SkyKoi — Koi runtime. Multi-channel gateway CLI with RPC Koi.
AI Security Review
scanned 2mo ago · by lpm-firewall-ai
The observed network behavior is product-aligned, configuration-gated model catalog retrieval rather than concrete exfiltration or remote code execution. Scanner hits resolve to bundled dependency/WASM code and do not establish malicious behavior.
User runs the CLI with the SkyKoi model provider configured.
Impact
Configured SkyKoi credential is sent to the selected platform endpoint; no unrelated credential/file harvesting or remote payload execution was confirmed.
Mechanism
Authenticated model-catalog fetch and validated local cache.
AI rationale
The observed network behavior is product-aligned, configuration-gated model catalog retrieval rather than concrete exfiltration or remote code execution. Scanner hits resolve to bundled dependency/WASM code and do not establish malicious behavior.
48import fs$1 from "node:fs/promises";
L49: import { execFile, spawn, spawnSync } from "node:child_process";
L50: import { Writable } from "node:stream";
...
L77: if (resolved === path.parse(resolved).root) return true;
L78: const home = resolveHomeDir();
L79: if (home && resolved === path.resolve(home)) return true;
...
L136: * historically left behind — so an uninstall wasn't "no trace":
L137: * - the private Node runtime (~/.skykoi-node) it drops when no system Node,
L138: * - the `koi` shims in the npm prefix (incl. a hand-written dev shim that
...
L154: });
L155: if (process.platform === "win32") {
L156: const prefix = path.join(process.env.APPDATA || path.join(home, "AppData", "Roaming"), "npm");
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
48import fs$1 from "node:fs/promises";
L49: import { execFile, spawn, spawnSync } from "node:child_process";
L50: import { Writable } from "node:stream";
...
L77: if (resolved === path.parse(resolved).root) return true;
L78: const home = resolveHomeDir();
L79: if (home && resolved === path.resolve(home)) return true;
...
L136: * historically left behind — so an uninstall wasn't "no trace":
L137: * - the private Node runtime (~/.skykoi-node) it drops when no system Node,
L138: * - the `koi` shims in the npm prefix (incl. a hand-written dev shim that
...
L154: });
L155: if (process.platform === "win32") {
L156: const prefix = path.join(process.env.APPDATA || path.join(home, "AppData", "Roaming"), "npm");
Medium
Unsafe Vm Context
Package source executes code through a VM context API.
76import { a as formatTokenCount$2, i as estimateUsageCost, o as formatUsd$1, s as resolveModelCostConfig } from "./transcript-tools-UfIShVfz.js";
L77: import { a as minSecurity, d as resolveExecApprovalsFromFile, i as maxAsk, l as resolveSafeBins, o as recordAllowlistUse, r as evaluateShellAllowlist, s as requiresExecApproval, t ...
L78: import { a as canvasSnapshotTempPath, c as parseCameraClipPayload, d as buildNodeShellCommand, i as parseEnvPairs, l as parseCameraSnapPayload, n as screenRecordTempPath, o as pars...
L79: import { a as browserSnapshot, c as browserStop, d as fetchBrowserJson, i as browserProfiles, l as browserTabs, n as browserFocusTab, o as browserStart, r as browserOpenTab, s as b...
...
L113: import { createInterface } from "node:readline";
L114: import { createSer
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
76import { a as formatTokenCount$2, i as estimateUsageCost, o as formatUsd$1, s as resolveModelCostConfig } from "./transcript-tools-UfIShVfz.js";
L77: import { a as minSecurity, d as resolveExecApprovalsFromFile, i as maxAsk, l as resolveSafeBins, o as recordAllowlistUse, r as evaluateShellAllowlist, s as requiresExecApproval, t ...
L78: import { a as canvasSnapshotTempPath, c as parseCameraClipPayload, d as buildNodeShellCommand, i as parseEnvPairs, l as parseCameraSnapPayload, n as screenRecordTempPath, o as pars...
L79: import { a as browserSnapshot, c as browserStop, d as fetchBrowserJson, i as browserProfiles, l as browserTabs, n as browserFocusTab, o as browserStart, r as browserOpenTab, s as b...
...
L113: import { createInterface } from "node:readline";
L114: import { createSer
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
76Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js -> dist/reply-BSpnPmRp.js
L76: import { a as formatTokenCount$2, i as estimateUsageCost, o as formatUsd$1, s as resolveModelCostConfig } from "./transcript-tools-UfIShVfz.js";
L77: import { a as minSecurity, d as resolveExecApprovalsFromFile, i as maxAsk, l as resolveSafeBins, o as recordAllowlistUse, r as evaluateShellAllowlist, s as requiresExecApproval, t ...
L78: import { a as canvasSnapshotTempPath, c as parseCameraClipPayload, d as buildNodeShellCommand, i as parseEnvPairs, l as parseCameraSnapPayload, n as screenRecordTempPath, o as pars...
L79: import { a as browserSnapshot, c as browserStop, d as fetchBrowserJson, i as browserProfiles, l as browserTabs, n as browserFocusTab, o as browserStart, r as bro
High
Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/dist-DbdYn2HD.js:
import { writeFile } from "fs/promises";
baseUrl: "https://bedrock-runtime.us-east-1.amazonaws.com",
baseUrl: "https://bedrock-runtime.us-east-1.amazonaws.com",
baseUrl: "https://bedrock-runtime.us-east-1.amazonaws.com",
baseUrl: "https://bedrock-runtime.us-east-1.amazonaws.com",
baseUrl: "https://bedrock-runtime.us-east-1.amazonaws.com",
baseUrl: "https://bedrock-runtime.us-east-1.amazonaws.com",
baseUrl: "https://bedrock-runtime.us-east-1.amazonaws.com",
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
dist/dist-BV4k18uz.js:
import { accessSync, constants, createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
import { appendFileSync as appendFileSync$1, chmodSync as chmodSync$1, closeSync as closeSync$1, constants as constants$1, createWriteStream as createWriteStream$1, existsSync as e...
import { access as access$1, mkdir as mkdir$1, readFile as readFile$1, readdir as readdir$2, stat as stat$1, writeFile as writeFile$1 } from "fs/promises";
//#region node_modules/.pnpm/@mariozechner+pi-coding-agent@0.52.8_ws@8.19.0_zod@4.3.6/node_modules/@mariozechner/pi-coding-agent/dist/config.js
if (re
High
Entrypoint Foreign Package Code Overwrite
Manifest-reachable source overwrites another installed package with package-defined remote behavior.
11import { r as resolveWhatsAppAccount } from "./accounts-hnrVg4_k.js";
L12: import { r as init_esm_shims, t as __dirname } from "./esm-shims-DOra-T0N.js";
L13: import fs from "node:fs";
L14: import { exec } from "child_process";
L15: import { createReadStream as createReadStream$1, createWriteStream as createWriteStream$1, promises as promises$1 } from "fs";
...
L21: import * as Crypto from "crypto";
L22: import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from "crypto";
L23: import { mkdir, readFile, stat, unlink, writeFile } from "fs/promises";
L24: import WebSocket from "ws";
L25: import { randomUUID as randomUUID$1 } from "node:crypto";
...
L39: * @constructor
L40: * @private
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
•Remote response is passed to a worker and executed with Node capabilities.
dist/login-qr-CAbE5sJu.js:
import { i as __require, o as __toESM, r as __exportAll, t as __commonJSMin } from "./chunk-D_gEzPfs.js";
var require_eventemitter3 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
var require_aspromise = /* @__PURE__ */ __commonJSMin(((exports, module) => {
var require_base64 = /* @__PURE__ */ __commonJSMin(((exports) => {
var require_eventemitter = /* @__PURE__ */ __commonJSMin(((exports, module) => {
var require_float = /* @__PURE__ */ __commonJSMin(((exports, module) => {
var require_inquire$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
* Requires a module only if available.
dist/reply-BSpnPmRp.js:
import { i as __require, o as __toESM, r as __exportAll, t as __commo
Critical
Remote Response Code Execution
Source passes code obtained from a remote response into a dynamic execution sink.
48import fs$1 from "node:fs/promises";
L49: import { execFile, spawn, spawnSync } from "node:child_process";
L50: import { Writable } from "node:stream";
...
L77: if (resolved === path.parse(resolved).root) return true;
L78: const home = resolveHomeDir();
L79: if (home && resolved === path.resolve(home)) return true;
...
L136: * historically left behind — so an uninstall wasn't "no trace":
L137: * - the private Node runtime (~/.skykoi-node) it drops when no system Node,
L138: * - the `koi` shims in the npm prefix (incl. a hand-written dev shim that
...
L154: });
L155: if (process.platform === "win32") {
L156: const prefix = path.join(process.env.APPDATA || path.join(home, "AppData", "Roaming"), "npm");
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
48import fs$1 from "node:fs/promises";
L49: import { execFile, spawn, spawnSync } from "node:child_process";
L50: import { Writable } from "node:stream";
...
L77: if (resolved === path.parse(resolved).root) return true;
L78: const home = resolveHomeDir();
L79: if (home && resolved === path.resolve(home)) return true;
...
L136: * historically left behind — so an uninstall wasn't "no trace":
L137: * - the private Node runtime (~/.skykoi-node) it drops when no system Node,
L138: * - the `koi` shims in the npm prefix (incl. a hand-written dev shim that
...
L154: });
L155: if (process.platform === "win32") {
L156: const prefix = path.join(process.env.APPDATA || path.join(home, "AppData", "Roaming"), "npm");
Medium
Unsafe Vm Context
Package source executes code through a VM context API.
76import { a as formatTokenCount$2, i as estimateUsageCost, o as formatUsd$1, s as resolveModelCostConfig } from "./transcript-tools-UfIShVfz.js";
L77: import { a as minSecurity, d as resolveExecApprovalsFromFile, i as maxAsk, l as resolveSafeBins, o as recordAllowlistUse, r as evaluateShellAllowlist, s as requiresExecApproval, t ...
L78: import { a as canvasSnapshotTempPath, c as parseCameraClipPayload, d as buildNodeShellCommand, i as parseEnvPairs, l as parseCameraSnapPayload, n as screenRecordTempPath, o as pars...
L79: import { a as browserSnapshot, c as browserStop, d as fetchBrowserJson, i as browserProfiles, l as browserTabs, n as browserFocusTab, o as browserStart, r as browserOpenTab, s as b...
...
L113: import { createInterface } from "node:readline";
L114: import { createSer
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
76import { a as formatTokenCount$2, i as estimateUsageCost, o as formatUsd$1, s as resolveModelCostConfig } from "./transcript-tools-UfIShVfz.js";
L77: import { a as minSecurity, d as resolveExecApprovalsFromFile, i as maxAsk, l as resolveSafeBins, o as recordAllowlistUse, r as evaluateShellAllowlist, s as requiresExecApproval, t ...
L78: import { a as canvasSnapshotTempPath, c as parseCameraClipPayload, d as buildNodeShellCommand, i as parseEnvPairs, l as parseCameraSnapPayload, n as screenRecordTempPath, o as pars...
L79: import { a as browserSnapshot, c as browserStop, d as fetchBrowserJson, i as browserProfiles, l as browserTabs, n as browserFocusTab, o as browserStart, r as browserOpenTab, s as b...
...
L113: import { createInterface } from "node:readline";
L114: import { createSer
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/dist-DbdYn2HD.js:
import { writeFile } from "fs/promises";
baseUrl: "https://bedrock-runtime.us-east-1.amazonaws.com",
baseUrl: "https://bedrock-runtime.us-east-1.amazonaws.com",
baseUrl: "https://bedrock-runtime.us-east-1.amazonaws.com",
baseUrl: "https://bedrock-runtime.us-east-1.amazonaws.com",
baseUrl: "https://bedrock-runtime.us-east-1.amazonaws.com",
baseUrl: "https://bedrock-runtime.us-east-1.amazonaws.com",
baseUrl: "https://bedrock-runtime.us-east-1.amazonaws.com",
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
11import { r as resolveWhatsAppAccount } from "./accounts-hnrVg4_k.js";
L12: import { r as init_esm_shims, t as __dirname } from "./esm-shims-DOra-T0N.js";
L13: import fs from "node:fs";
L14: import { exec } from "child_process";
L15: import { createReadStream as createReadStream$1, createWriteStream as createWriteStream$1, promises as promises$1 } from "fs";
...
