u-foo@3.1.7: Suspicious npm security report (Warn)

Loading npm security reports…

u-foo@3.1.7: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

24 flagged

package.jsonView file

Lines 31-71json

31 "ukimi": "bin/ukimi.js",

32 "ucode": "bin/ucode.js"

33 },

34 "files": [

35 "bin/",

36 "src/",

37 "templates/",

38 "online/",

39 "scripts/",

40 "dist/tui/",

41 "SKILLS/",

42 "OPTIONAL_SKILLS/",

43 "LICENSE",

44 "README.md"

45 ],

46 "type": "commonjs",

47 "engines": {

48 "node": ">=18.17"

49 },

50 "scripts": {

51 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L51

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L51

52 "pack:tui": "node scripts/pack-tui.js",

53 "prepack": "node scripts/pack-tui.js --check",

54 "test": "jest",

55 "test:watch": "jest --watch",

56 "test:coverage": "jest --coverage"

57 },

58 "dependencies": {

59 "@anthropic-ai/claude-agent-sdk": "^0.2.138",

60 "@modelcontextprotocol/sdk": "^1.30.0",

61 "@openai/codex-sdk": "^0.145.0",

62 "@xterm/addon-serialize": "^0.14.0",

63 "@xterm/headless": "^6.0.0",

64 "chalk": "^4.1.2",

65 "commander": "^13.1.0",

66 "gray-matter": "^4.0.3",

67 "node-pty": "^1.1.0",

68 "undici": "^6.28.0",

69 "ws": "^8.19.0"

70 },

71 "devDependencies": {

bin/ufoo.jsView file

Lines 74-114javascript

74 }

75 if (cmd === "chat") {

76 await runChat(chatProjectRoot, { globalMode });

77 return;

78 }

80 // Handle resume command to resume/launch agent sessions

src/code/tools/bash.jsView file

Lines 23-63javascript

23 // The process group may already have exited; fall back to the child.

24 }

25 }

26 try {

27 child.kill(signal);

28 } catch {

29 // ignore a child that already exited

30 }

bin/ukimi.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2/**

3 * ukimi: Launch Kimi Code CLI (kimi) and auto-join event bus

4 *

5 * Usage: ukimi [kimi args...]

6 *

7 * Differences vs uclaude:

8 * - kimi has no --append-system-prompt style flag, so the default

9 * bootstrap is delivered via post-launch PTY injection (same model as

10 * ucodex's UFOO_STARTUP_BOOTSTRAP_TEXT path).

11 * - Session resume uses kimi's own session ids via `--session <id>`.

src/runtime/projects/projectId.jsView file

Lines 1-21javascript

1const crypto = require("crypto");

2const fs = require("fs");

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/runtime/projects/projectId.jsView on unpkg · L1

3const

src/coordination/bus/inject.jsView file

Lines 1-21javascript

1const { spawn, spawnSync } = require("child_process");

2const fs = require("fs");

3const net

src/agents/providers/claudeThreadProvider.jsView file

Lines 11-51javascript

11const CACHE_CONTROL = Object.freeze({ type: "ephemeral" });

13function createThreadId() {

14 return `claude-thread-${Date.now().toString

scripts/postinstall.jsView file

74function installSkillDirs(targetDir, sources, label) { L75: fs.mkdirSync(targetDir, { recursive: true }); L76: ... L84: // Install ufoo skills for Claude and Codex at npm install time. L85: // - Claude skills: ~/.claude/skills/<name> -> skill dir L86: // - Codex skills: ${CODEX_HOME:-~/.codex}/skills/<name> -> skill dir L87: try { ... L90: const sources = collectSkillSources(pkgRoot); L91: const codexHome = process.env.CODEX_HOME || path.join(home, ".codex"); L92: const retiredLinks = [redacted]({ pkgRoot, home, codexHome }); ... L98: if (sources.length > 0) { L99: installSkillDirs(path.join(home, ".claude", "skills"), sources, "~/.claude/skills");

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L74

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. es", "node-pty", "prebuilds", platform, "spawn-helper" ); if (fs.existssync(spawnhelperpath)) { const stats = fs.statsync(spawnhelperpath); if ((stats.mode & 0o111) === 0) { fs.chmodsync(spawnhelperpath, 0o755); console.log(`[postinstall] fixed node-pty spawn-helper permissions (${platform})`); } } } catch { } } try { const plat = `${process.platform}-${process.arch}`; const tuibin = path.join(__dirname, "..", "dist", "tui", plat, "ufoo-tui"); if (

