skykoi@2026.3.584: Suspicious npm security report (Warn)

Loading npm security reports…

skykoi@2026.3.584: Suspicious npm security report (Warn) | LPM Firewall

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 859 file(s), 22.4 MB of source, external domains: 127.0.0.1, 169.254.169.254, 169.254.170.2, 192.168.1.100, a.co, accounts.google.com, admin.googleapis.com, aistudio.google.com, albumart.url, api.anthropic.com, api.botframework.com, api.cerebras.ai, api.chutes.ai, api.deepgram.com, api.firecrawl.dev, api.github.com, api.groq.com, api.individual.githubcopilot.com, api.kimi.com, api.minimax.chat, api.minimax.io, api.minimaxi.com, api.mistral.ai, api.moonshot.ai, api.moonshot.cn, api.openai.com, api.perplexity.ai, api.plivo.com, api.slack.com, api.synthetic.new, api.telnyx.com, api.twilio.com, api.us.nylas.com, api.venice.ai, api.voyageai.com, api.x.ai, api.xiaomimimo.com, attacker.azureedge.net, auth.openai.com, aws.amazon.com, bedrock-runtime.us-east-1.amazonaws.com, bot-api.zaloplatforms.com, bot.zaloplatforms.com, bun.sh, cfg.example.org, chat.example.com, chat.googleapis.com, chat.qwen.ai, chatgpt.com, chutes.ai

Oversized source lightweight scan

dist/dist-BOqYgp53.js4.45 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsCryptoShellHighEntropyStringsUrlStringscli.github.comgithub.compi.dev

dist/dist-C53i5oqF.js2.01 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsWebSocketHighEntropyStringsUrlStrings127.0.0.1accounts.google.comapi.anthropic.comapi.cerebras.aiapi.groq.comapi.individual.githubcopilot.comapi.kimi.comapi.minimax.ioapi.minimaxi.comapi.mistral.aiapi.openai.comauth.openai.combedrock-runtime.us-east-1.amazonaws.comchatgpt.comclaude.aicloudcode-pa.googleapis.comconsole.anthropic.comdaily-cloudcode-pa.sandbox.googleapis.comgenerativelanguage.googleapis.comgoo.gleoauth2.googleapis.comopencode.airouter.huggingface.co

dist/login-qr-Ck847h47.js3.90 MB file, sampled 256 KB

FilesystemChildProcessEvalCryptoShellWebSocket

dist/opus-ml-DxEzSl7C.js3.91 MB file, sampled 256 KB

HighEntropyStrings

dist/plugin-sdk/index.js8.14 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoShellWebSocketHighEntropyStringsUrlStringsskykoi.com

dist/plugin-sdk/opus-ml-DbnGLBEn.js3.91 MB file, sampled 256 KB

HighEntropyStrings

dist/plugin-sdk/pi-model-discovery-HMR1-eGH.js5.87 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoShellWebSocketHighEntropyStringsUrlStringsapi.anthropic.comapi.cerebras.aiapi.github.comapi.groq.comapi.individual.githubcopilot.comapi.kimi.comapi.minimax.ioapi.minimaxi.comapi.mistral.aiapi.openai.combedrock-runtime.us-east-1.amazonaws.comchatgpt.comcloudcode-pa.googleapis.comcodeload.github.comdaily-cloudcode-pa.sandbox.googleapis.com

dist/pw-session-xgnVmyRY.js4.16 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsEvalDynamicRequireHighEntropyStringsUrlStringsdotenvx.comwww.apache.org

dist/reply-DaDe_tEh.js5.48 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsNativeBindingsCryptoShellHighEntropyStringsUrlStringsapi.deepgram.comapi.groq.comapi.openai.comexample.comgenerativelanguage.googleapis.comwww.skykoi.com

Source & flagged code

32 flagged

dist/esm-74jbv3SC.jsView file

Lines 5574-5614javascript

5574//#endregion

5575//#region node_modules/.pnpm/css-select@5.2.2/node_modules/css-select/lib/esm/pseudo-selectors/aliases.js

5576/**

5577* Aliases are pseudos that are expressed as selectors.