L21: import * as Crypto from "crypto";
L22: import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from "crypto";
L23: import { mkdir, readFile, stat, unlink, writeFile } from "fs/promises";
L24: import WebSocket from "ws";
L25: import { randomUUID as randomUUID$1 } from "node:crypto";
...
L39: * @constructor
L40: * @private
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
•Remote response is passed to a worker and executed with Node capabilities.
dist/login-qr-CAbE5sJu.js:
import { i as __require, o as __toESM, r as __exportAll, t as __commonJSMin } from "./chunk-D_gEzPfs.js";
var require_eventemitter3 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
var require_aspromise = /* @__PURE__ */ __commonJSMin(((exports, module) => {
var require_base64 = /* @__PURE__ */ __commonJSMin(((exports) => {
var require_eventemitter = /* @__PURE__ */ __commonJSMin(((exports, module) => {
var require_float = /* @__PURE__ */ __commonJSMin(((exports, module) => {
var require_inquire$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
* Requires a module only if available.
dist/reply-BSpnPmRp.js:
import { i as __require, o as __toESM, r as __exportAll, t as __commo
Critical
Remote Response Code Execution
Source passes code obtained from a remote response into a dynamic execution sink.
18import { n as isWSLEnv, t as isWSL } from"./wsl-CI-sLZO8.js";
19import { t as createDefaultDeps } from"./deps-Ci0UmhIa.js";
20import { o as resolveGatewayLogPaths, t as resolveGatewayService } from"./service-Bijwsx7a.js";
21import { r as isSystemdUserServiceAvailable } from"./systemd-CC8qsoSh.js";
22import { t as readLastGatewayErrorLine } from"./diagnostics-l1sIrg-l.js";
23import { i as buildGatewayInstallPlan, r as isGatewayDaemonRuntime, t as DEFAULT_GATEWAY_DAEMON_RUNTIME } from"./daemon-runtime-CI0RHp5z.js";
24import { n as renderSystemdUnavailableHints, t as isSystemdUnavailableDetail } from"./systemd-hints-j40ykvpd.js";
25import { a as renderGatewayServiceCleanupHints, i as findExtraGatewayServices, n as auditGatewayServiceConfig } from"./service-audit-CvPiF2WL.js";
26import { a as normalizeListenerAddress, c as pickProbeHostForBind, d as safeDaemonEnv, f as buildDaemonServiceSnapshot, l as renderGatewayServiceStartHints, m as emitDaemonActionJson, n as describeRuntimeLiveness, o as parsePort, p as createNullWriter, r as filterDaemonEnv, s as parsePortFromArgs, t as describeAutostart, u as renderRuntimeHints } from"./shared-Du3xRJjY.js";
76Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js -> dist/reply-BSpnPmRp.js
L76: import { a as formatTokenCount$2, i as estimateUsageCost, o as formatUsd$1, s as resolveModelCostConfig } from "./transcript-tools-UfIShVfz.js";
L77: import { a as minSecurity, d as resolveExecApprovalsFromFile, i as maxAsk, l as resolveSafeBins, o as recordAllowlistUse, r as evaluateShellAllowlist, s as requiresExecApproval, t ...
L78: import { a as canvasSnapshotTempPath, c as parseCameraClipPayload, d as buildNodeShellCommand, i as parseEnvPairs, l as parseCameraSnapPayload, n as screenRecordTempPath, o as pars...
L79: import { a as browserSnapshot, c as browserStop, d as fetchBrowserJson, i as browserProfiles, l as browserTabs, n as browserFocusTab, o as browserStart, r as bro
High
Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
dist/dist-BV4k18uz.js:
import { accessSync, constants, createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
import { appendFileSync as appendFileSync$1, chmodSync as chmodSync$1, closeSync as closeSync$1, constants as constants$1, createWriteStream as createWriteStream$1, existsSync as e...
import { access as access$1, mkdir as mkdir$1, readFile as readFile$1, readdir as readdir$2, stat as stat$1, writeFile as writeFile$1 } from "fs/promises";
//#region node_modules/.pnpm/@mariozechner+pi-coding-agent@0.52.8_ws@8.19.0_zod@4.3.6/node_modules/@mariozechner/pi-coding-agent/dist/config.js
if (re
High
Entrypoint Foreign Package Code Overwrite
Manifest-reachable source overwrites another installed package with package-defined remote behavior.