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/postinstall.jsView on unpkg

dist/tui/linux-arm64/ufoo-tuiView file

•path = dist/tui/linux-arm64/ufoo-tui kind = native_binary sizeBytes = 2130744 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/tui/linux-arm64/ufoo-tuiView on unpkg

src/agents/controller/ufooAgent.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/agents/controller/ufooAgent.js#virtual:normalized:round1View on unpkg

src/agents/launch/launcher.jsView file

•matchType = normalized_sha256 matchedPackage = u-foo@3.1.1 matchedPath = src/agents/launch/launcher.js matchedIdentity = npm:dS1mb28:3.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agents/launch/launcher.jsView on unpkg

src/coordination/bus/index.jsView file

•matchType = normalized_sha256 matchedPackage = u-foo@3.1.1 matchedPath = src/coordination/bus/index.js matchedIdentity = npm:dS1mb28:3.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/coordination/bus/index.jsView on unpkg

src/runtime/daemon/ops.jsView file

•matchType = normalized_sha256 matchedPackage = u-foo@3.1.1 matchedPath = src/runtime/daemon/ops.js matchedIdentity = npm:dS1mb28:3.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/runtime/daemon/ops.jsView on unpkg

src/ui/rustChatHost.jsView file

•matchType = normalized_sha256 matchedPackage = u-foo@3.1.1 matchedPath = src/ui/rustChatHost.js matchedIdentity = npm:dS1mb28:3.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/ui/rustChatHost.jsView on unpkg

src/agents/launch/ptyWrapper.jsView file

•matchType = normalized_sha256 matchedPackage = u-foo@3.1.1 matchedPath = src/agents/launch/ptyWrapper.js matchedIdentity = npm:dS1mb28:3.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agents/launch/ptyWrapper.jsView on unpkg

src/app/chat/transport.jsView file

•matchType = normalized_sha256 matchedPackage = u-foo@3.1.1 matchedPath = src/app/chat/transport.js matchedIdentity = npm:dS1mb28:3.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/app/chat/transport.jsView on unpkg

src/app/cli/run.jsView file

•matchType = normalized_sha256 matchedPackage = u-foo@3.1.1 matchedPath = src/app/cli/run.js matchedIdentity = npm:dS1mb28:3.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/app/cli/run.jsView on unpkg

src/runtime/daemon/mcpConfigure.jsView file

•matchType = normalized_sha256 matchedPackage = u-foo@3.1.1 matchedPath = src/runtime/daemon/mcpConfigure.js matchedIdentity = npm:dS1mb28:3.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/runtime/daemon/mcpConfigure.jsView on unpkg

src/runtime/daemon/run.jsView file

•matchType = normalized_sha256 matchedPackage = u-foo@3.1.1 matchedPath = src/runtime/daemon/run.js matchedIdentity = npm:dS1mb28:3.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/runtime/daemon/run.jsView on unpkg

src/agents/prompts/native/environment.jsView file

•matchType = normalized_sha256 matchedPackage = u-foo@3.1.1 matchedPath = [redacted].js matchedIdentity = npm:dS1mb28:3.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agents/prompts/native/environment.jsView on unpkg

Source & flagged code

24 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/ufoo.jsView file

94L95: const { execSync } = require("child_process"); L96: const path = require("path");

High

Child Process

Package source references child process execution.

bin/ufoo.jsView on unpkg · L94

•matchType = normalized_sha256 matchedPackage = u-foo@3.1.1 matchedPath = bin/ufoo.js matchedIdentity = npm:dS1mb28:3.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/ufoo.jsView on unpkg

src/code/tools/bash.jsView file

43cwd: workspaceRoot, L44: shell: true, L45: timeout: timeoutMs,

High

Shell

Package source references shell execution.

src/code/tools/bash.jsView on unpkg · L43

bin/ukimi.jsView file

13L14: const AgentLauncher = require("../src/agents/launch/launcher"); L15: const { resolveDefaultManualBootstrap } = require("../[redacted]");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/ukimi.jsView on unpkg · L13

src/runtime/projects/projectId.jsView file

1const crypto = require("crypto"); L2: const fs = require("fs");

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/runtime/projects/projectId.jsView on unpkg · L1

src/coordination/bus/inject.jsView file

1const { spawn, spawnSync } = require("child_process"); L2: const fs = require("fs"); L3: const net = require("net"); L4: const path = require("path"); ... L7: L8: const SHOULD_LOG_INJECT = process.env.UFOO_INJECT_DEBUG === "1"; L9: const logInject = (message) => {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/coordination/bus/inject.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = u-foo@3.1.1 matchedPath = src/coordination/bus/inject.js matchedIdentity = npm:dS1mb28:3.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/coordination/bus/inject.jsView on unpkg

src/agents/providers/claudeThreadProvider.jsView file

31package = u-foo; repositoryIdentity = ufoo; dependency = @anthropic-ai/claude-agent-sdk L31: try { L32: return await import("@anthropic-ai/claude-agent-sdk"); L33: } catch (err) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/agents/providers/claudeThreadProvider.jsView on unpkg · L31

scripts/postinstall.jsView file

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L74

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/postinstall.jsView on unpkg

dist/tui/linux-arm64/ufoo-tuiView file

•path = dist/tui/linux-arm64/ufoo-tui kind = native_binary sizeBytes = 2130744 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/tui/linux-arm64/ufoo-tuiView on unpkg

src/agents/controller/ufooAgent.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/agents/controller/ufooAgent.js#virtual:normalized:round1View on unpkg

src/agents/launch/launcher.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agents/launch/launcher.jsView on unpkg

src/coordination/bus/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/coordination/bus/index.jsView on unpkg

src/runtime/daemon/ops.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/runtime/daemon/ops.jsView on unpkg

src/ui/rustChatHost.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/ui/rustChatHost.jsView on unpkg

src/agents/launch/ptyWrapper.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agents/launch/ptyWrapper.jsView on unpkg

src/app/chat/transport.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/app/chat/transport.jsView on unpkg

src/app/cli/run.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/app/cli/run.jsView on unpkg

src/runtime/daemon/mcpConfigure.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/runtime/daemon/mcpConfigure.jsView on unpkg

src/runtime/daemon/run.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/runtime/daemon/run.jsView on unpkg

src/agents/prompts/native/environment.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agents/prompts/native/environment.jsView on unpkg

