w3bs.AccountStart building
PACKAGES / Moonshot AI

Kimi Code CLI

Terminal AI coding agent that works with Kimi models and other compatible providers.

ThreatCrush · No malware found
INSTALLw3bs install moonshot.ai/kimi-code

No w3bs yet? curl -fsSL https://w3bs.org/install.sh | sh

Get started

What to type once it is installed.

  1. w3bs install moonshot.ai/kimi-codeInstall Kimi Code CLI and track it for updates
  2. kimiOpen the interactive UI; run /login inside on first launch
  3. kimi -p "<instruction>"Run a single instruction without the interactive UI
  4. kimi -cResume the previous session
  5. kimi acpServe the Agent Client Protocol so Zed or JetBrains can drive it

Every option: kimi --help · docs ↗

Malware scan

ThreatCrush found no malware indicators in Kimi Code CLI 2.1.1. The other findings below are ordinary code-review notes, not malware.

Scanned
2026-11-02 22:59 UTC · threatcrush 0.13.30
Files
4315 (installer + github.com/MoonshotAI/kimi-code@fc3b521b8b68)
Findings
4 high · 80 medium · 76 low
100+ other findings (not malware)
  • high
    dependency name close to a popular packagesource/packages/agent-core-v2/package.json:95manifest-typosquat · CWE-1357
  • high
    dependency name close to a popular packagesource/packages/kap-server/package.json:46manifest-typosquat · CWE-1357
  • high
    dependency name close to a popular packagesource/packages/klient/package.json:52manifest-typosquat · CWE-1357
  • high
    Hardcoded Credentialsource/packages/node-sdk/examples/kimi-harness-logging-smoke.ts:98secret-generic-credential · CWE-798
  • medium
    regex with nested unbounded quantifierssource/apps/kimi-code/dist-web/assets/actionscript-3-CoDkCxhg.js:1redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/apps/kimi-code/dist-web/assets/c-BIGW1oBm.js:1redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/apps/kimi-code/dist-web/assets/cobol-nBiQ_Alo.js:1redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/apps/kimi-code/dist-web/assets/cynefin-VYW2F7L2-C-EfYT07.js:160redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/apps/kimi-code/dist-web/assets/cynefin-VYW2F7L2-DH-wDJuX.js:160redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/apps/kimi-code/dist-web/assets/erlang-DsQrWhSR.js:1redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/apps/kimi-code/dist-web/assets/gdscript-C5YyOfLZ.js:1redos-nested-quantifier · CWE-1333
  • medium
    unescaped HTML renderingsource/apps/kimi-code/dist-web/assets/index-_mdBonhR.js:13js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/kimi-code/dist-web/assets/index-_mdBonhR.js:1401js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/kimi-code/dist-web/assets/index-_mdBonhR.js:1415js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/kimi-code/dist-web/assets/index10-DXBCRIm3.js:1js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/apps/kimi-code/dist-web/assets/index8-Bul4vJWm.js:1js-unescaped-html-sink · CWE-79
  • medium
    regex with nested unbounded quantifierssource/apps/kimi-code/dist-web/assets/katex-DnlPpQZa.js:252redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/apps/kimi-code/dist-web/assets/katex-DnlPpQZa.js:256redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/apps/kimi-code/dist-web/assets/katex-HP8lGamR.js:252redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/apps/kimi-code/dist-web/assets/katex-HP8lGamR.js:256redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/apps/kimi-code/dist-web/assets/katexRenderer.worker-CO_gEm4q.js:252redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/apps/kimi-code/dist-web/assets/katexRenderer.worker-CO_gEm4q.js:256redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/apps/kimi-code/dist-web/assets/mdx-Cmh6b_Ma.js:1redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/apps/kimi-code/dist-web/assets/mermaid.core-CaI4CgOv.js:165redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/apps/kimi-code/dist-web/assets/mermaidParser.worker-BFSlSHEW.js:164redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/apps/kimi-code/dist-web/assets/nix-CwoSXNpI.js:1redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/apps/kimi-code/dist-web/assets/objective-c-DXmwc3jG.js:1redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/apps/kimi-code/dist-web/assets/objective-cpp-CLxacb5B.js:1redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/apps/kimi-code/dist-web/assets/pug-DKIMFp6K.js:1redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/apps/kimi-code/dist-web/assets/puppet-BMWR74SV.js:1redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/apps/kimi-code/dist-web/assets/shellscript-Yzrsuije.js:1redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/apps/kimi-code/dist-web/assets/turnDiff.worker-BzC1nIn4.js:1redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/apps/kimi-code/dist-web/assets/wolfram-lXgVvXCa.js:1redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/apps/kimi-code/dist-web/assets/yaml-Buea-lGh.js:1redos-nested-quantifier · CWE-1333