5578*/

5579const aliases = {

5580 "any-link": ":is(a, area, link)[href]",

5581 link: ":any-link:not(:visited)",

5582 disabled: `:is(

5583 :is(button, input, select, textarea, optgroup, option)[disabled],

5584 optgroup[disabled] > option,

5585 fieldset[disabled]:not(fieldset[disabled] legend:first-of-type *)

5586 )`,

5587 enabled: ":not(:disabled)",

5588 checked: ":is(:is(input[type=radio], input[type=checkbox])[checked], option:selected)",

5589 required: ":is(input, select, textarea)[required]",

5590 optional: ":is(input, select, textarea):not([required])",

5591 selected: "option:is([selected], select:not([multiple]):not(:has(> option[selected])) > :first-of-type)",

5592 checkbox: "[type=checkbox]",

5593 file: "[type=file]",

5594 password: "[type=password]",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/esm-74jbv3SC.jsView on unpkg · L5594

5595 radio: "[type=radio]",

5596 reset: "[type=reset]",

5597 image: "[type=image]",

5598 submit: "[type=submit]",

5599 parent: ":not(:empty)",

5600 header: ":is(h1, h2, h3, h4, h5, h6)",

5601 button: ":is(button, input[type=button])",

5602 input: ":is(input, textarea, select, button)",

5603 text: "input:is(:not([type!='']), [type=text])"

5604};

5605

5606//#endregion

5607//#region node_modules/.pnpm/css-select@5.2.2/node_modules/css-select/lib/esm/pseudo-selectors/subselects.js

5608/** Used as a placeholder for :has. Will be replaced with the actual element. */

5609const PLACEHOLDER_ELEMENT = {};

5610function ensureIsTag(next, adapter) {

5611 if (next === import_boolbase.default.falseFunc) return import_boolbase.default.falseFunc;

5612 return (elem) => adapter.isTag(elem) && next(elem);

5613}

5614function getNextSiblings(elem, adapter) {

dist/ports-4_pj727t.jsView file

Lines 1-22javascript

1import { b as sleep } from "./utils-DvowqEJV.js";

2import { f as resolveLsofCommandSync } from "./chrome-yJZo5R2c.js";

3import { execFileSync } from "node:child_process";

High

dist/sound-DEW9hK8H.jsView file

Lines 1-38javascript

1import fs, { existsSync, readdirSync } from "node:fs";

2import os from "node:os";

3import path, { join } from "node:path";

4import { spawn, spawnSync } from "node:child_process";

dist/pw-tools-core-CrSUieXr.jsView file

Lines 668-708javascript

668 continue;

669 }

670 try {

671 await locator.fill(value, { timeout });

672 } catch (err) {

673 throw toAIFriendlyError(err, ref);

dist/utilities-B719KVIx.jsView file

Lines 263-303javascript

263}

264

265//#endregion

266//#region node_modules/.pnpm/@eshaz+web-worker@1.2.2/node_modules/@eshaz/web-worker/cjs/node.js

267var require_node = /* @__PURE__ */ __commonJSMin(((exports, module) => {

268 init_esm_shims();

dist/run-code-tool-Dvg8djTe.jsView file

Lines 1-21javascript

1import { n as toToolHandles } from "./declarations-CInVP-gk.js";

2import { t as pformat } from "./pprint-C8p0jrbU.js";

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/run-code-tool-Dvg8djTe.jsView on unpkg · L1

3import { Type } from

dist/sandbox-BvPKuLgM.jsView file

Lines 1-37javascript

1import { f as CHANNEL_IDS, s as defaultRuntime } from "./subsystem-Cif6Dsse.js";

2import { r as STATE_DIR } from "./paths-umluv5Bk.js";

3import { d as resolveKoiIdFromSessionKey, l as normalizeKoiId } from

dist/completion-cli-Ded6q-2s.jsView file

Lines 1-41javascript

1import { r as __exportAll } from "./chunk-D_gEzPfs.js";

2import { _ as resolveStateDir } from "./paths-umluv5Bk.js";

