skykoi@2026.3.573: Clean npm security report (Allow)

Loading npm security reports…

skykoi@2026.3.573: Clean npm security report (Allow) | LPM Firewall

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 859 file(s), 22.4 MB of source, external domains: 127.0.0.1, 169.254.169.254, 169.254.170.2, 192.168.1.100, a.co, accounts.google.com, admin.googleapis.com, aistudio.google.com, albumart.url, api.anthropic.com, api.botframework.com, api.cerebras.ai, api.chutes.ai, api.deepgram.com, api.firecrawl.dev, api.github.com, api.groq.com, api.individual.githubcopilot.com, api.kimi.com, api.minimax.chat, api.minimax.io, api.minimaxi.com, api.mistral.ai, api.moonshot.ai, api.moonshot.cn, api.openai.com, api.perplexity.ai, api.plivo.com, api.slack.com, api.synthetic.new, api.telnyx.com, api.twilio.com, api.us.nylas.com, api.venice.ai, api.voyageai.com, api.x.ai, api.xiaomimimo.com, attacker.azureedge.net, auth.openai.com, aws.amazon.com, bedrock-runtime.us-east-1.amazonaws.com, bot-api.zaloplatforms.com, bot.zaloplatforms.com, bun.sh, cfg.example.org, chat.example.com, chat.googleapis.com, chat.qwen.ai, chatgpt.com, chutes.ai

Oversized source lightweight scan

dist/dist-C53i5oqF.js2.01 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsWebSocketHighEntropyStringsUrlStrings127.0.0.1accounts.google.comapi.anthropic.comapi.cerebras.aiapi.groq.comapi.individual.githubcopilot.comapi.kimi.comapi.minimax.ioapi.minimaxi.comapi.mistral.aiapi.openai.comauth.openai.combedrock-runtime.us-east-1.amazonaws.comchatgpt.comclaude.aicloudcode-pa.googleapis.comconsole.anthropic.comdaily-cloudcode-pa.sandbox.googleapis.comgenerativelanguage.googleapis.comgoo.gleoauth2.googleapis.comopencode.airouter.huggingface.cowww.googleapis.com

dist/dist-VO62Er4I.js4.45 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsCryptoShellHighEntropyStringsUrlStringscli.github.comgithub.compi.dev

dist/login-qr-AWeYd_2Y.js3.90 MB file, sampled 256 KB

FilesystemChildProcessEvalCryptoShellWebSocket

dist/opus-ml-DxEzSl7C.js3.91 MB file, sampled 256 KB

HighEntropyStrings

dist/plugin-sdk/index.js8.14 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoShellWebSocketHighEntropyStringsUrlStringsskykoi.com

dist/plugin-sdk/opus-ml-DbnGLBEn.js3.91 MB file, sampled 256 KB

HighEntropyStrings

dist/plugin-sdk/pi-model-discovery-CGBXPZE-.js5.87 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoShellWebSocketHighEntropyStringsUrlStringsapi.anthropic.comapi.cerebras.aiapi.github.comapi.groq.comapi.individual.githubcopilot.comapi.kimi.comapi.minimax.ioapi.minimaxi.comapi.mistral.aiapi.openai.combedrock-runtime.us-east-1.amazonaws.comchatgpt.comcloudcode-pa.googleapis.comcodeload.github.comdaily-cloudcode-pa.sandbox.googleapis.com

dist/pw-session-D_7D96az.js4.16 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsEvalDynamicRequireHighEntropyStringsUrlStringsdotenvx.comwww.apache.org

dist/reply-B36m21zy.js5.46 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsNativeBindingsCryptoShellHighEntropyStringsUrlStringsapi.deepgram.comapi.groq.comapi.openai.comexample.comgenerativelanguage.googleapis.comwww.skykoi.com

Source & flagged code

33 flagged

dist/esm-74jbv3SC.jsView file

Lines 5574-5614javascript

5574//#endregion

5575//#region node_modules/.pnpm/css-select@5.2.2/node_modules/css-select/lib/esm/pseudo-selectors/aliases.js

5576/**

5577* Aliases are pseudos that are expressed as selectors.