  • medium
    MAC or signature compared with ==source/apps/kimi-code/src/cli/sub/update-download.ts:75js-timing-unsafe-mac-compare · CWE-208
  • medium
    MAC or signature compared with ==source/apps/kimi-code/src/cli/update/native-stage.ts:485js-timing-unsafe-mac-compare · CWE-208
  • medium
    regex with nested unbounded quantifierssource/apps/kimi-code/src/tui/components/editor/custom-editor.ts:37redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/apps/kimi-code/src/tui/theme/pi-tui-theme.ts:24redos-nested-quantifier · CWE-1333
  • medium
    predictable randomness used for a security valuesource/apps/kimi-code/src/utils/persistence.ts:41insecure-randomness-for-secret · CWE-338
  • medium
    regex with nested unbounded quantifierssource/apps/vis/server/src/lib/task-store.ts:26redos-nested-quantifier · CWE-1333
  • medium
    buffer allocated without zeroingsource/apps/vis/server/src/lib/task-store.ts:177js-uninitialized-buffer · CWE-908
  • medium
    regex with nested unbounded quantifierssource/apps/vscode/webview-ui/src/lib/text-enrichment.ts:9redos-nested-quantifier · CWE-1333
  • medium
    MAC or signature compared with ==source/packages/agent-core-v2/src/agent/loop/projector.ts:63js-timing-unsafe-mac-compare · CWE-208
  • medium
    regex with nested unbounded quantifierssource/packages/agent-core-v2/src/agent/media/image-format-policy.ts:69redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/agent-core-v2/src/agent/task/persist.ts:11redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/agent-core-v2/src/app/config/tomlWriteback.ts:69redos-nested-quantifier · CWE-1333
  • medium
    archive entry written to a path built from its own namesource/packages/agent-core-v2/src/app/plugin/archive.ts:149js-archive-entry-path · CWE-22
  • medium
    regex with nested unbounded quantifierssource/packages/agent-core-v2/src/app/plugin/types.ts:196redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/agent-core-v2/src/app/telemetry/privacy.ts:14redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/agent-core-v2/src/app/telemetry/privacy.ts:15redos-nested-quantifier · CWE-1333
  • medium
    MAC or signature compared with ==source/packages/agent-core-v2/src/features/skill/workspace/rootFileSkillSource.ts:117js-timing-unsafe-mac-compare · CWE-208
  • medium
    buffer allocated without zeroingsource/packages/agent-core-v2/src/features/tower/protocol/frontmatter.ts:42js-uninitialized-buffer · CWE-908
  • medium
    buffer allocated without zeroingsource/packages/agent-core-v2/src/features/tower/protocol/store.ts:2420js-uninitialized-buffer · CWE-908
  • medium
    regex with nested unbounded quantifierssource/packages/agent-core-v2/src/human/llm/protocol/kit/media.ts:85redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/agent-core-v2/src/workspace/workspaceAgentProfileLoader/internal/agentFile.ts:25redos-nested-quantifier · CWE-1333
  • medium
    buffer allocated without zeroingsource/packages/kap-server/src/search/indexCore.ts:943js-uninitialized-buffer · CWE-908
  • medium
    buffer allocated without zeroingsource/packages/kap-server/src/services/transcript/wireCache.ts:101js-uninitialized-buffer · CWE-908
  • medium
    predictable temporary filesource/packages/klient/scripts/run-docker-e2e.sh:127sh-predictable-temp-path · CWE-377
  • medium
    buffer allocated without zeroingsource/packages/minidb/src/codec.ts:347js-uninitialized-buffer · CWE-908
  • medium
    buffer allocated without zeroingsource/packages/minidb/src/codec.ts:365js-uninitialized-buffer · CWE-908
  • medium
    buffer allocated without zeroingsource/packages/minidb/src/codec.ts:371js-uninitialized-buffer · CWE-908
  • medium
    buffer allocated without zeroingsource/packages/minidb/src/codec.ts:378js-uninitialized-buffer · CWE-908
  • medium
    buffer allocated without zeroingsource/packages/minidb/src/codec.ts:382js-uninitialized-buffer · CWE-908
  • medium
    buffer allocated without zeroingsource/packages/minidb/src/codec.ts:399js-uninitialized-buffer · CWE-908