3import { n as registerSubCliByName, t as getSubCliEntries } from "./register.subclis-CqAqJ_rB.js"

dist/pw-session-xgnVmyRY.jsView file

3import { n as formatErrorMessage } from "./errors-CiDOsXtk.js"; L4: import { t as getChromeWebSocketUrl, x as getHeadersWithAuth } from "./chrome-yJZo5R2c.js"; L5: import { r as init_esm_shims, t as __dirname } from "./esm-shims-DOra-T0N.js"; L6: ... L110: "use strict"; L111: var Hb = __require("os"), $t = Tf(), at = process.env, yr = void 0; L112: $t("no-color") || $t("no-colors") || $t("color=false") ? yr = !1 : ($t("color") || $t("colors") || $t("color=true") || $t("color=always")) && (yr = !0); ... L127: var e = yr ? 1 : 0; L128: if (process.platform === "win32") { L129: var t = Hb.release().split("."); ... L155: supportsColor: ka, L156: stdout: ka(process.stdout),

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/pw-session-xgnVmyRY.jsView on unpkg · L3

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/pw-session-xgnVmyRY.js: //#region node_modules/.pnpm/playwright-core@1.58.2/node_modules/playwright-core/lib/utilsBundleImpl/index.js funding: "https://dotenvx.com", followRedirects: !1, if (n.followRedirects) { if (b && n.followRedirects && w >= 300 && w < 400) { S && n(O.range, "MISSING_CHAR", "Implicit map keys need to be followed by map values"), E.comment && (O.comment ? O.comment += ` var r = i.writeFile; i.writeFile = n;

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/pw-session-xgnVmyRY.jsView on unpkg

3Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js -> dist/pw-ai-module-D5ZeY7Hk.js -> dist/pw-ai-Cvlh9K06.js -> dist/pw-session-xgnVmyRY.js L3: import { n as formatErrorMessage } from "./errors-CiDOsXtk.js"; L4: import { t as getChromeWebSocketUrl, x as getHeadersWithAuth } from "./chrome-yJZo5R2c.js"; L5: import { r as init_esm_shims, t as __dirname } from "./esm-shims-DOra-T0N.js"; L6: ... L110: "use strict"; L111: var Hb = __require("os"), $t = Tf(), at = process.env, yr = void 0; L112: $t("no-color") || $t("no-colors") || $t("color=false") ? yr = !1 : ($t("color") || $t("colors") || $t("color=true") || $t("color=always")) && (yr = !0); ... L127: var e = yr ? 1 : 0; L128: if (process.platform === "win32") { L129: var t = Hb.release().split("."); ... L155:

dist/dist-C53i5oqF.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/dist-C53i5oqF.js: import { writeFile } from "fs/promises"; baseUrl: "https://bedrock-runtime.us-east-1.amazonaws.com", baseUrl: "https://bedrock-runtime.us-east-1.amazonaws.com", baseUrl: "https://bedrock-runtime.us-east-1.amazonaws.com", baseUrl: "https://bedrock-runtime.us-east-1.amazonaws.com", baseUrl: "https://bedrock-runtime.us-east-1.amazonaws.com", baseUrl: "https://bedrock-runtime.us-east-1.amazonaws.com", baseUrl: "https://bedrock-runtime.us-east-1.amazonaws.com",

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/dist-C53i5oqF.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = skykoi@2026.3.555 matchedPath = dist/dist-C53i5oqF.js matchedIdentity = npm:c2t5a29p:2026.3.555 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dist-C53i5oqF.jsView on unpkg

dist/gateway-cli-CwBGha7X.jsView file

73import { a as resolveOutboundTarget, o as resolveSessionDeliveryTarget, u as normalizePollInput } from "./message-DhSe7-oB.js"; L74: import { i as [redacted], s as verifyDeviceSignature, t as deriveDeviceIdFromPublicKey } from "./device-identity-S9LsHyR8.js"; L75: import { n as pickPrimaryTailnetIPv6, t as pickPrimaryTailnetIPv4 } from "./tailnet-Cr3uILr_.js"; L76: import { $ as validateNodePairListParams, A as [redacted], At as ErrorCodes, B as validateKoiIdentityParams, C as validateCronUpdateParams, Ct as validateWeb... L77: import { n as callGateway, s as loadGatewayTlsRuntime$1 } from "./call-1OwFPVUz.js"; ... L111: import "./graph-access-DsKakzKO.js"; L112: import { _ as setAudioMuted, m as isPrivateMode, p as isAudioMuted, v as setPrivateMode } from "./identify-BVhO81JE.js"; L1