5578*/

5579const aliases = {

5580 "any-link": ":is(a, area, link)[href]",

5581 link: ":any-link:not(:visited)",

5582 disabled: `:is(

5583 :is(button, input, select, textarea, optgroup, option)[disabled],

5584 optgroup[disabled] > option,

5585 fieldset[disabled]:not(fieldset[disabled] legend:first-of-type *)

5586 )`,

5587 enabled: ":not(:disabled)",

5588 checked: ":is(:is(input[type=radio], input[type=checkbox])[checked], option:selected)",

5589 required: ":is(input, select, textarea)[required]",

5590 optional: ":is(input, select, textarea):not([required])",

5591 selected: "option:is([selected], select:not([multiple]):not(:has(> option[selected])) > :first-of-type)",

5592 checkbox: "[type=checkbox]",

5593 file: "[type=file]",

5594 password: "[type=password]",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/esm-74jbv3SC.jsView on unpkg · L5594

5595 radio: "[type=radio]",

5596 reset: "[type=reset]",

5597 image: "[type=image]",

5598 submit: "[type=submit]",

5599 parent: ":not(:empty)",

5600 header: ":is(h1, h2, h3, h4, h5, h6)",

5601 button: ":is(button, input[type=button])",

5602 input: ":is(input, textarea, select, button)",

5603 text: "input:is(:not([type!='']), [type=text])"

5604};

5605

5606//#endregion

5607//#region node_modules/.pnpm/css-select@5.2.2/node_modules/css-select/lib/esm/pseudo-selectors/subselects.js

5608/** Used as a placeholder for :has. Will be replaced with the actual element. */

5609const PLACEHOLDER_ELEMENT = {};

5610function ensureIsTag(next, adapter) {

5611 if (next === import_boolbase.default.falseFunc) return import_boolbase.default.falseFunc;

5612 return (elem) => adapter.isTag(elem) && next(elem);

5613}

5614function getNextSiblings(elem, adapter) {

dist/learned-skills-Z9qUAa-y.jsView file

Lines 1-26javascript

1import { r as __exportAll } from "./chunk-D_gEzPfs.js";

2import { t as createSubsystemLogger } from "./subsystem-C9EJTll_.js";

3import { n as openForeground } from "./foreground-Bnqqz2FR.js";

dist/login-qr-AWeYd_2Y.jsView file

•Remote response is passed to a worker and executed with Node capabilities. dist/login-qr-AWeYd_2Y.js: import { i as __require, o as __toESM, r as __exportAll, t as __commonJSMin } from "./chunk-D_gEzPfs.js"; var require_eventemitter3 = /* @__PURE__ */ __commonJSMin(((exports, module) => { var require_aspromise = /* @__PURE__ */ __commonJSMin(((exports, module) => { var require_base64 = /* @__PURE__ */ __commonJSMin(((exports) => { var require_eventemitter = /* @__PURE__ */ __commonJSMin(((exports, module) => { var require_float = /* @__PURE__ */ __commonJSMin(((exports, module) => { var require_inquire$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => { * Requires a module only if available. dist/reply-B36m21zy.js: import { i as __require, o as __toESM, r as __exportAll, t as __commo

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist/login-qr-AWeYd_2Y.jsView on unpkg

•Trigger-reachable chain: manifest.main -> dist/index.js -> dist/login-qr-AWeYd_2Y.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/login-qr-AWeYd_2Y.jsView on unpkg

763try { L764: var mod = eval("quire".replace(/^/, "re"))(moduleName); L765: if (mod && (mod.length || Object.keys(mod).length)) return mod;

High

Eval

Package source references dynamic code evaluation.

