registry / @inkeep/open-knowledge / 0.61.3

@inkeep/open-knowledge@0.61.3

⚠ Under review

Local-first, agent-friendly Markdown knowledge base with a cross-platform CLI and web editor

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 30 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareTelemetryUrlStrings

Manifest

CopyleftLicense

scanned 945 file(s), 30.1 MB of source, external domains: 0.0.0.0, 127.0.0.1, antigravity.google, api.github.com, api.openai.com, app.excalidraw.com, bun.sh, cdn.agentclientprotocol.com, cdn.jsdelivr.net, chevrotain.io, claude.com, contoh.com, cscott.net, cursor.com, developers.openai.com, discord.gg, docs.claude.com, docs.excalidraw.com, docs.github.com, docs.openclaw.ai, docs.orama.com, ejemplo.com, embed.reddit.com, en.wikipedia.org, esm.sh, example.com, excalidraw-room-persistence.firebaseio.com, exemplo.com, fb.me, foo.bar, giphy.com, gist.github.com, git-scm.com, github.com, gnu.org, googleads.g.doubleclick.net, hermes-agent.nousresearch.com, html.spec.whatwg.org, i.ytimg.com, img.youtube.com, json-schema.org, json.excalidraw.com, landley.net, langium.org, libraries.excalidraw.com, lodash.com, mermaid.js.org, notes.example.com, openclaw.ai, opencode.ai

Oversized source lightweight scan

dist/index.mjs2.11 MB file, sampled 256 KB

NetworkChildProcessEnvironmentVarsNativeBindingsShellHighEntropyStringsUrlStrings127.0.0.1

dist/public/assets/pdf.worker-CLesOks4.mjs2.12 MB file, sampled 256 KB

NetworkChildProcessHighEntropyStringsUrlStringsexample.comwww.w3.org

dist/src-C8z0M4Ib.mjs2.11 MB file, sampled 256 KB

NetworkChildProcessEnvironmentVarsMinifiedUrlStringscdn.agentclientprotocol.com

Source & flagged code

20 flagged

dist/lib-B82GtN9K.mjsView file

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib-B82GtN9K.mjsView on unpkg · L39

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Secret Pattern

RSA private key in dist/lib-B82GtN9K.mjs

dist/lib-B82GtN9K.mjsView on unpkg · L39

1import{o as e,t}from"./chunk-DTipWd-i.mjs";import{n}from"./wrapper-BR9ZCXZF.mjs";import{Blob as r,Buffer as i}from"buffer";import{TextDecoder as a,TextEncoder as o}from"util";impor... L2: `+t+`at`)}else typeof r==`object`&&r.message&&r.stack?n+=r.stack.replace(/\n at/gm,` ... L38: Y3FblSokcA== L39: -----END CERTIFICATE-----`,key:`-----BEGIN PRIVATE KEY----- L40: [redacted] ... L67: \r L68: `);var qu=class e{reject=null;resolve=null;listeners={onSignalAbort:this.onSignalAbort.bind(this)};isChunkedTransfer=!1;isProperLastChunkReceived=!1;previousChunk=null;nodeRequest=... L69: ... L71: `),o+=a,i&&!i.disableErrorCapturing&&i.errorCapture===Ls.tryAndCatch&&(o+=`} catch(e) { $happy_dom.dispatchError(e); }`),o+=`})`;let s=null;try{s=r[Fe](o,{filename:r.location.href}... L72: `);let o=a;s

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/lib-B82GtN9K.mjsView on unpkg · L1

dist/open-browser-xN9OlX1t.mjsView file

Lines 1-2javascript

1import{ei as e}from"./src-C8z0M4Ib.mjs";import{execFile as t}from"node:child_process";const n=new Set([`http:`,`https:`]),r=/

dist/src-C8z0M4Ib.mjsView file

21`)){let e=n.trim();if(e===``)continue;let r=/^([a-fA-F0-9]{64})\s+\*?(.+)$/.exec(e);if(r===null)continue;let[,i,a]=r;if(a.trim().split(/[\\/]/).pop()===t)return i.toLowerCase()}ret... L22: `).map(e=>e.trim()).find(e=>e!==``),r=t??`exit code ${e}`;d(n===void 0?r:`${r}: ${n.slice(0,300)}`)})})}function IT(e){for(let[t,n]of Object.entries(e))if(t.toLowerCase()===`path`)... L23: `)}\n`;this.enqueue(e,async()=>{if(!this.appendBroken.has(e))try{await $s(this.eventsPath(e),n)}catch(t){this.appendBroken.add(e),this.log.error({err:t,threadId:e},`[acp-persist] e...