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/gateway-cli-CwBGha7X.jsView on unpkg · L73

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/gateway-cli-CwBGha7X.js

dist/dist-BOqYgp53.jsView file

15import { access, lstat, open, readFile, readdir, readlink, realpath, stat, unlink } from "node:fs/promises"; L16: import { spawn, spawnSync } from "node:child_process"; L17: import * as _bundledTypebox from "@sinclair/typebox"; ... L44: //#region node_modules/.pnpm/@mariozechner+pi-coding-agent@0.52.8_ws@8.19.0_zod@4.3.6/node_modules/@mariozechner/pi-coding-agent/dist/config.js L45: const __dirname = dirname$1(fileURLToPath$1(import.meta.url)); L46: /** ... L63: switch (detectInstallMethod()) { L64: case "bun-binary": return `Download from: https://github.com/badlogic/pi-mono/releases/latest`; L65: case "pnpm": return `Run: pnpm install -g ${packageName}`; ... L72: /** L73: * Get the base directory for resolving package assets (themes, package.json, README.md, CHANGELOG.md). L74: * -

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

dist/dist-BOqYgp53.jsView on unpkg · L15

15Trigger-reachable chain: manifest.main -> dist/index.js -> dist/dist-BOqYgp53.js L15: import { access, lstat, open, readFile, readdir, readlink, realpath, stat, unlink } from "node:fs/promises"; L16: import { spawn, spawnSync } from "node:child_process"; L17: import * as _bundledTypebox from "@sinclair/typebox"; ... L44: //#region node_modules/.pnpm/@mariozechner+pi-coding-agent@0.52.8_ws@8.19.0_zod@4.3.6/node_modules/@mariozechner/pi-coding-agent/dist/config.js L45: const __dirname = dirname$1(fileURLToPath$1(import.meta.url)); L46: /** ... L63: switch (detectInstallMethod()) { L64: case "bun-binary": return `Download from: https://github.com/badlogic/pi-mono/releases/latest`; L65: case "pnpm": return `Run: pnpm install -g ${packageName}`; ... L72: /** L73: * Get the base directory for re

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/dist-BOqYgp53.jsView on unpkg · L15

dist/daemon-runtime-DijShj_J.jsView file

8import fs from "node:fs/promises"; L9: import { execFile } from "node:child_process"; L10: import { createHash } from "node:crypto"; ... L162: function buildPosixShim() { L163: return `#!/bin/sh L164: # SkyKoi launcher shim (format ${LAUNCHER_FORMAT_VERSION}) — generated, do not edit. ... L306: } L307: function buildLauncherShim(platform = process.platform) { L308: const content = platform === "win32" ? buildWindowsShim() : buildPosixShim(); ... L333: async function installLauncher(params) { L334: const env = params.env ?? process.env; L335: const platform = params.platform ?? process.platform;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/daemon-runtime-DijShj_J.jsView on unpkg · L8

8Cross-file remote execution chain: dist/daemon-runtime-DijShj_J.js spawns dist/model-selection-COJyQmnT.js; helper contains network access plus dynamic code execution. L8: import fs from "node:fs/promises"; L9: import { execFile } from "node:child_process"; L10: import { createHash } from "node:crypto"; ... L162: function buildPosixShim() { L163: return `#!/bin/sh L164: # SkyKoi launcher shim (format ${LAUNCHER_FORMAT_VERSION}) — generated, do not edit. ... L306: } L307: function buildLauncherShim(platform = process.platform) { L308: const content = platform === "win32" ? buildWindowsShim() : buildPosixShim(); ... L333: async function installLauncher(params) { L334: const env = params.env ?? process.env; L335: const platform = params.platform ?? process.platform;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/daemon-runtime-DijShj_J.jsView on unpkg · L8