dist/gateway-cli-ML8fx2rd.jsView file

73import { a as resolveOutboundTarget, o as resolveSessionDeliveryTarget, u as normalizePollInput } from "./message-CgZk2rsI.js"; L74: import { i as [redacted], s as verifyDeviceSignature, t as deriveDeviceIdFromPublicKey } from "./device-identity-R2uZ_n0v.js"; L75: import { n as pickPrimaryTailnetIPv6, t as pickPrimaryTailnetIPv4 } from "./tailnet-Cr3uILr_.js"; L76: import { $ as validateNodePairListParams, A as [redacted], At as ErrorCodes, B as validateKoiIdentityParams, C as validateCronUpdateParams, Ct as validateWeb... L77: import { n as callGateway, s as loadGatewayTlsRuntime$1 } from "./call-BxUgmcmA.js"; ... L111: import "./graph-access-CVMrfC5i.js"; L112: import { _ as setAudioMuted, m as isPrivateMode, p as isAudioMuted, v as setPrivateMode } from "./identify-kWDt7trc.js"; L1

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/gateway-cli-ML8fx2rd.jsView on unpkg · L73

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/gateway-cli-ML8fx2rd.js: import { $t as OPENAI_TTS_MODELS, An as DEFAULT_INPUT_PDF_MAX_PIXELS, At as getChannelActivity, B as inferLegacyName, Bt as findSubkoiRunByRunId, C as readRecentActivity, Cn as DEF... import fs, { chmodSync, constants, copyFileSync, createReadStream, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlink... await fs$1.writeFile(statePath, JSON.stringify(state, null, 2), "utf-8"); await fs$1.writeFile(tmp, `${kept.join("\n")}\n`, "utf-8"); await fs.promises.writeFile(tmp, json, "utf-8"); Authorization: `Bearer ${token}` headers: { Authorization: `Be

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/systemd-CVE-d5EQ.jsView file

Lines 1-27javascript

1import { g as resolveGatewaySystemdServiceName, i as resolveHomeDir, p as formatGatewayServiceDescription } from "./home-CDe_CxBN.js";

2import { n as isRich, r as theme, t as colorize } from "./theme-CF1-tqcX.js";

3import

dist/reply-B36m21zy.jsView file

76import { a as formatTokenCount$2, i as estimateUsageCost, o as formatUsd$1, s as resolveModelCostConfig } from "./transcript-tools-UfIShVfz.js"; L77: import { a as minSecurity, d as resolveExecApprovalsFromFile, i as maxAsk, l as resolveSafeBins, o as recordAllowlistUse, r as evaluateShellAllowlist, s as requiresExecApproval, t ... L78: import { a as canvasSnapshotTempPath, c as parseCameraClipPayload, d as buildNodeShellCommand, i as parseEnvPairs, l as parseCameraSnapPayload, n as screenRecordTempPath, o as pars... L79: import { a as browserSnapshot, c as browserStop, d as fetchBrowserJson, i as browserProfiles, l as browserTabs, n as browserFocusTab, o as browserStart, r as browserOpenTab, s as b... ... L112: import { createInterface } from "node:readline"; L113: import { createSer

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/reply-B36m21zy.jsView on unpkg · L76

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/reply-B36m21zy.jsView on unpkg · L76

dist/dist-VO62Er4I.jsView file

15import { access, lstat, open, readFile, readdir, readlink, realpath, stat, unlink } from "node:fs/promises"; L16: import { spawn, spawnSync } from "node:child_process"; L17: import * as _bundledTypebox from "@sinclair/typebox"; ... L44: //#region node_modules/.pnpm/@mariozechner+pi-coding-agent@0.52.8_ws@8.19.0_zod@4.3.6/node_modules/@mariozechner/pi-coding-agent/dist/config.js L45: const __dirname = dirname$1(fileURLToPath$1(import.meta.url)); L46: /** ... L63: switch (detectInstallMethod()) { L64: case "bun-binary": return `Download from: https://github.com/badlogic/pi-mono/releases/latest`; L65: case "pnpm": return `Run: pnpm install -g ${packageName}`; ... L72: /** L73: * Get the base directory for resolving package assets (themes, package.json, README.md, CHANGELOG.md). L74: * -