  • medium
    buffer allocated without zeroingsource/packages/minidb/src/codec.ts:522js-uninitialized-buffer · CWE-908
  • medium
    buffer allocated without zeroingsource/packages/minidb/src/codec.ts:540js-uninitialized-buffer · CWE-908
  • medium
    buffer allocated without zeroingsource/packages/minidb/src/codec.ts:546js-uninitialized-buffer · CWE-908
  • medium
    buffer allocated without zeroingsource/packages/minidb/src/codec.ts:553js-uninitialized-buffer · CWE-908
  • medium
    buffer allocated without zeroingsource/packages/minidb/src/codec.ts:557js-uninitialized-buffer · CWE-908
  • medium
    buffer allocated without zeroingsource/packages/minidb/src/codec.ts:648js-uninitialized-buffer · CWE-908
  • medium
    buffer allocated without zeroingsource/packages/minidb/src/compaction.ts:187js-uninitialized-buffer · CWE-908
  • medium
    buffer allocated without zeroingsource/packages/minidb/src/gen-codec.ts:408js-uninitialized-buffer · CWE-908
  • medium
    buffer allocated without zeroingsource/packages/minidb/src/gen-codec.ts:437js-uninitialized-buffer · CWE-908
  • medium
    buffer allocated without zeroingsource/packages/minidb/src/recovery.ts:99js-uninitialized-buffer · CWE-908
  • medium
    buffer allocated without zeroingsource/packages/minidb/src/value-reader.ts:69js-uninitialized-buffer · CWE-908
  • medium
    buffer allocated without zeroingsource/packages/minidb/src/value-reader.ts:85js-uninitialized-buffer · CWE-908
  • medium
    buffer allocated without zeroingsource/packages/minidb/src/worker/text-build-core.ts:138js-uninitialized-buffer · CWE-908
  • medium
    buffer allocated without zeroingsource/packages/minidb/src/worker/text-build-core.ts:227js-uninitialized-buffer · CWE-908
  • medium
    buffer allocated without zeroingsource/packages/minidb/src/worker/text-build.ts:78js-uninitialized-buffer · CWE-908
  • medium
    regex with nested unbounded quantifierssource/packages/pi-tui/src/components/markdown.ts:194redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/pi-tui/src/stdin-buffer.ts:29redos-nested-quantifier · CWE-1333
  • medium
    predictable randomness used for a security valuesource/packages/product/src/shared/node/json-file.ts:14insecure-randomness-for-secret · CWE-338
  • medium
    buffer allocated without zeroingsource/packages/session-import/src/images.ts:78js-uninitialized-buffer · CWE-908
  • medium
    MAC or signature compared with ==source/packages/session-import/src/rollout.ts:482js-timing-unsafe-mac-compare · CWE-208
  • low
    Hardcoded Credentialsource/apps/kimi-code/scripts/native/smoke.mjs:124secret-generic-credential · CWE-798
  • low
    regex with nested unbounded quantifierssource/apps/vis/web/test/renderers.test.ts:66redos-nested-quantifier · CWE-1333
  • low
    Hardcoded Credentialsource/apps/vscode/test/kimi-harness.integration.test.ts:49secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/vscode/test/kimi-harness.integration.test.ts:474secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/vscode/test/kimi-harness.integration.test.ts:652secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/vscode/test/kimi-harness.integration.test.ts:687secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/vscode/test/kimi-harness.integration.test.ts:730secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/vscode/test/kimi-harness.integration.test.ts:739secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/vscode/test/kimi-harness.integration.test.ts:749secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/vscode/test/kimi-harness.integration.test.ts:820secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/vscode/test/kimi-harness.integration.test.ts:948secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/apps/vscode/test/kimi-harness.integration.test.ts:976secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/agent-core-v2/test/_base/di/cascade.test.ts:257secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/agent-core-v2/test/_base/di/cascade.test.ts:259secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/agent-core-v2/test/_base/di/cascade.test.ts:260secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/agent-core-v2/test/_base/di/cascade.test.ts:718secret-generic-credential · CWE-798

Showing the first 100 findings.

Badge for your README

ThreatCrush: No malware found

[![ThreatCrush scan](https://w3bs.org/api/packages/moonshot.ai/kimi-code/badge.svg)](https://w3bs.org/packages/moonshot.ai/kimi-code)