dist/dist-cjs-4ycED5ld.jsView file

9var buffer = __require("buffer"); L10: var http = __require("http"); L11: var nodeConfigProvider = require_dist_cjs$1(); ... L42: }); L43: req.end(); L44: }); ... L71: const requestOptions = await getCmdsUri({ logger: init.logger }); L72: const credsResponse = JSON.parse(await requestFromEcsImds(timeout, requestOptions)); L73: if (!isImdsCredentials(credsResponse)) throw new propertyProvider.CredentialsProviderError("Invalid response received from instance metadata service.", { logger: init.logger }); ... L77: const requestFromEcsImds = async (timeout, options) => { L78: if (process.env[ENV_CMDS_AUTH_TOKEN]) options.headers = { L79: ...options.headers,

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/dist-cjs-4ycED5ld.jsView on unpkg · L9

dist/tui-CEJi8nv7.jsView file

48import fs$1 from "node:fs/promises"; L49: import { execFile, spawn, spawnSync } from "node:child_process"; L50: import { Writable } from "node:stream"; ... L77: if (resolved === path.parse(resolved).root) return true; L78: const home = resolveHomeDir(); L79: if (home && resolved === path.resolve(home)) return true; ... L136: * historically left behind — so an uninstall wasn't "no trace": L137: * - the private Node runtime (~/.skykoi-node) it drops when no system Node, L138: * - the `koi` shims in the npm prefix (incl. a hand-written dev shim that ... L154: }); L155: if (process.platform === "win32") { L156: const prefix = path.join(process.env.APPDATA || path.join(home, "AppData", "Roaming"), "npm");

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist/tui-CEJi8nv7.jsView on unpkg · L48

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/tui-CEJi8nv7.jsView on unpkg · L48

src/capture/audio-daemon/SkyKoiCapture.app/Contents/MacOS/audio-daemonView file

•path = src/capture/audio-daemon/SkyKoiCapture.app/Contents/MacOS/audio-daemon kind = native_binary sizeBytes = 579792 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/capture/audio-daemon/SkyKoiCapture.app/Contents/MacOS/audio-daemonView on unpkg

scripts/needle-sidecar.pyView file

•path = scripts/needle-sidecar.py kind = build_helper sizeBytes = 3524 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/needle-sidecar.pyView on unpkg

dist/archive-CHtEiM2-.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/archive-CHtEiM2-.jsView on unpkg

dist/lib-CG6iTHU6.jsView file

•matchType = normalized_sha256 matchedPackage = skykoi@2026.3.555 matchedPath = dist/lib-CG6iTHU6.js matchedIdentity = npm:c2t5a29p:2026.3.555 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib-CG6iTHU6.jsView on unpkg

dist/doctor-D6RsG337.jsView file

•matchType = normalized_sha256 matchedPackage = skykoi@2026.3.555 matchedPath = dist/doctor-BGJufSkv.js matchedIdentity = npm:c2t5a29p:2026.3.555 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/doctor-D6RsG337.jsView on unpkg

dist/graphics-terminal-setup-CI80Oah_.jsView file

•matchType = normalized_sha256 matchedPackage = skykoi@2026.3.555 matchedPath = dist/graphics-terminal-setup-DszMKyl6.js matchedIdentity = npm:c2t5a29p:2026.3.555 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/graphics-terminal-setup-CI80Oah_.jsView on unpkg

Source & flagged code

32 flagged · loading source

dist/esm-74jbv3SC.jsView file

5594patternName = generic_password severity = medium line = 5594 matchedText = password...d]",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/esm-74jbv3SC.jsView on unpkg · L5594

dist/ports-4_pj727t.jsView file

2import { f as resolveLsofCommandSync } from "./chrome-yJZo5R2c.js"; L3: import { execFileSync } from "node:child_process"; L4:

High

Child Process

Package source references child process execution.