High

Shell

Package source references shell execution.

dist/src-C8z0M4Ib.mjsView on unpkg · L21

1import{i as e,o as t,t as n}from"./chunk-DTipWd-i.mjs";import{$t as r,A as i,At as a,B as o,Bt as s,C as c,Ct as l,Dt as u,Et as d,F as f,Ft as p,Gt as m,H as h,Ht as g,I as _,It a... L2: `)){let e=n.trim();if(e.startsWith(`ok-contributors: `))try{let n=JSON.parse(e.slice(17));if(typeof n==`object`&&n&&`id`in n&&typeof n.id==`string`&&`name`in n&&typeof n.name==`str... L3: `)){let e=t.trim();if(!e.startsWith(Bd))continue;let n;try{n=JSON.parse(e.slice(10))}catch{return null}return typeof n!=`object`||!n?null:Hd(n)}return null}function Ud(e){if(!e)ret... L4: `)){let e=n.trim();if(!e.startsWith(Bd))continue;let r;try{r=JSON.parse(e.slice(10))}catch{continue}if(typeof r!=`object`||!r)continue;let i=Hd(r);i&&t.push(i)}return t}function nn... L5: `,i=e.getWriter();try{await i.write(n.encode

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src-C8z0M4Ib.mjsView on unpkg · L1

dist/chunk-5QMZ5MUS-C5NTf5Rj.mjsView file

Lines 1-5javascript

1import{t as e}from"./chunk-DXB73IDG-BBwE27jK.mjs";function t(){let e=[{prop:`Function`,target:globalThis,violationType:`function_constructor`,strategy:`throw`,reason:`Function constructor allows arbitrary code execution`},{prop:`eval`,target:globalThis,violationType:`eval`

dist/native/index.jsView file

Lines 1-25javascript

1// prettier-ignore

2/* eslint-disable */

3// @ts-nocheck

4/* auto-generated by NAPI-RS */

6const { readFileSync } = require('fs')

7let nativeBinding = null

dist/public/assets/ku-TR-6OUDTVRD-CKCYZmQ1.jsView file

7contains invisible/control Unicode U+200C (zero width non-joiner) یان Alt ڕابگرە و کلیک بکە بۆ زیادکردنی خاڵە نوێیەکان`,placeImage:`کلیک بکە بۆ دانانی وێنەکە، یان کلیک بکە و ڕایبکێشە بۆ ئەوەی قەبارەکەی بە دەستی دابنێیت`,publishLibrary:`کتێبخانەی تایبەت بە خۆت بڵاوبکەرەوە`,bindTextToElement:`بۆ زیادکردنی د

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/public/assets/ku-TR-6OUDTVRD-CKCYZmQ1.jsView on unpkg · L7

dist/js-exec-VXN6TZ7U-Ds5SsewK.mjsView file

28Cross-file remote execution chain: dist/js-exec-VXN6TZ7U-Ds5SsewK.mjs spawns dist/chunk-5QMZ5MUS-C5NTf5Rj.mjs; helper contains network access plus dynamic code execution. L28: Available modules: L29: fs, path, child_process, process, console, L30: os, url, assert, util, events, buffer, stream, ... L43: child_process: L44: execSync(cmd) throws on non-zero exit, returns stdout L45: spawnSync(cmd, args) returns { stdout, stderr, status } ... L49: L50: os: platform(), arch(), homedir(), tmpdir(), type(), hostname(), L51: EOL, cpus(), endianness() L52: L53: url: URL, URLSearchParams, parse(), format() L54:

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/js-exec-VXN6TZ7U-Ds5SsewK.mjsView on unpkg · L28

dist/native/native-config.linux-arm64-musl.nodeView file

•path = dist/native/native-config.linux-arm64-musl.node kind = native_binary sizeBytes = 788152 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/native-config.linux-arm64-musl.nodeView on unpkg

dist/dist-bundle-EXrl9_Zm.mjsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/dist-bundle-EXrl9_Zm.mjsView on unpkg

•matchType = normalized_sha256 matchedPackage = @inkeep/open-knowledge@0.36.0 matchedPath = dist/dist-bundle-GEZgvZIe.mjs matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.36.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dist-bundle-EXrl9_Zm.mjsView on unpkg

dist/chunk-WRU74C26-BESBlKtm.mjsView file

•matchType = normalized_sha256 matchedPackage = @inkeep/open-knowledge@0.36.0 matchedPath = dist/chunk-Q4XR5HBZ-DE_erWE4.mjs matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.36.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-WRU74C26-BESBlKtm.mjsView on unpkg

dist/chunk-ZIRB5QZD-B2znOhor.mjsView file

•matchType = normalized_sha256 matchedPackage = @inkeep/open-knowledge@0.30.0 matchedPath = dist/public/assets/chunk-XPW4576I-DZebSSCr.js matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.30.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-ZIRB5QZD-B2znOhor.mjsView on unpkg

dist/public/assets/chunk-ZUYEQ4TG-DLAN927O.jsView file

1patternName = google_api_key severity = high line = 1 matchedText = var e={V...AZZX

High

Secret Pattern

Google API key in dist/public/assets/chunk-ZUYEQ4TG-DLAN927O.js

dist/public/assets/chunk-ZUYEQ4TG-DLAN927O.jsView on unpkg · L1

Source & flagged code

20 flagged · loading source

dist/lib-B82GtN9K.mjsView file

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib-B82GtN9K.mjsView on unpkg · L39

