{"id":"MAL-2026-4433","summary":"Malicious code in @self-evolving-harness/kivo (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ce31b5c287727dabb5479a114843b06b80bbd75db10d74014a00db80b9b321bd)\nThe package's LLM pipeline (Kivo.ingest → value-gate → OpenAILLMProvider) resolves its endpoint via resolveLlmConfig() in dist/cjs/cli/resolve-llm-config.js, which hardcodes DEFAULT_BASE_URL = 'https://api.penguinsaichat.dpdns.org/v1' — a free dpdns.org dynamic-DNS subdomain unaffiliated with OpenAI. When a consumer has OPENAI_API_KEY set but no OPENAI_BASE_URL (the standard setup), the library POSTs the caller's knowledge text and their OpenAI bearer token to this third-party host with `Authorization: Bearer ${apiKey}` (dist/cjs/extraction/llm-extractor.js sets up the request, hooks/kivo-intent-injection/scripts/extract-queue-worker.mjs sends to the same host). The README does not disclose this destination; users who supplied OPENAI_API_KEY have a reasonable expectation that traffic goes to api.openai.com. This is the silent-relay shape: a hardcoded author-controlled destination on the normal-use API path, leaking both caller-supplied content and a credential the caller intended for OpenAI. The use of a free DDNS subdomain (not a corporate endpoint) is consistent with attacker infrastructure rather than a legitimate proxy.\n","modified":"2026-05-27T00:31:58.027578248Z","published":"2026-05-20T17:58:12Z","withdrawn":"2026-05-26T21:41:23Z","database_specific":{"malicious-packages-origins":[{"sha256":"bd42e509e1704aad19b049ba3b99f61e33a270f1fdf3314fc9008a5c8f0571f3","source":"amazon-inspector","versions":["1.29.3"],"id":"IN-MAL-2026-003583","import_time":"2026-05-26T05:50:54.302616953Z","modified_time":"2026-05-20T17:58:12Z"},{"versions":["1.29.3"],"id":"IN-MAL-2026-003582","import_time":"2026-05-26T05:50:54.191924083Z","modified_time":"2026-05-20T17:58:12Z","sha256":"ce31b5c287727dabb5479a114843b06b80bbd75db10d74014a00db80b9b321bd","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@self-evolving-harness/kivo/v/1.29.3"}],"affected":[{"package":{"name":"@self-evolving-harness/kivo","ecosystem":"npm","purl":"pkg:npm/%40self-evolving-harness%2Fkivo"},"versions":["1.29.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"domains":["34.9.16.104.in-addr.arpa"],"evidence_files":[{"sha256":"1b3d2ae66952ba44c8eda6204c0cbd04b104c0630d8c5f31e4939b3cd0686a5e","tlsh":"4d91435c88e2241600927f587bef1475f39ca68b0d099a4033ad53e5bf9b9786c736dc","path":"dist/cjs/cli/resolve-llm-config.js"}],"package_integrity":[{"hashes":{"sha1":"f69efb1da353678219fe8d894683ead0f327f3a5","sha512_sri":"sha512-XXxuL3nTYByJVOy8p2GDlx9Td4OwYW8nL8i1WUy3OmLgxQGJ+5gKRVT21m9Nazo3EX06ct6eke/HhUoIDXEEVg=="},"filename":"kivo-1.29.3.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/@self-evolving-harness/kivo/MAL-2026-4433.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"}]}