dist/ports-4_pj727t.jsView on unpkg · L2

dist/sound-DEW9hK8H.jsView file

18* win32: ffplay when available (ships with the ffmpeg the voice listener L19: * already requires) → PowerShell PresentationCore MediaPlayer L20: * (dependency-free; handles mp3 + wav)

High

Shell

Package source references shell execution.

dist/sound-DEW9hK8H.jsView on unpkg · L18

dist/pw-tools-core-CrSUieXr.jsView file

688const locator = refLocator(page, opts.ref); L689: const elementEvaluator = new Function("el", "fnBody", ` L690: "use strict";

High

Eval

Package source references dynamic code evaluation.

dist/pw-tools-core-CrSUieXr.jsView on unpkg · L688

dist/utilities-B719KVIx.jsView file

283*/ L284: const URL$1 = __require("url"); L285: const VM = __require("vm");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/utilities-B719KVIx.jsView on unpkg · L283

dist/run-code-tool-Dvg8djTe.jsView file

1import { n as toToolHandles } from "./declarations-CInVP-gk.js"; L2: import { t as pformat } from "./pprint-C8p0jrbU.js";

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/run-code-tool-Dvg8djTe.jsView on unpkg · L1

dist/sandbox-BvPKuLgM.jsView file

17import fs from "node:fs/promises"; L18: import { spawn } from "node:child_process"; L19: import crypto from "node:crypto"; ... L22: //#region src/koi/sandbox/constants.ts L23: const DEFAULT_SANDBOX_WORKSPACE_ROOT = path.join(os.homedir(), ".skykoi", "sandboxes"); L24: const DEFAULT_SANDBOX_IMAGE = "SKYKOI-sandbox:bookworm-slim"; ... L256: const app = express(); L257: app.use(express.json({ limit: "1mb" })); L258: const authToken = params.authToken?.trim(); ... L260: if (String(req.headers.authorization ?? "").trim() === `Bearer ${authToken}`) return next(); L261: res.status(401).send("Unauthorized"); L262: });

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/sandbox-BvPKuLgM.jsView on unpkg · L17

dist/completion-cli-Ded6q-2s.jsView file

21Trigger-reachable persistence chain: manifest.main -> dist/index.js -> dist/completion-cli-Ded6q-2s.js L21: "bash", L22: "powershell", L23: "fish" ... L27: } L28: function resolveShellFromEnv(env = process.env) { L29: const shellPath = env.SHELL?.trim() ?? ""; ... L42: function resolveCompletionCacheDir(env = process.env) { L43: const stateDir = resolveStateDir(env, os.homedir); L44: return path.join(stateDir, "completions"); ... L121: const home = process.env.HOME || os.homedir(); L122: if (shell === "zsh") return path.join(home, ".zshrc"); L123: if (shell === "bash") return path.join(home, ".bashrc");

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/completion-cli-Ded6q-2s.jsView on unpkg · L21

21"bash", L22: "powershell", L23: "fish" ... L27: } L28: function resolveShellFromEnv(env = process.env) { L29: const shellPath = env.SHELL?.trim() ?? ""; ... L42: function resolveCompletionCacheDir(env = process.env) { L43: const stateDir = resolveStateDir(env, os.homedir); L44: return path.join(stateDir, "completions"); ... L121: const home = process.env.HOME || os.homedir(); L122: if (shell === "zsh") return path.join(home, ".zshrc"); L123: if (shell === "bash") return path.join(home, ".bashrc");

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/completion-cli-Ded6q-2s.jsView on unpkg · L21

dist/pw-session-xgnVmyRY.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/pw-session-xgnVmyRY.jsView on unpkg · L3

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/pw-session-xgnVmyRY.jsView on unpkg

dist/dist-C53i5oqF.jsView file

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/dist-C53i5oqF.jsView on unpkg

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dist-C53i5oqF.jsView on unpkg

dist/gateway-cli-CwBGha7X.jsView file

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/gateway-cli-CwBGha7X.jsView on unpkg · L73

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/gateway-cli-CwBGha7X.js

dist/dist-BOqYgp53.jsView file

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

dist/dist-BOqYgp53.jsView on unpkg · L15

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/dist-BOqYgp53.jsView on unpkg · L15

dist/daemon-runtime-DijShj_J.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/daemon-runtime-DijShj_J.jsView on unpkg · L8

