SkyKoi — Koi runtime. Multi-channel gateway CLI with RPC Koi.
AI Security Review
scanned 2mo ago · by lpm-firewall-ai
The scanner's remote-code-execution label is overstated: the observed dynamic evaluation is bundled dependency code, not remote response execution. However, the package implements an autonomous, networked local-data collection and model-delegation capability that warrants a warning.
Running the gateway/proactive evaluation service and receiving local capture triggers.
Impact
Sensitive screen, terminal, audio, message, calendar, and notification content may leave the device; untrusted captured content can influence model-directed actions.
Mechanism
Autonomous context collection, remote AI prompting, and model-directed agent delegation.
AI rationale
The scanner's remote-code-execution label is overstated: the observed dynamic evaluation is bundled dependency code, not remote response execution. However, the package implements an autonomous, networked local-data collection and model-delegation capability that warrants a warning.
6import { l as graphEventOutboxSize } from "./graph-preview-outbox-2eq1U_Ie.js";
L7: import { g as pushCaptureEvent, h as onPrivateModeChange, l as drainEvents, m as isPrivateMode, n as resolveVoiceIdentity, p as isAudioMuted, u as flushToDisk, y as sweepTmpDbOrpha...
L8: import { r as resolveCapturePolicy, t as captureSourceEnabled } from "./capture-policy-movNohfh.js";
...
L14: import { readdir, rm } from "node:fs/promises";
L15: import { exec, execFile, execFileSync, execSync, spawn } from "node:child_process";
L16:
...
L77: windowsHide: true
L78: }, (err, stdout) => {
L79: if (err) {
...
L122: async function captureTerminals() {
L123: if (process.platform !== "darwin") return [];
L124: const [itermRaw, terminalRaw] = await Promise.all([runOsascript$1(ITERM_SCRIPT), runOsascript$1(T
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
76import { a as formatTokenCount$2, i as estimateUsageCost, o as formatUsd$1, s as resolveModelCostConfig } from "./transcript-tools-UfIShVfz.js";
L77: import { a as minSecurity, d as resolveExecApprovalsFromFile, i as maxAsk, l as resolveSafeBins, o as recordAllowlistUse, r as evaluateShellAllowlist, s as requiresExecApproval, t ...
L78: import { a as canvasSnapshotTempPath, c as parseCameraClipPayload, d as buildNodeShellCommand, i as parseEnvPairs, l as parseCameraSnapPayload, n as screenRecordTempPath, o as pars...
L79: import { a as browserSnapshot, c as browserStop, d as fetchBrowserJson, i as browserProfiles, l as browserTabs, n as browserFocusTab, o as browserStart, r as browserOpenTab, s as b...
...
L113: import { createInterface } from "node:readline";
L114: import { createSer
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
76import { a as formatTokenCount$2, i as estimateUsageCost, o as formatUsd$1, s as resolveModelCostConfig } from "./transcript-tools-UfIShVfz.js";
L77: import { a as minSecurity, d as resolveExecApprovalsFromFile, i as maxAsk, l as resolveSafeBins, o as recordAllowlistUse, r as evaluateShellAllowlist, s as requiresExecApproval, t ...
L78: import { a as canvasSnapshotTempPath, c as parseCameraClipPayload, d as buildNodeShellCommand, i as parseEnvPairs, l as parseCameraSnapPayload, n as screenRecordTempPath, o as pars...
L79: import { a as browserSnapshot, c as browserStop, d as fetchBrowserJson, i as browserProfiles, l as browserTabs, n as browserFocusTab, o as browserStart, r as browserOpenTab, s as b...
...
L113: import { createInterface } from "node:readline";
L114: import { createSer
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
76Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js -> dist/reply-D2cV1q7_.js
L76: import { a as formatTokenCount$2, i as estimateUsageCost, o as formatUsd$1, s as resolveModelCostConfig } from "./transcript-tools-UfIShVfz.js";
L77: import { a as minSecurity, d as resolveExecApprovalsFromFile, i as maxAsk, l as resolveSafeBins, o as recordAllowlistUse, r as evaluateShellAllowlist, s as requiresExecApproval, t ...
