registry / @drdeeks/character-kit / 1.2.0

@drdeeks/character-kit@1.2.0

⚠ Under review

Universal agent character enforcement, knowledge indexing, and memory with YAML frontmatter. True plugin: install once, reference as @character-kit in any harness config.

Static Scan Results

scanned 22d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 206 KB of source

Source & flagged code

9 flagged

deploy/ack_watchdog.jsView file

Lines 1-38javascript

1#!/usr/bin/env node

2/**

3 * ACK monitor watchdog (self-healing companion, Node-native).

4 *

5 * Node port of ack_watchdog.py. Revives the acknowledgment monitor

6 * (ack_monitor.js) if it dies, and revives the enforcer daemon itself in

7 * root-mode installs. This is the self-healing layer: no single process in

8 * the daemon/monitor/watchdog trio is a point of failure on its own.

9 *

10 * Revival order: prefer `systemctl restart <unit>` (idempotent, re-reads the

11 * unit). Fall back to a direct launch if systemctl is unavailable (e.g. a

12 * container without systemd).

13 */

15import fs from "fs";

16import path from "path";

17import os from "os";

18import { fileURLToPath } from "url";

19import { spawn, spawnSync } from "child_process";

High

Child Process

Package source references child process execution.

deploy/ack_watchdog.jsView on unpkg · L18

21const __dirname = path.dirname(fileURLToPath(import.meta.url));

23const PIDFILE = process.env.ACK_MONITOR_PID || "/var/lib/agent-character-kit/ack-monitor.pid";

24const WATCHDOG_PID = process.env.ACK_WATCHDOG_PID || "/var/lib/agent-character-kit/ack-watchdog.pid";

25const MONITOR_BIN = process.env.ACK_MONITOR_BIN || path.join(__dirname, "ack_monitor.js");

26const MONITOR_UNIT = "agent-character-monitor.service";

27const ENFORCER_UNIT = "agent-enforcer.service";

28const INTERVAL = parseInt(process.env.ACK_WATCHDOG_INTERVAL || "5", 10) * 1000;

30function log(msg) {

31 console.log(`${new Date().toISOString()} [ack-watchdog] ${msg}`);

32}

33function logError(msg) {

34 console.error(`${new Date().toISOString()} [ack-watchdog] ${msg}`);

35}

37function processAlive(pattern, pidfile) {

38 try {

•matchType = normalized_sha256 matchedPackage = @drdeeks/character-kit@1.2.1 matchedPath = deploy/ack_watchdog.js matchedIdentity = npm:QGRyZGVla3MvY2hhcmFjdGVyLWtpdA:1.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

deploy/ack_watchdog.jsView on unpkg

node/enforcer/agent_enforcer_daemon.jsView file

Lines 31-71javascript

31// from .env itself, and the supervisor/systemd passes it to the daemon's

32// LAUNCH env. Auto-loading it here would make the daemon self-gate

33// against any client that doesn't also inherit this repo's .env (e.g. the

34// test harness, or a companion launched without it) — breaking legit calls.

35import { fileURLToPath } from "url";

36const __daemonDir = path.dirname

python/tests/python_parity_test.pyView file

•path = python/tests/python_parity_test.py kind = payload_in_excluded_dir sizeBytes = 2981 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

python/tests/python_parity_test.pyView on unpkg

•path = python/tests/python_parity_test.py kind = build_helper sizeBytes = 2981 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/tests/python_parity_test.pyView on unpkg

node/bin/install.jsView file

•matchType = normalized_sha256 matchedPackage = @drdeeks/character-kit@1.2.1 matchedPath = node/bin/install.js matchedIdentity = npm:QGRyZGVla3MvY2hhcmFjdGVyLWtpdA:1.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node/bin/install.jsView on unpkg

node/tests/habit-create.test.jsView file

•matchType = normalized_sha256 matchedPackage = @drdeeks/character-kit@1.2.1 matchedPath = node/tests/habit-create.test.js matchedIdentity = npm:QGRyZGVla3MvY2hhcmFjdGVyLWtpdA:1.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node/tests/habit-create.test.jsView on unpkg

node/tests/install.test.jsView file

•matchType = normalized_sha256 matchedPackage = @drdeeks/character-kit@1.2.1 matchedPath = node/tests/install.test.js matchedIdentity = npm:QGRyZGVla3MvY2hhcmFjdGVyLWtpdA:1.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node/tests/install.test.jsView on unpkg

Source & flagged code

9 flagged · loading source

deploy/ack_watchdog.jsView file

18import { fileURLToPath } from "url"; L19: import { spawn, spawnSync } from "child_process"; L20:

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code