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

dist/dist-VO62Er4I.jsView on unpkg · L15

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/dist-VO62Er4I.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = skykoi@2026.3.555 matchedPath = dist/dist-CzFIzheb.js matchedIdentity = npm:c2t5a29p:2026.3.555 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

dist/performances-Xu9Ybvjp.jsView file

6import { homedir } from "node:os"; L7: import { spawn } from "node:child_process"; L8: ... L32: const SITES = { L33: youtube: "https://www.youtube.com/", L34: gmail: "https://mail.google.com/", ... L183: function fireVirtualKey(vk, times = 1) { L184: if (process.platform !== "win32") return; L185: const once = `[koi.K]::keybd_event(${vk},0,0,[IntPtr]::Zero);[koi.K]::keybd_event(${vk},0,2,[IntPtr]::Zero)`; ... L303: if (parts === void 0) return false; L304: const target = [homedir(), ...parts].join(sep); L305: try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/performances-Xu9Ybvjp.jsView on unpkg · L6

dist/routes-D10XhY5o.jsView file

14import crypto from "node:crypto"; L15: import { lookup } from "node:dns"; L16: import { lookup as lookup$1 } from "node:dns/promises"; ... L77: function jsonError(res, status, message) { L78: res.status(status).json({ error: message }); L79: } ... L157: function registerBrowserKoiActRoutes(app, ctx) { L158: app.post("/act", async (req, res) => { L159: const profileCtx = resolveProfileContext(req, res, ctx); ... L792: }; L793: const PRIVATE_IPV6_PREFIXES = [ L794: "fe80:",

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/routes-D10XhY5o.jsView on unpkg · L14

src/capture/audio-daemon/SkyKoiCapture.app/Contents/MacOS/audio-daemonView file

•path = src/capture/audio-daemon/SkyKoiCapture.app/Contents/MacOS/audio-daemon kind = native_binary sizeBytes = 579792 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/capture/audio-daemon/SkyKoiCapture.app/Contents/MacOS/audio-daemonView on unpkg

scripts/needle-sidecar.pyView file

•path = scripts/needle-sidecar.py kind = build_helper sizeBytes = 3524 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/needle-sidecar.pyView on unpkg

dist/plugin-sdk/pi-model-discovery-CGBXPZE-.jsView file

•matchType = normalized_sha256 matchedPackage = skykoi@2026.3.555 matchedPath = dist/plugin-sdk/pi-model-discovery-CGBXPZE-.js matchedIdentity = npm:c2t5a29p:2026.3.555 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/pi-model-discovery-CGBXPZE-.jsView on unpkg

dist/dist-C53i5oqF.jsView file

•matchType = normalized_sha256 matchedPackage = skykoi@2026.3.555 matchedPath = dist/dist-C53i5oqF.js matchedIdentity = npm:c2t5a29p:2026.3.555 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dist-C53i5oqF.jsView on unpkg

dist/lib-CG6iTHU6.jsView file

•matchType = normalized_sha256 matchedPackage = skykoi@2026.3.555 matchedPath = dist/lib-CG6iTHU6.js matchedIdentity = npm:c2t5a29p:2026.3.555 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib-CG6iTHU6.jsView on unpkg

dist/capture-service-DqagMyhZ.jsView file

•matchType = normalized_sha256 matchedPackage = skykoi@2026.3.555 matchedPath = dist/capture-service-Cfh9nzYa.js matchedIdentity = npm:c2t5a29p:2026.3.555 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/capture-service-DqagMyhZ.jsView on unpkg

Source & flagged code

33 flagged · loading source

dist/esm-74jbv3SC.jsView file

5594patternName = generic_password severity = medium line = 5594 matchedText = password...d]",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/esm-74jbv3SC.jsView on unpkg · L5594

dist/learned-skills-Z9qUAa-y.jsView file

6import { homedir } from "node:os"; L7: import { spawn } from "node:child_process"; L8:

High

Child Process

Package source references child process execution.

dist/learned-skills-Z9qUAa-y.jsView on unpkg · L6

146else { L147: const cmd = process.platform === "win32" ? ["powershell.exe", [ L148: "-NoProfile",

High

Shell

Package source references shell execution.

dist/learned-skills-Z9qUAa-y.jsView on unpkg · L146

dist/login-qr-AWeYd_2Y.jsView file

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist/login-qr-AWeYd_2Y.jsView on unpkg

•Trigger-reachable chain: manifest.main -> dist/index.js -> dist/login-qr-AWeYd_2Y.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/login-qr-AWeYd_2Y.jsView on unpkg

763try { L764: var mod = eval("quire".replace(/^/, "re"))(moduleName); L765: if (mod && (mod.length || Object.keys(mod).length)) return mod;

High

Eval

Package source references dynamic code evaluation.

dist/gateway-cli-ML8fx2rd.jsView file

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/gateway-cli-ML8fx2rd.jsView on unpkg · L73

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/systemd-CVE-d5EQ.jsView file

7Trigger-reachable persistence chain: manifest.main -> dist/index.js -> dist/systemd-CVE-d5EQ.js L7: import fs from "node:fs/promises"; L8: import { execFile } from "node:child_process"; L9: ... L30: try { L31: return os.userInfo().username; L32: } catch { ... L39: try { L40: const { stdout } = await runExec("loginctl", [ L41: "show-user", ... L295: * one answer a translated error string cannot fool — the same reason the L296: * Windows side trusts `/Query` exit codes over schtasks' localized output. L297: * ActiveState matters too: after a unit file is deleted and daemon-reload

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/systemd-CVE-d5EQ.jsView on unpkg · L7

7import fs from "node:fs/promises"; L8: import { execFile } from "node:child_process"; L9: ... L30: try { L31: return os.userInfo().username; L32: } catch { ... L39: try { L40: const { stdout } = await runExec("loginctl", [ L41: "show-user", ... L295: * one answer a translated error string cannot fool — the same reason the L296: * Windows side trusts `/Query` exit codes over schtasks' localized output. L297: * ActiveState matters too: after a unit file is deleted and daemon-reload

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/systemd-CVE-d5EQ.jsView on unpkg · L7

dist/reply-B36m21zy.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/reply-B36m21zy.jsView on unpkg · L76

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/reply-B36m21zy.jsView on unpkg · L76

dist/dist-VO62Er4I.jsView file

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

dist/dist-VO62Er4I.jsView on unpkg · L15

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/dist-VO62Er4I.jsView on unpkg

High

Known Malware Source Similarity

dist/performances-Xu9Ybvjp.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/performances-Xu9Ybvjp.jsView on unpkg · L6

dist/routes-D10XhY5o.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/routes-D10XhY5o.jsView on unpkg · L14

src/capture/audio-daemon/SkyKoiCapture.app/Contents/MacOS/audio-daemonView file

•path = src/capture/audio-daemon/SkyKoiCapture.app/Contents/MacOS/audio-daemon kind = native_binary sizeBytes = 579792 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/capture/audio-daemon/SkyKoiCapture.app/Contents/MacOS/audio-daemonView on unpkg

scripts/needle-sidecar.pyView file

•path = scripts/needle-sidecar.py kind = build_helper sizeBytes = 3524 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/needle-sidecar.pyView on unpkg

dist/plugin-sdk/pi-model-discovery-CGBXPZE-.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/pi-model-discovery-CGBXPZE-.jsView on unpkg

dist/dist-C53i5oqF.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dist-C53i5oqF.jsView on unpkg

dist/lib-CG6iTHU6.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib-CG6iTHU6.jsView on unpkg

dist/capture-service-DqagMyhZ.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/capture-service-DqagMyhZ.jsView on unpkg