L78: import { a as canvasSnapshotTempPath, c as parseCameraClipPayload, d as buildNodeShellCommand, i as parseEnvPairs, l as parseCameraSnapPayload, n as screenRecordTempPath, o as pars...
L79: import { a as browserSnapshot, c as browserStop, d as fetchBrowserJson, i as browserProfiles, l as browserTabs, n as browserFocusTab, o as browserStart, r as bro
High
Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/model-selection-eVZa08Vb.js:
import fs, { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
* - A provider with a config key, a non-seed baseUrl, or a model set other
const xaiSeeded = xai !== void 0 && !xai.apiKey?.trim() && (xai.baseUrl === void 0 || xai.baseUrl === SEEDED_XAI_BASE_URL) && xaiModels.length === 1 && xaiModels[0]?.id === SEEDED_...
baseUrl: z.string().min(1),
baseUrl: z.string().optional(),
baseUrl: z.string().optional(),
baseUrl: z.string().optional(),
baseUrl: z.string().optional(),
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
dist/dist-C_FHbTTK.js:
import { accessSync, constants, createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
import { appendFileSync as appendFileSync$1, chmodSync as chmodSync$1, closeSync as closeSync$1, constants as constants$1, createWriteStream as createWriteStream$1, existsSync as e...
import { access as access$1, mkdir as mkdir$1, readFile as readFile$1, readdir as readdir$2, stat as stat$1, writeFile as writeFile$1 } from "fs/promises";
//#region node_modules/.pnpm/@mariozechner+pi-coding-agent@0.52.8_ws@8.19.0_zod@4.3.6/node_modules/@mariozechner/pi-coding-agent/dist/config.js
if (re
High
Entrypoint Foreign Package Code Overwrite
Manifest-reachable source overwrites another installed package with package-defined remote behavior.
73import { a as resolveOutboundTarget, o as resolveSessionDeliveryTarget, u as normalizePollInput } from "./message-uZdVl-Fe.js";
L74: import { i as [redacted], s as verifyDeviceSignature, t as deriveDeviceIdFromPublicKey } from "./device-identity-S9LsHyR8.js";
L75: import { n as pickPrimaryTailnetIPv6, t as pickPrimaryTailnetIPv4 } from "./tailnet-Cr3uILr_.js";
L76: import { $ as validateNodePairListParams, A as [redacted], At as ErrorCodes, B as validateKoiIdentityParams, C as validateCronUpdateParams, Ct as validateWeb...
L77: import { n as callGateway, s as loadGatewayTlsRuntime$1 } from "./call-ePYRIWp3.js";
...
L112: import "./graph-access-CDNpfrV8.js";
L113: import { _ as setAudioMuted, m as isPrivateMode, p as isAudioMuted, v as setPrivateMode } from "./identify-DcWtcev6.js";
L1
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
73import { a as resolveOutboundTarget, o as resolveSessionDeliveryTarget, u as normalizePollInput } from "./message-uZdVl-Fe.js";
L74: import { i as [redacted], s as verifyDeviceSignature, t as deriveDeviceIdFromPublicKey } from "./device-identity-S9LsHyR8.js";
L75: import { n as pickPrimaryTailnetIPv6, t as pickPrimaryTailnetIPv4 } from "./tailnet-Cr3uILr_.js";
L76: import { $ as validateNodePairListParams, A as [redacted], At as ErrorCodes, B as validateKoiIdentityParams, C as validateCronUpdateParams, Ct as validateWeb...
L77: import { n as callGateway, s as loadGatewayTlsRuntime$1 } from "./call-ePYRIWp3.js";
...
L112: import "./graph-access-CDNpfrV8.js";
L113: import { _ as setAudioMuted, m as isPrivateMode, p as isAudioMuted, v as setPrivateMode } from "./identify-DcWtcev6.js";
L1
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
48import fs$1 from "node:fs/promises";
L49: import { execFile, spawn, spawnSync } from "node:child_process";
L50: import { Writable } from "node:stream";
...