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/daemon-runtime-DijShj_J.jsView on unpkg · L8

dist/dist-cjs-4ycED5ld.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/dist-cjs-4ycED5ld.jsView on unpkg · L9

dist/tui-CEJi8nv7.jsView file

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist/tui-CEJi8nv7.jsView on unpkg · L48

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/tui-CEJi8nv7.jsView on unpkg · L48

src/capture/audio-daemon/SkyKoiCapture.app/Contents/MacOS/audio-daemonView file

•path = src/capture/audio-daemon/SkyKoiCapture.app/Contents/MacOS/audio-daemon kind = native_binary sizeBytes = 579792 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/capture/audio-daemon/SkyKoiCapture.app/Contents/MacOS/audio-daemonView on unpkg

scripts/needle-sidecar.pyView file

•path = scripts/needle-sidecar.py kind = build_helper sizeBytes = 3524 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/needle-sidecar.pyView on unpkg

dist/archive-CHtEiM2-.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/archive-CHtEiM2-.jsView on unpkg

dist/lib-CG6iTHU6.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib-CG6iTHU6.jsView on unpkg

dist/doctor-D6RsG337.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/doctor-D6RsG337.jsView on unpkg

dist/graphics-terminal-setup-CI80Oah_.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/graphics-terminal-setup-CI80Oah_.jsView on unpkg

Source & flagged code

32 flagged

dist/esm-74jbv3SC.jsView file

Lines 5574-5614javascript

5574//#endregion

5575//#region node_modules/.pnpm/css-select@5.2.2/node_modules/css-select/lib/esm/pseudo-selectors/aliases.js

5576/**

5577* Aliases are pseudos that are expressed as selectors.

5578*/

5579const aliases = {

5580 "any-link": ":is(a, area, link)[href]",

5581 link: ":any-link:not(:visited)",

5582 disabled: `:is(

5583 :is(button, input, select, textarea, optgroup, option)[disabled],

5584 optgroup[disabled] > option,

5585 fieldset[disabled]:not(fieldset[disabled] legend:first-of-type *)

5586 )`,

5587 enabled: ":not(:disabled)",

5588 checked: ":is(:is(input[type=radio], input[type=checkbox])[checked], option:selected)",

5589 required: ":is(input, select, textarea)[required]",

5590 optional: ":is(input, select, textarea):not([required])",

5591 selected: "option:is([selected], select:not([multiple]):not(:has(> option[selected])) > :first-of-type)",

5592 checkbox: "[type=checkbox]",

5593 file: "[type=file]",

5594 password: "[type=password]",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/esm-74jbv3SC.jsView on unpkg · L5594

5595 radio: "[type=radio]",

5596 reset: "[type=reset]",

5597 image: "[type=image]",

5598 submit: "[type=submit]",

5599 parent: ":not(:empty)",

5600 header: ":is(h1, h2, h3, h4, h5, h6)",

5601 button: ":is(button, input[type=button])",

5602 input: ":is(input, textarea, select, button)",

5603 text: "input:is(:not([type!='']), [type=text])"

5604};

5605

5606//#endregion

5607//#region node_modules/.pnpm/css-select@5.2.2/node_modules/css-select/lib/esm/pseudo-selectors/subselects.js

5608/** Used as a placeholder for :has. Will be replaced with the actual element. */

5609const PLACEHOLDER_ELEMENT = {};

5610function ensureIsTag(next, adapter) {

5611 if (next === import_boolbase.default.falseFunc) return import_boolbase.default.falseFunc;

5612 return (elem) => adapter.isTag(elem) && next(elem);

5613}

5614function getNextSiblings(elem, adapter) {

dist/ports-4_pj727t.jsView file

Lines 1-22javascript

1import { b as sleep } from "./utils-DvowqEJV.js";

2import { f as resolveLsofCommandSync } from "./chrome-yJZo5R2c.js";

3import { execFileSync } from "node:child_process";