Findings

6 Critical20 High9 Medium6 Low

CriticalHardcoded Runtime Data Exfiltrationdist/reply-B36m21zy.js

CriticalCredential Exfiltrationdist/reply-B36m21zy.js

CriticalBrowser Credential Phishingdist/dist-VO62Er4I.js

CriticalRemote Asset Decode Executedist/gateway-cli-ML8fx2rd.js

CriticalRemote Response Code Executiondist/login-qr-AWeYd_2Y.js

CriticalTrigger Reachable Dangerous Capabilitydist/login-qr-AWeYd_2Y.js

HighChild Processdist/learned-skills-Z9qUAa-y.js

HighShelldist/learned-skills-Z9qUAa-y.js

HighEvaldist/login-qr-AWeYd_2Y.js

HighCredential Redirect Persistencedist/gateway-cli-ML8fx2rd.js

HighEntrypoint Foreign Package Code Overwritedist/gateway-cli-ML8fx2rd.js

HighCommand Output Exfiltrationdist/gateway-cli-ML8fx2rd.js

HighSandbox Evasion Gated Capabilitydist/performances-Xu9Ybvjp.js

HighCloud Metadata Accessdist/routes-D10XhY5o.js

HighObfuscated Payload Loaderdist/login-qr-AWeYd_2Y.js

HighRemote Agent Bridgedist/reply-B36m21zy.js

HighCross File Remote Execution Contextdist/gateway-cli-ML8fx2rd.js

HighSpawned Bundled Service Listenerdist/gateway-cli-ML8fx2rd.js

HighTrigger Reachable Credential Exfiltrationdist/reply-B36m21zy.js

HighTrigger Reachable Persistencedist/systemd-CVE-d5EQ.js

HighSemantic Analysis Limiteddist/dist-VO62Er4I.js

HighKnown Malware Source Similaritydist/dist-VO62Er4I.js

HighKnown Malware Source Similaritydist/plugin-sdk/pi-model-discovery-CGBXPZE-.js

HighKnown Malware Source Similaritydist/dist-C53i5oqF.js

HighKnown Malware Source Similaritydist/lib-CG6iTHU6.js

HighKnown Malware Source Similaritydist/capture-service-DqagMyhZ.js

MediumSecret Patterndist/esm-74jbv3SC.js

MediumDynamic Requiredist/gateway-cli-ML8fx2rd.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/systemd-CVE-d5EQ.js

MediumShips Native Binarysrc/capture/audio-daemon/SkyKoiCapture.app/Contents/MacOS/audio-daemon

MediumShips Build Helperscripts/needle-sidecar.py

MediumOversized Source Filedist/reply-B36m21zy.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/gateway-cli-ML8fx2rd.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

33 flagged

dist/esm-74jbv3SC.jsView file

Lines 5574-5614javascript

5574//#endregion

5575//#region node_modules/.pnpm/css-select@5.2.2/node_modules/css-select/lib/esm/pseudo-selectors/aliases.js

5576/**

5577* Aliases are pseudos that are expressed as selectors.

5578*/

5579const aliases = {

5580 "any-link": ":is(a, area, link)[href]",

5581 link: ":any-link:not(:visited)",

5582 disabled: `:is(

5583 :is(button, input, select, textarea, optgroup, option)[disabled],

5584 optgroup[disabled] > option,

5585 fieldset[disabled]:not(fieldset[disabled] legend:first-of-type *)

5586 )`,

5587 enabled: ":not(:disabled)",

5588 checked: ":is(:is(input[type=radio], input[type=checkbox])[checked], option:selected)",

5589 required: ":is(input, select, textarea)[required]",

5590 optional: ":is(input, select, textarea):not([required])",

5591 selected: "option:is([selected], select:not([multiple]):not(:has(> option[selected])) > :first-of-type)",

5592 checkbox: "[type=checkbox]",

5593 file: "[type=file]",

5594 password: "[type=password]",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/esm-74jbv3SC.jsView on unpkg · L5594