L77: if (resolved === path.parse(resolved).root) return true;
L78: const home = resolveHomeDir();
L79: if (home && resolved === path.resolve(home)) return true;
...
L136: * historically left behind — so an uninstall wasn't "no trace":
L137: * - the private Node runtime (~/.skykoi-node) it drops when no system Node,
L138: * - the `koi` shims in the npm prefix (incl. a hand-written dev shim that
...
L154: });
L155: if (process.platform === "win32") {
L156: const prefix = path.join(process.env.APPDATA || path.join(home, "AppData", "Roaming"), "npm");
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
•Remote response is passed to a worker and executed with Node capabilities.
dist/login-qr-DBgNo35J.js:
import { i as __require, o as __toESM, r as __exportAll, t as __commonJSMin } from "./chunk-D_gEzPfs.js";
var require_eventemitter3 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
var require_aspromise = /* @__PURE__ */ __commonJSMin(((exports, module) => {
var require_base64 = /* @__PURE__ */ __commonJSMin(((exports) => {
var require_eventemitter = /* @__PURE__ */ __commonJSMin(((exports, module) => {
var require_float = /* @__PURE__ */ __commonJSMin(((exports, module) => {
var require_inquire$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
* Requires a module only if available.
dist/reply-D2cV1q7_.js:
import { i as __require, o as __toESM, r as __exportAll, t as __commo
Critical
Remote Response Code Execution
Source passes code obtained from a remote response into a dynamic execution sink.
76import { a as formatTokenCount$2, i as estimateUsageCost, o as formatUsd$1, s as resolveModelCostConfig } from "./transcript-tools-UfIShVfz.js";
L77: import { a as minSecurity, d as resolveExecApprovalsFromFile, i as maxAsk, l as resolveSafeBins, o as recordAllowlistUse, r as evaluateShellAllowlist, s as requiresExecApproval, t ...
L78: import { a as canvasSnapshotTempPath, c as parseCameraClipPayload, d as buildNodeShellCommand, i as parseEnvPairs, l as parseCameraSnapPayload, n as screenRecordTempPath, o as pars...
L79: import { a as browserSnapshot, c as browserStop, d as fetchBrowserJson, i as browserProfiles, l as browserTabs, n as browserFocusTab, o as browserStart, r as browserOpenTab, s as b...
...
L113: import { createInterface } from "node:readline";
L114: import { createSer
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
76import { a as formatTokenCount$2, i as estimateUsageCost, o as formatUsd$1, s as resolveModelCostConfig } from "./transcript-tools-UfIShVfz.js";
L77: import { a as minSecurity, d as resolveExecApprovalsFromFile, i as maxAsk, l as resolveSafeBins, o as recordAllowlistUse, r as evaluateShellAllowlist, s as requiresExecApproval, t ...
L78: import { a as canvasSnapshotTempPath, c as parseCameraClipPayload, d as buildNodeShellCommand, i as parseEnvPairs, l as parseCameraSnapPayload, n as screenRecordTempPath, o as pars...
L79: import { a as browserSnapshot, c as browserStop, d as fetchBrowserJson, i as browserProfiles, l as browserTabs, n as browserFocusTab, o as browserStart, r as browserOpenTab, s as b...
...
L113: import { createInterface } from "node:readline";
L114: import { createSer
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/model-selection-eVZa08Vb.js:
import fs, { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
* - A provider with a config key, a non-seed baseUrl, or a model set other
const xaiSeeded = xai !== void 0 && !xai.apiKey?.trim() && (xai.baseUrl === void 0 || xai.baseUrl === SEEDED_XAI_BASE_URL) && xaiModels.length === 1 && xaiModels[0]?.id === SEEDED_...