High

dist/sound-DEW9hK8H.jsView file

Lines 1-38javascript

1import fs, { existsSync, readdirSync } from "node:fs";

2import os from "node:os";

3import path, { join } from "node:path";

4import { spawn, spawnSync } from "node:child_process";

dist/pw-tools-core-CrSUieXr.jsView file

Lines 668-708javascript

668 continue;

669 }

670 try {

671 await locator.fill(value, { timeout });

672 } catch (err) {

673 throw toAIFriendlyError(err, ref);

dist/utilities-B719KVIx.jsView file

Lines 263-303javascript

263}

264

265//#endregion

266//#region node_modules/.pnpm/@eshaz+web-worker@1.2.2/node_modules/@eshaz/web-worker/cjs/node.js

267var require_node = /* @__PURE__ */ __commonJSMin(((exports, module) => {

268 init_esm_shims();

dist/run-code-tool-Dvg8djTe.jsView file

Lines 1-21javascript

1import { n as toToolHandles } from "./declarations-CInVP-gk.js";

2import { t as pformat } from "./pprint-C8p0jrbU.js";

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/run-code-tool-Dvg8djTe.jsView on unpkg · L1

3import { Type } from

dist/sandbox-BvPKuLgM.jsView file

Lines 1-37javascript

1import { f as CHANNEL_IDS, s as defaultRuntime } from "./subsystem-Cif6Dsse.js";

2import { r as STATE_DIR } from "./paths-umluv5Bk.js";

3import { d as resolveKoiIdFromSessionKey, l as normalizeKoiId } from

dist/completion-cli-Ded6q-2s.jsView file

Lines 1-41javascript

1import { r as __exportAll } from "./chunk-D_gEzPfs.js";

2import { _ as resolveStateDir } from "./paths-umluv5Bk.js";

3import { n as registerSubCliByName, t as getSubCliEntries } from "./register.subclis-CqAqJ_rB.js"

dist/pw-session-xgnVmyRY.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/pw-session-xgnVmyRY.jsView on unpkg · L3

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/pw-session-xgnVmyRY.jsView on unpkg

dist/dist-C53i5oqF.jsView file

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/dist-C53i5oqF.jsView on unpkg

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dist-C53i5oqF.jsView on unpkg

dist/gateway-cli-CwBGha7X.jsView file

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/gateway-cli-CwBGha7X.jsView on unpkg · L73

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/gateway-cli-CwBGha7X.js

dist/dist-BOqYgp53.jsView file

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

dist/dist-BOqYgp53.jsView on unpkg · L15

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/dist-BOqYgp53.jsView on unpkg · L15

dist/daemon-runtime-DijShj_J.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/daemon-runtime-DijShj_J.jsView on unpkg · L8

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/daemon-runtime-DijShj_J.jsView on unpkg · L8

dist/dist-cjs-4ycED5ld.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/dist-cjs-4ycED5ld.jsView on unpkg · L9

dist/tui-CEJi8nv7.jsView file

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist/tui-CEJi8nv7.jsView on unpkg · L48

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/tui-CEJi8nv7.jsView on unpkg · L48

src/capture/audio-daemon/SkyKoiCapture.app/Contents/MacOS/audio-daemonView file

•path = src/capture/audio-daemon/SkyKoiCapture.app/Contents/MacOS/audio-daemon kind = native_binary sizeBytes = 579792 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

src/capture/audio-daemon/SkyKoiCapture.app/Contents/MacOS/audio-daemonView on unpkg

scripts/needle-sidecar.pyView file

•path = scripts/needle-sidecar.py kind = build_helper sizeBytes = 3524 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/needle-sidecar.pyView on unpkg

dist/archive-CHtEiM2-.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/archive-CHtEiM2-.jsView on unpkg

dist/lib-CG6iTHU6.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib-CG6iTHU6.jsView on unpkg

dist/doctor-D6RsG337.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/doctor-D6RsG337.jsView on unpkg

dist/graphics-terminal-setup-CI80Oah_.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/graphics-terminal-setup-CI80Oah_.jsView on unpkg

skykoi@2026.3.584

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code