5595 radio: "[type=radio]",

5596 reset: "[type=reset]",

5597 image: "[type=image]",

5598 submit: "[type=submit]",

5599 parent: ":not(:empty)",

5600 header: ":is(h1, h2, h3, h4, h5, h6)",

5601 button: ":is(button, input[type=button])",

5602 input: ":is(input, textarea, select, button)",

5603 text: "input:is(:not([type!='']), [type=text])"

5604};

5605

5606//#endregion

5607//#region node_modules/.pnpm/css-select@5.2.2/node_modules/css-select/lib/esm/pseudo-selectors/subselects.js

5608/** Used as a placeholder for :has. Will be replaced with the actual element. */

5609const PLACEHOLDER_ELEMENT = {};

5610function ensureIsTag(next, adapter) {

5611 if (next === import_boolbase.default.falseFunc) return import_boolbase.default.falseFunc;

5612 return (elem) => adapter.isTag(elem) && next(elem);

5613}

5614function getNextSiblings(elem, adapter) {

dist/learned-skills-Z9qUAa-y.jsView file

Lines 1-26javascript

1import { r as __exportAll } from "./chunk-D_gEzPfs.js";

2import { t as createSubsystemLogger } from "./subsystem-C9EJTll_.js";

3import { n as openForeground } from "./foreground-Bnqqz2FR.js";

dist/login-qr-AWeYd_2Y.jsView file

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist/login-qr-AWeYd_2Y.jsView on unpkg

•Trigger-reachable chain: manifest.main -> dist/index.js -> dist/login-qr-AWeYd_2Y.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/login-qr-AWeYd_2Y.jsView on unpkg

763try { L764: var mod = eval("quire".replace(/^/, "re"))(moduleName); L765: if (mod && (mod.length || Object.keys(mod).length)) return mod;

High

Eval

Package source references dynamic code evaluation.

dist/gateway-cli-ML8fx2rd.jsView file

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/gateway-cli-ML8fx2rd.jsView on unpkg · L73

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/systemd-CVE-d5EQ.jsView file

Lines 1-27javascript

1import { g as resolveGatewaySystemdServiceName, i as resolveHomeDir, p as formatGatewayServiceDescription } from "./home-CDe_CxBN.js";

2import { n as isRich, r as theme, t as colorize } from "./theme-CF1-tqcX.js";

3import

dist/reply-B36m21zy.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/reply-B36m21zy.jsView on unpkg · L76

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/reply-B36m21zy.jsView on unpkg · L76

dist/dist-VO62Er4I.jsView file

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

dist/dist-VO62Er4I.jsView on unpkg · L15

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/dist-VO62Er4I.jsView on unpkg

High

Known Malware Source Similarity

dist/performances-Xu9Ybvjp.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/performances-Xu9Ybvjp.jsView on unpkg · L6

dist/routes-D10XhY5o.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/routes-D10XhY5o.jsView on unpkg · L14

src/capture/audio-daemon/SkyKoiCapture.app/Contents/MacOS/audio-daemonView file

•path = src/capture/audio-daemon/SkyKoiCapture.app/Contents/MacOS/audio-daemon kind = native_binary sizeBytes = 579792 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/capture/audio-daemon/SkyKoiCapture.app/Contents/MacOS/audio-daemonView on unpkg

scripts/needle-sidecar.pyView file

•path = scripts/needle-sidecar.py kind = build_helper sizeBytes = 3524 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/needle-sidecar.pyView on unpkg

dist/plugin-sdk/pi-model-discovery-CGBXPZE-.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/pi-model-discovery-CGBXPZE-.jsView on unpkg

dist/dist-C53i5oqF.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dist-C53i5oqF.jsView on unpkg

dist/lib-CG6iTHU6.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib-CG6iTHU6.jsView on unpkg

dist/capture-service-DqagMyhZ.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/capture-service-DqagMyhZ.jsView on unpkg

skykoi@2026.3.573

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code