baseUrl: z.string().min(1),
baseUrl: z.string().optional(),
baseUrl: z.string().optional(),
baseUrl: z.string().optional(),
baseUrl: z.string().optional(),
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
73import { a as resolveOutboundTarget, o as resolveSessionDeliveryTarget, u as normalizePollInput } from "./message-uZdVl-Fe.js";
L74: import { i as [redacted], s as verifyDeviceSignature, t as deriveDeviceIdFromPublicKey } from "./device-identity-S9LsHyR8.js";
L75: import { n as pickPrimaryTailnetIPv6, t as pickPrimaryTailnetIPv4 } from "./tailnet-Cr3uILr_.js";
L76: import { $ as validateNodePairListParams, A as [redacted], At as ErrorCodes, B as validateKoiIdentityParams, C as validateCronUpdateParams, Ct as validateWeb...
L77: import { n as callGateway, s as loadGatewayTlsRuntime$1 } from "./call-ePYRIWp3.js";
...
L112: import "./graph-access-CDNpfrV8.js";
L113: import { _ as setAudioMuted, m as isPrivateMode, p as isAudioMuted, v as setPrivateMode } from "./identify-DcWtcev6.js";
L1
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
73import { a as resolveOutboundTarget, o as resolveSessionDeliveryTarget, u as normalizePollInput } from "./message-uZdVl-Fe.js";
L74: import { i as [redacted], s as verifyDeviceSignature, t as deriveDeviceIdFromPublicKey } from "./device-identity-S9LsHyR8.js";
L75: import { n as pickPrimaryTailnetIPv6, t as pickPrimaryTailnetIPv4 } from "./tailnet-Cr3uILr_.js";
L76: import { $ as validateNodePairListParams, A as [redacted], At as ErrorCodes, B as validateKoiIdentityParams, C as validateCronUpdateParams, Ct as validateWeb...
L77: import { n as callGateway, s as loadGatewayTlsRuntime$1 } from "./call-ePYRIWp3.js";
...
L112: import "./graph-access-CDNpfrV8.js";
L113: import { _ as setAudioMuted, m as isPrivateMode, p as isAudioMuted, v as setPrivateMode } from "./identify-DcWtcev6.js";
L1
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
48import fs$1 from "node:fs/promises";
L49: import { execFile, spawn, spawnSync } from "node:child_process";
L50: import { Writable } from "node:stream";
...
L77: if (resolved === path.parse(resolved).root) return true;
L78: const home = resolveHomeDir();
L79: if (home && resolved === path.resolve(home)) return true;
...
L136: * historically left behind — so an uninstall wasn't "no trace":
L137: * - the private Node runtime (~/.skykoi-node) it drops when no system Node,
L138: * - the `koi` shims in the npm prefix (incl. a hand-written dev shim that
...
L154: });
L155: if (process.platform === "win32") {
L156: const prefix = path.join(process.env.APPDATA || path.join(home, "AppData", "Roaming"), "npm");
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
•Remote response is passed to a worker and executed with Node capabilities.
dist/login-qr-DBgNo35J.js:
import { i as __require, o as __toESM, r as __exportAll, t as __commonJSMin } from "./chunk-D_gEzPfs.js";
var require_eventemitter3 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
var require_aspromise = /* @__PURE__ */ __commonJSMin(((exports, module) => {
var require_base64 = /* @__PURE__ */ __commonJSMin(((exports) => {
var require_eventemitter = /* @__PURE__ */ __commonJSMin(((exports, module) => {
var require_float = /* @__PURE__ */ __commonJSMin(((exports, module) => {
var require_inquire$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
* Requires a module only if available.
dist/reply-D2cV1q7_.js:
import { i as __require, o as __toESM, r as __exportAll, t as __commo
Critical
Remote Response Code Execution
Source passes code obtained from a remote response into a dynamic execution sink.
22constr= (t) =>newUint8Array(t.length/2).map(((n, e) =>parseInt(t.substring(2* e, 2* (e +1)), 16))), o= (t) =>r(t)[0], s=/* @__PURE__ */newMap();
23 [
24 ,
258364,
26 ,
278218,
28402,
298222,
308230,
318224,
328225,
33710,
348240,
35352,
368249,
37338,
18import { n as isWSLEnv, t as isWSL } from"./wsl-CI-sLZO8.js";
19import { t as createDefaultDeps } from"./deps-CP8dgeqC.js";
20import { o as resolveGatewayLogPaths, t as resolveGatewayService } from"./service-Bijwsx7a.js";
21import { r as isSystemdUserServiceAvailable } from"./systemd-CC8qsoSh.js";
22import { t as readLastGatewayErrorLine } from"./diagnostics-l1sIrg-l.js";
23import { i as buildGatewayInstallPlan, r as isGatewayDaemonRuntime, t as DEFAULT_GATEWAY_DAEMON_RUNTIME } from"./daemon-runtime-CpJ83Bk3.js";
24import { n as renderSystemdUnavailableHints, t as isSystemdUnavailableDetail } from"./systemd-hints-j40ykvpd.js";
25import { a as renderGatewayServiceCleanupHints, i as findExtraGatewayServices, n as auditGatewayServiceConfig } from"./service-audit-DlMh4adN.js";
26import { a as normalizeListenerAddress, c as pickProbeHostForBind, d as safeDaemonEnv, f as buildDaemonServiceSnapshot, l as renderGatewayServiceStartHints, m as emitDaemonActionJson, n as describeRuntimeLiveness, o as parsePort, p as createNullWriter, r as filterDaemonEnv, s as parsePortFromArgs, t as describeAutostart, u as renderRuntimeHints } from"./shared-BAV1ahvK.js";
import { a as clearBillingAlert, i as classifyBillingFailure, o as reportBillingAlert } from"./billing-alerts-NEfc_gjv.js";
5import { r as loadOrCreateDeviceIdentity } from"./device-identity-S9LsHyR8.js";
6import { l as graphEventOutboxSize } from"./graph-preview-outbox-2eq1U_Ie.js";
7import { g as pushCaptureEvent, h as onPrivateModeChange, l as drainEvents, m as isPrivateMode, n as resolveVoiceIdentity, p as isAudioMuted, u as flushToDisk, y as sweepTmpDbOrphans } from"./identify-DcWtcev6.js";
8import { r as resolveCapturePolicy, t as captureSourceEnabled } from"./capture-policy-movNohfh.js";
9import { n as EchoTracker, t as DominantSpeakerTracker } from"./audio-echo-1bDoJBiN.js";
76Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js -> dist/reply-D2cV1q7_.js
L76: import { a as formatTokenCount$2, i as estimateUsageCost, o as formatUsd$1, s as resolveModelCostConfig } from "./transcript-tools-UfIShVfz.js";
L77: import { a as minSecurity, d as resolveExecApprovalsFromFile, i as maxAsk, l as resolveSafeBins, o as recordAllowlistUse, r as evaluateShellAllowlist, s as requiresExecApproval, t ...
L78: import { a as canvasSnapshotTempPath, c as parseCameraClipPayload, d as buildNodeShellCommand, i as parseEnvPairs, l as parseCameraSnapPayload, n as screenRecordTempPath, o as pars...
L79: import { a as browserSnapshot, c as browserStop, d as fetchBrowserJson, i as browserProfiles, l as browserTabs, n as browserFocusTab, o as browserStart, r as bro
High
Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
dist/dist-C_FHbTTK.js:
import { accessSync, constants, createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
import { appendFileSync as appendFileSync$1, chmodSync as chmodSync$1, closeSync as closeSync$1, constants as constants$1, createWriteStream as createWriteStream$1, existsSync as e...
import { access as access$1, mkdir as mkdir$1, readFile as readFile$1, readdir as readdir$2, stat as stat$1, writeFile as writeFile$1 } from "fs/promises";
//#region node_modules/.pnpm/@mariozechner+pi-coding-agent@0.52.8_ws@8.19.0_zod@4.3.6/node_modules/@mariozechner/pi-coding-agent/dist/config.js
if (re
High
Entrypoint Foreign Package Code Overwrite
Manifest-reachable source overwrites another installed package with package-defined remote behavior.