xiaokcode: Suspicious npm security report (Warn)

Loading npm security reports…

Source & flagged code

4 flagged

dist/platform/runtime/context.jsView file

Lines 1-21javascript

1import { execFile } from 'child_process';

2import { readFileSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/platform/runtime/context.jsView on unpkg · L1

3import { join } from 'path';

4import { loadCustomAgents } from '../../ai/agents/loader.js';

5import { buildMcpRuntimeTools } from '../../ai/mcp/runtime/tools.js';

6import { createComputerUseTool } from '../../ai/tools/computer-use.js';

7import { normalizeMcpRuntimeToolResult } from '../../ai/mcp/runtime/client.js';

8import { createBackgroundRunner } from '../agents/background-runner.js';

9import { createLspManager } from '../lsp/manager.js';

10import { loadPlatformPluginRuntime, connectDeclaredLspServer } from '../plugins/runtime.js';

11import { createSandboxEnforcer } from '../sandbox/enforcer.js';

12import { createSandboxPolicy } from '../sandbox/policy.js';

13import { FileTeamStore } from '../teams/store.js';

14import { createTeamService } from '../teams/service.js';

15import { createWorktreeManager } from '../worktrees/manager.js';

16import { ReminderClientService } from '../../runtime/reminder/client.js';

17import { resolveXiaokDaemonSocketPath } from '../../runtime/reminder/ipc.js';

18import { createReminderService } from '../../runtime/reminder/service.js';

19import { CapabilityRegistry } from './capability-registry.js';

20import { FileCapabilityHealthStore } from './health-store.js';

21import { loadSettingsMcpServers, loadPluginMcpServers, mergeMcpServerConfigs, } from '../mcp/config.js';

dist/platform/lsp/server-process.jsView file

Lines 1-26javascript

1import { spawn } from 'child_process';

2import { decodeLspFrames, encodeLspMessage } from './client.js';

3export function buildLspServerSpawnOptions(command, options = {}) {

dist/ai/skills/execution-state.jsView file

Lines 1-21javascript

1import { createHash } from 'node:crypto';

2export function createEmptySessionSkillExecutionState(now = Date.now()) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/ai/skills/execution-state.jsView on unpkg · L1

3 return

dist/commands/plugin.jsView file

Lines 1-22javascript

1import { existsSync, mkdirSync, readdirSync, rmSync, readFileSync, } from 'fs';

2import { join, resolve } from 'path';

3import { execSync } from 'child_process';

4import https from 'https';

Source & flagged code

4 flagged · loading source

dist/platform/runtime/context.jsView file

1import { execFile } from 'child_process'; L2: import { readFileSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/platform/runtime/context.jsView on unpkg · L1

dist/platform/lsp/server-process.jsView file

6stdio: 'pipe', L7: windowsVerbatimArguments: platform === 'win32' && command.toLowerCase() === 'cmd.exe', L8: ...(platform === 'win32' ? { windowsHide: true } : {}),

High

Shell

Package source references shell execution.

dist/platform/lsp/server-process.jsView on unpkg · L6

dist/ai/skills/execution-state.jsView file

xiaokcode: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

4 flagged

dist/platform/runtime/context.jsView file

Lines 1-21javascript

1import { execFile } from 'child_process';

2import { readFileSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/platform/runtime/context.jsView on unpkg · L1

3import { join } from 'path';

4import { loadCustomAgents } from '../../ai/agents/loader.js';

5import { buildMcpRuntimeTools } from '../../ai/mcp/runtime/tools.js';

6import { createComputerUseTool } from '../../ai/tools/computer-use.js';

7import { normalizeMcpRuntimeToolResult } from '../../ai/mcp/runtime/client.js';

8import { createBackgroundRunner } from '../agents/background-runner.js';

9import { createLspManager } from '../lsp/manager.js';

10import { loadPlatformPluginRuntime, connectDeclaredLspServer } from '../plugins/runtime.js';

11import { createSandboxEnforcer } from '../sandbox/enforcer.js';

12import { createSandboxPolicy } from '../sandbox/policy.js';

13import { FileTeamStore } from '../teams/store.js';

14import { createTeamService } from '../teams/service.js';

15import { createWorktreeManager } from '../worktrees/manager.js';

16import { ReminderClientService } from '../../runtime/reminder/client.js';

17import { resolveXiaokDaemonSocketPath } from '../../runtime/reminder/ipc.js';

18import { createReminderService } from '../../runtime/reminder/service.js';

19import { CapabilityRegistry } from './capability-registry.js';

20import { FileCapabilityHealthStore } from './health-store.js';

21import { loadSettingsMcpServers, loadPluginMcpServers, mergeMcpServerConfigs, } from '../mcp/config.js';

dist/platform/lsp/server-process.jsView file

Lines 1-26javascript

1import { spawn } from 'child_process';

2import { decodeLspFrames, encodeLspMessage } from './client.js';

3export function buildLspServerSpawnOptions(command, options = {}) {

dist/ai/skills/execution-state.jsView file

Lines 1-21javascript

1import { createHash } from 'node:crypto';

2export function createEmptySessionSkillExecutionState(now = Date.now()) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/ai/skills/execution-state.jsView on unpkg · L1

3 return

dist/commands/plugin.jsView file

Lines 1-22javascript

1import { existsSync, mkdirSync, readdirSync, rmSync, readFileSync, } from 'fs';

2import { join, resolve } from 'path';

3import { execSync } from 'child_process';

4import https from 'https';

xiaokcode@1.4.22

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code