Source & flagged code

24 flagged

package.jsonView file

Lines 31-71json

31 "ukimi": "bin/ukimi.js",

32 "ucode": "bin/ucode.js"

33 },

34 "files": [

35 "bin/",

36 "src/",

37 "templates/",

38 "online/",

39 "scripts/",

40 "dist/tui/",

41 "SKILLS/",

42 "OPTIONAL_SKILLS/",

43 "LICENSE",

44 "README.md"

45 ],

46 "type": "commonjs",

47 "engines": {

48 "node": ">=18.17"

49 },

50 "scripts": {

51 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L51

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L51

52 "pack:tui": "node scripts/pack-tui.js",

53 "prepack": "node scripts/pack-tui.js --check",

54 "test": "jest",

55 "test:watch": "jest --watch",

56 "test:coverage": "jest --coverage"

57 },

58 "dependencies": {

59 "@anthropic-ai/claude-agent-sdk": "^0.2.138",

60 "@modelcontextprotocol/sdk": "^1.30.0",

61 "@openai/codex-sdk": "^0.145.0",

62 "@xterm/addon-serialize": "^0.14.0",

63 "@xterm/headless": "^6.0.0",

64 "chalk": "^4.1.2",

65 "commander": "^13.1.0",

66 "gray-matter": "^4.0.3",

67 "node-pty": "^1.1.0",

68 "undici": "^6.28.0",

69 "ws": "^8.19.0"

70 },

71 "devDependencies": {

bin/ufoo.jsView file

Lines 74-114javascript

74 }

75 if (cmd === "chat") {

76 await runChat(chatProjectRoot, { globalMode });

77 return;

78 }

80 // Handle resume command to resume/launch agent sessions

src/code/tools/bash.jsView file

Lines 23-63javascript

23 // The process group may already have exited; fall back to the child.

24 }

25 }

26 try {

27 child.kill(signal);

28 } catch {

29 // ignore a child that already exited

30 }

bin/ukimi.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2/**

3 * ukimi: Launch Kimi Code CLI (kimi) and auto-join event bus

4 *

5 * Usage: ukimi [kimi args...]

6 *

7 * Differences vs uclaude:

8 * - kimi has no --append-system-prompt style flag, so the default

9 * bootstrap is delivered via post-launch PTY injection (same model as

10 * ucodex's UFOO_STARTUP_BOOTSTRAP_TEXT path).

11 * - Session resume uses kimi's own session ids via `--session <id>`.

src/runtime/projects/projectId.jsView file

Lines 1-21javascript

1const crypto = require("crypto");

2const fs = require("fs");

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/runtime/projects/projectId.jsView on unpkg · L1

3const

src/coordination/bus/inject.jsView file

Lines 1-21javascript

1const { spawn, spawnSync } = require("child_process");

2const fs = require("fs");

3const net

src/agents/providers/claudeThreadProvider.jsView file

Lines 11-51javascript

11const CACHE_CONTROL = Object.freeze({ type: "ephemeral" });

13function createThreadId() {

14 return `claude-thread-${Date.now().toString

scripts/postinstall.jsView file

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L74

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/postinstall.jsView on unpkg

dist/tui/linux-arm64/ufoo-tuiView file

•path = dist/tui/linux-arm64/ufoo-tui kind = native_binary sizeBytes = 2130744 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/tui/linux-arm64/ufoo-tuiView on unpkg

src/agents/controller/ufooAgent.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/agents/controller/ufooAgent.js#virtual:normalized:round1View on unpkg

src/agents/launch/launcher.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agents/launch/launcher.jsView on unpkg

src/coordination/bus/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/coordination/bus/index.jsView on unpkg

src/runtime/daemon/ops.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/runtime/daemon/ops.jsView on unpkg

src/ui/rustChatHost.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/ui/rustChatHost.jsView on unpkg

src/agents/launch/ptyWrapper.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agents/launch/ptyWrapper.jsView on unpkg

src/app/chat/transport.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/app/chat/transport.jsView on unpkg

src/app/cli/run.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/app/cli/run.jsView on unpkg

src/runtime/daemon/mcpConfigure.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/runtime/daemon/mcpConfigure.jsView on unpkg

src/runtime/daemon/run.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/runtime/daemon/run.jsView on unpkg

src/agents/prompts/native/environment.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agents/prompts/native/environment.jsView on unpkg

u-foo@3.1.7

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code