire$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
* Requires a module only if available.
dist/reply-CIcC0unK.js:
import { i as __require, o as __toESM, r as __exportAll, t as __commo
Critical
Remote Response Code Execution
Source passes code obtained from a remote response into a dynamic execution sink.
11import { r as resolveWhatsAppAccount } from "./accounts-K_IsE0KT.js";
L12: import { r as init_esm_shims, t as __dirname } from "./esm-shims-BICYbQBM.js";
L13: import fs from "node:fs";
L14: import { exec } from "child_process";
L15: import { createReadStream as createReadStream$1, createWriteStream as createWriteStream$1, promises as promises$1 } from "fs";
...
L21: import * as Crypto from "crypto";
L22: import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from "crypto";
L23: import { mkdir, readFile, stat, unlink, writeFile } from "fs/promises";
L24: import WebSocket from "ws";
L25: import { randomUUID as randomUUID$1 } from "node:crypto";
...
L39: * @constructor
L40: * @private
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
5import { n as require_dist$9, t as require_dist$10 } from "./dist-L9D1u2Mi.js";
L6: import { n as __filename, r as init_esm_shims, t as __dirname } from "./esm-shims-o37Ji_s9.js";
L7:
...
L239: this.requireSize = (k, v, size, sizeCalculation) => {
L240: if (this.isBackgroundFetch(v)) return 0;
L241: if (!isPosInt(size)) if (sizeCalculation) {
...
L817: const auth = `${decodeURIComponent(proxy.username)}:${decodeURIComponent(proxy.password)}`;
L818: headers["Proxy-Authorization"] = `Basic ${Buffer.from(auth).toString("base64")}`;
L819: }
...
L1909: else this._ensureWriteable(byteLength, offsetVal);
L1910: this._buff.write(value, offsetVal, byteLength, encodingVal);
L1911: if (isInsert) this._writeOffset += byteLength;
75import { a as formatTokenCount$2, i as estimateUsageCost, o as formatUsd$1, s as resolveModelCostConfig } from "./transcript-tools-C-Fq_mL_.js";
L76: import { a as minSecurity, d as resolveExecApprovalsFromFile, i as maxAsk, l as resolveSafeBins, o as recordAllowlistUse, r as evaluateShellAllowlist, s as requiresExecApproval, t ...
L77: import { a as canvasSnapshotTempPath, c as parseCameraClipPayload, d as buildNodeShellCommand, i as parseEnvPairs, l as parseCameraSnapPayload, n as screenRecordTempPath, o as pars...
L78: import { a as browserSnapshot, c as browserStop, d as fetchBrowserJson, i as browserProfiles, l as browserTabs, n as browserFocusTab, o as browserStart, r as browserOpenTab, s as b...
...
L109: import { createInterface } from "node:readline";
L110: import { createSer
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
75import { a as formatTokenCount$2, i as estimateUsageCost, o as formatUsd$1, s as resolveModelCostConfig } from "./transcript-tools-C-Fq_mL_.js";
L76: import { a as minSecurity, d as resolveExecApprovalsFromFile, i as maxAsk, l as resolveSafeBins, o as recordAllowlistUse, r as evaluateShellAllowlist, s as requiresExecApproval, t ...
L77: import { a as canvasSnapshotTempPath, c as parseCameraClipPayload, d as buildNodeShellCommand, i as parseEnvPairs, l as parseCameraSnapPayload, n as screenRecordTempPath, o as pars...
L78: import { a as browserSnapshot, c as browserStop, d as fetchBrowserJson, i as browserProfiles, l as browserTabs, n as browserFocusTab, o as browserStart, r as browserOpenTab, s as b...
...
L109: import { createInterface } from "node:readline";
L110: import { createSer
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
11import { r as resolveWhatsAppAccount } from "./accounts-K_IsE0KT.js";
L12: import { r as init_esm_shims, t as __dirname } from "./esm-shims-BICYbQBM.js";
L13: import fs from "node:fs";
L14: import { exec } from "child_process";
L15: import { createReadStream as createReadStream$1, createWriteStream as createWriteStream$1, promises as promises$1 } from "fs";
...
L21: import * as Crypto from "crypto";
L22: import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from "crypto";
L23: import { mkdir, readFile, stat, unlink, writeFile } from "fs/promises";
L24: import WebSocket from "ws";
L25: import { randomUUID as randomUUID$1 } from "node:crypto";
...
L39: * @constructor
L40: * @private
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
•Remote response is passed to a worker and executed with Node capabilities.
dist/login-qr-DUBMdkkL.js:
import { i as __require, o as __toESM, r as __exportAll, t as __commonJSMin } from "./chunk-D_gEzPfs.js";
var require_eventemitter3 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
var require_aspromise = /* @__PURE__ */ __commonJSMin(((exports, module) => {
var require_base64 = /* @__PURE__ */ __commonJSMin(((exports) => {
var require_eventemitter = /* @__PURE__ */ __commonJSMin(((exports, module) => {
var require_float = /* @__PURE__ */ __commonJSMin(((exports, module) => {
var require_inquire$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
* Requires a module only if available.
dist/reply-CIcC0unK.js:
import { i as __require, o as __toESM, r as __exportAll, t as __commo
Critical
Remote Response Code Execution
Source passes code obtained from a remote response into a dynamic execution sink.
75Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js -> dist/reply-CIcC0unK.js
L75: import { a as formatTokenCount$2, i as estimateUsageCost, o as formatUsd$1, s as resolveModelCostConfig } from "./transcript-tools-C-Fq_mL_.js";
L76: import { a as minSecurity, d as resolveExecApprovalsFromFile, i as maxAsk, l as resolveSafeBins, o as recordAllowlistUse, r as evaluateShellAllowlist, s as requiresExecApproval, t ...
L77: import { a as canvasSnapshotTempPath, c as parseCameraClipPayload, d as buildNodeShellCommand, i as parseEnvPairs, l as parseCameraSnapPayload, n as screenRecordTempPath, o as pars...
L78: import { a as browserSnapshot, c as browserStop, d as fetchBrowserJson, i as browserProfiles, l as browserTabs, n as browserFocusTab, o as browserStart, r as bro
High
Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
11import { r as resolveWhatsAppAccount } from "./accounts-K_IsE0KT.js";
L12: import { r as init_esm_shims, t as __dirname } from "./esm-shims-BICYbQBM.js";
L13: import fs from "node:fs";
L14: import { exec } from "child_process";
L15: import { createReadStream as createReadStream$1, createWriteStream as createWriteStream$1, promises as promises$1 } from "fs";
...
L21: import * as Crypto from "crypto";
L22: import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from "crypto";
L23: import { mkdir, readFile, stat, unlink, writeFile } from "fs/promises";
L24: import WebSocket from "ws";
L25: import { randomUUID as randomUUID$1 } from "node:crypto";
...
L39: * @constructor
L40: * @private
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.