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Secret Pattern

RSA private key in dist/lib-B82GtN9K.mjs

dist/lib-B82GtN9K.mjsView on unpkg · L39

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/lib-B82GtN9K.mjsView on unpkg · L1

dist/open-browser-xN9OlX1t.mjsView file

1import{ei as e}from"./src-C8z0M4Ib.mjs";import{execFile as t}from"node:child_process";const n=new Set([`http:`,`https:`]),r=/[\u0000-\u0020\u007F-\u009F"'`\\&|<>^()$;{}[\]*?!~]/;fu... L2: //# sourceMappingURL=open-browser-xN9OlX1t.mjs.map

High

Child Process

Package source references child process execution.

dist/open-browser-xN9OlX1t.mjsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @inkeep/open-knowledge@0.30.0 matchedPath = dist/open-browser-B0EHWyOL.mjs matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.30.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/open-browser-xN9OlX1t.mjsView on unpkg

dist/src-C8z0M4Ib.mjsView file

High

Shell

Package source references shell execution.

dist/src-C8z0M4Ib.mjsView on unpkg · L21

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src-C8z0M4Ib.mjsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/src-C8z0M4Ib.mjsView on unpkg · L1

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src-C8z0M4Ib.mjsView on unpkg · L1

dist/chunk-5QMZ5MUS-C5NTf5Rj.mjsView file

1import{t as e}from"./chunk-DXB73IDG-BBwE27jK.mjs";function t(){let e=[{prop:`Function`,target:globalThis,violationType:`function_constructor`,strategy:`throw`,reason:`Function cons... L2:

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-5QMZ5MUS-C5NTf5Rj.mjsView on unpkg · L1

dist/native/index.jsView file

•matchType = normalized_sha256 matchedPackage = @inkeep/open-knowledge@0.31.0 matchedPath = dist/native/index.js matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.31.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/native/index.jsView on unpkg

5L6: const { readFileSync } = require('fs') L7: let nativeBinding = null

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/native/index.jsView on unpkg · L5

dist/public/assets/ku-TR-6OUDTVRD-CKCYZmQ1.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/public/assets/ku-TR-6OUDTVRD-CKCYZmQ1.jsView on unpkg · L7

dist/js-exec-VXN6TZ7U-Ds5SsewK.mjsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/js-exec-VXN6TZ7U-Ds5SsewK.mjsView on unpkg · L28

dist/native/native-config.linux-arm64-musl.nodeView file

•path = dist/native/native-config.linux-arm64-musl.node kind = native_binary sizeBytes = 788152 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/native-config.linux-arm64-musl.nodeView on unpkg

dist/dist-bundle-EXrl9_Zm.mjsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/dist-bundle-EXrl9_Zm.mjsView on unpkg

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dist-bundle-EXrl9_Zm.mjsView on unpkg

dist/chunk-WRU74C26-BESBlKtm.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-WRU74C26-BESBlKtm.mjsView on unpkg

dist/chunk-ZIRB5QZD-B2znOhor.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-ZIRB5QZD-B2znOhor.mjsView on unpkg

dist/public/assets/chunk-ZUYEQ4TG-DLAN927O.jsView file

1patternName = google_api_key severity = high line = 1 matchedText = var e={V...AZZX

High

Secret Pattern

Google API key in dist/public/assets/chunk-ZUYEQ4TG-DLAN927O.js

dist/public/assets/chunk-ZUYEQ4TG-DLAN927O.jsView on unpkg · L1

Findings

3 Critical12 High7 Medium8 Low

CriticalCritical Secretdist/lib-B82GtN9K.mjs

CriticalTrojan Source Unicodedist/public/assets/ku-TR-6OUDTVRD-CKCYZmQ1.js

CriticalSecret Patterndist/lib-B82GtN9K.mjs

HighChild Processdist/open-browser-xN9OlX1t.mjs

HighShelldist/src-C8z0M4Ib.mjs

HighSame File Env Network Executiondist/src-C8z0M4Ib.mjs

HighCommand Output Exfiltrationdist/src-C8z0M4Ib.mjs

HighCross File Remote Execution Contextdist/js-exec-VXN6TZ7U-Ds5SsewK.mjs

HighSemantic Analysis Limiteddist/dist-bundle-EXrl9_Zm.mjs

HighKnown Malware Source Similaritydist/native/index.js

HighKnown Malware Source Similaritydist/open-browser-xN9OlX1t.mjs

HighKnown Malware Source Similaritydist/chunk-WRU74C26-BESBlKtm.mjs

HighKnown Malware Source Similaritydist/chunk-ZIRB5QZD-B2znOhor.mjs

HighKnown Malware Source Similaritydist/dist-bundle-EXrl9_Zm.mjs

HighSecret Patterndist/public/assets/chunk-ZUYEQ4TG-DLAN927O.js

MediumDynamic Requiredist/native/index.js

MediumUnsafe Vm Contextdist/lib-B82GtN9K.mjs

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Native Binarydist/native/native-config.linux-arm64-musl.node

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/chunk-5QMZ5MUS-C5NTf5Rj.mjs

LowWeak Cryptodist/src-C8z0M4Ib.mjs

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowCopyleft License