registry / @inkeep/open-knowledge / 0.24.0

@inkeep/open-knowledge@0.24.0

⚠ Under review

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 26 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

Manifest

CopyleftLicense

scanned 535 file(s), 17.0 MB of source, external domains: 127.0.0.1, api.github.com, api.openai.com, bun.sh, cdn.jsdelivr.net, chevrotain.io, claude.com, cscott.net, cursor.com, developers.openai.com, docs.claude.com, docs.github.com, docs.orama.com, en.wikipedia.org, example.com, fb.me, foo.bar, github.com, gnu.org, html.spec.whatwg.org, json-schema.org, landley.net, langium.org, openai.com, opencode.ai, placeholder.invalid, player.vimeo.com, prosemirror.net, radix-ui.com, react.dev, uploads.github.com, www.ibm.com, www.loom.com, www.w3.org

Oversized source lightweight scan

dist/dist-B8zi8Gb4.mjs2.65 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsMinifiedUrlStringsapi.github.com

dist/public/assets/pdf.worker-B1D2UnXD.mjs2.06 MB file, sampled 256 KB

NetworkChildProcessDynamicRequireUrlStringsexample.com

Source & flagged code

11 flagged

package.jsonView file

Lines 23-63json

23 "dist",

24 "scripts",

25 "!dist/**/*.map"

26 ],

27 "engines": {

28 "node": ">=24"

29 },

30 "publishConfig": {

31 "access": "public"

32 },

33 "scripts": {

34 "build:cli": "tsdown",

35 "build:app": "cp -r ../app/dist dist/public",

36 "build:skill-asset": "bun ../server/scripts/build-skill-bundles.ts && mkdir -p dist/assets/skills && cp -R ../server/dist/assets/skills/. dist/assets/skills/",

37 "build:notices": "mkdir -p dist && cp ../../THIRD_PARTY_NOTICES.md dist/THIRD_PARTY_NOTICES.md",

38 "build:license": "mkdir -p dist && cp ../../LICENSE dist/LICENSE",

39 "build:native": "mkdir -p dist/native && cp ../native-config/index.js ../native-config/index.d.ts ../native-config/package.json dist/native/ && (cp ../native-config/*.node dist/native/ 2>/dev/null || true)",

40 "build:schema": "bun --conditions=development scripts/build-config-schema.mjs",

41 "build:assets": "bun run build:app && bun run build:skill-asset && bun run build:notices && bun run build:license && bun run build:native && bun run build:schema",

42 "build": "bun run build:cli && bun run build:assets",

43 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L43

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L43

44 "test": "bun run build:schema && bun test --timeout 30000",

45 "test:e2e:cli": "bun test ./tests/e2e/cli-linux-e2e.ts",

46 "typecheck": "tsc --noEmit",

47 "prepublishOnly": "bash ../../scripts/check-notices-clean.sh && bun run build"

48 },

49 "dependencies": {

50 "@inquirer/checkbox": "^5.0.11",

51 "@inquirer/password": "^5.0.11",

52 "@inquirer/select": "^5.2.0",

53 "@modelcontextprotocol/sdk": "^1.28.0",

54 "@napi-rs/keyring": "^1.3.0",

55 "@octokit/auth-oauth-device": "^8.0.3",

56 "@octokit/request": "^10.0.8",

57 "@octokit/rest": "^22.0.1",

58 "cli-boxes": "^4.0.1",

59 "commander": "^14.0.0",

60 "jsonc-parser": "^3.3.1",

61 "picocolors": "^1.1.1",

62 "pino": "^10.3.1",

63 "simple-git": "^3.36.0",

dist/lib-CItGM3rN.mjsView file

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib-CItGM3rN.mjsView on unpkg · L39

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Secret Pattern

RSA private key in dist/lib-CItGM3rN.mjs

dist/lib-CItGM3rN.mjsView on unpkg · L39

scripts/probe-exec.tsView file

Lines 39-79typescript

39 const agent: WriterIdentity = { id: 'agent-claude-7x', name: 'Claude (Tim)', email: 'a@ok.test' };

40 const human: WriterIdentity = { id: 'human-tim', name: 'Tim Cardona', email: 't@ok.test' };

41 await commitWip

dist/chunk-XORM457F-BuPOSqOe.mjsView file

Lines 96-136javascript

96`)&&(n+=r>t?e.slice(t,r+1):i)}else n+=i}return(e[e.length-1]!==`"`||e.length===1)&&t(e.length,`MISSING_CHAR`,`Missing closing "quote`),n}function c(e,t){let n=``,r=e[t+1];for(;(r===` `||r===` `||r===`

97`||r===`\r`)&&!(r===`\r`&&e[t+2]!==`

98`);)r===`

99`&&(n+=`

100`),t+=1,r=e[t+1];return n||=` `,{fold:n,offset:t}}var l={0:`\0`,a:`\x07`,b:`\b`,e:`

dist/js-exec-M6UR76J5-Cu6NIWHE.mjsView file

Lines 8-48javascript

8 --strip-types Strip TypeScript type annotations

9 --version, -V Show version

10 --help Show this help

12Examples:

13 js-exec -c "console.log(1 + 2)"

14 js-exec script.js

15 js-exec app.ts

16 echo 'console.log("hello")' | js-exec

18File Extension Auto-Detection:

dist/native/native-config.linux-arm64-musl.nodeView file

•path = dist/native/native-config.linux-arm64-musl.node kind = native_binary sizeBytes = 796488 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/native-config.linux-arm64-musl.nodeView on unpkg

dist/public/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/public/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/public/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/dist-B8zi8Gb4.mjsView file

•path = dist/dist-B8zi8Gb4.mjs kind = oversized_source_file sizeBytes = 2782835 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/dist-B8zi8Gb4.mjsView on unpkg

dist/init-DJdnlEKc.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @inkeep/open-knowledge@0.22.0 matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.22.0 similarity = 0.875 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/init-DJdnlEKc.mjsView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/lib-CItGM3rN.mjsView file

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib-CItGM3rN.mjsView on unpkg · L39

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Secret Pattern

RSA private key in dist/lib-CItGM3rN.mjs

dist/lib-CItGM3rN.mjsView on unpkg · L39

scripts/probe-exec.tsView file

59console.log(` ${label}`); L60: console.log(` exec(${JSON.stringify(cmd)})`); L61: console.log('═══════════════════════════════════════════════════════════');

High

Child Process

Package source references child process execution.

scripts/probe-exec.tsView on unpkg · L59

dist/chunk-XORM457F-BuPOSqOe.mjsView file

116contains invisible/control Unicode U+FEFF (zero width no-break space) `};delete e.items,Object.assign(e,{type:n,source:t,end:[r]});break}default:{let r=`indent`in e?e.indent:-1,i=`end`in e&&Array.isArray(e.end)?e.end.filter(e=>e.type===`space`||e.type===`comment`||e.type===`newline`):[];for(let t of Object.ke

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/chunk-XORM457F-BuPOSqOe.mjsView on unpkg · L116

dist/js-exec-M6UR76J5-Cu6NIWHE.mjsView file

28Cross-file remote execution chain: dist/js-exec-M6UR76J5-Cu6NIWHE.mjs spawns dist/chunk-5QMZ5MUS-BwpNU33k.mjs; helper contains network access plus dynamic code execution. L28: Available modules: L29: fs, path, child_process, process, console, L30: os, url, assert, util, events, buffer, stream, ... L43: child_process: L44: execSync(cmd) throws on non-zero exit, returns stdout L45: spawnSync(cmd, args) returns { stdout, stderr, status } ... L49: L50: os: platform(), arch(), homedir(), tmpdir(), type(), hostname(), L51: EOL, cpus(), endianness() L52: L53: url: URL, URLSearchParams, parse(), format() L54:

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/js-exec-M6UR76J5-Cu6NIWHE.mjsView on unpkg · L28

dist/native/native-config.linux-arm64-musl.nodeView file

•path = dist/native/native-config.linux-arm64-musl.node kind = native_binary sizeBytes = 796488 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/native-config.linux-arm64-musl.nodeView on unpkg

dist/public/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/public/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/public/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/dist-B8zi8Gb4.mjsView file

•path = dist/dist-B8zi8Gb4.mjs kind = oversized_source_file sizeBytes = 2782835 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/dist-B8zi8Gb4.mjsView on unpkg

dist/init-DJdnlEKc.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/init-DJdnlEKc.mjsView on unpkg

Findings

4 Critical6 High7 Medium9 Low

CriticalCritical Secretdist/lib-CItGM3rN.mjs

CriticalTrojan Source Unicodedist/chunk-XORM457F-BuPOSqOe.mjs

CriticalPrevious Version Dangerous Deltadist/init-DJdnlEKc.mjs

CriticalSecret Patterndist/lib-CItGM3rN.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processscripts/probe-exec.ts

HighShell

HighCross File Remote Execution Contextdist/js-exec-M6UR76J5-Cu6NIWHE.mjs

HighShips High Entropy Blobdist/public/assets/KaTeX_Script-Regular-D3wIWfF6.woff2

HighOversized Source Filedist/dist-B8zi8Gb4.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Require

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Native Binarydist/native/native-config.linux-arm64-musl.node

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEval

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowCopyleft License

Source & flagged code

11 flagged

package.jsonView file

Lines 23-63json

23 "dist",

24 "scripts",

25 "!dist/**/*.map"

26 ],

27 "engines": {

28 "node": ">=24"

29 },

30 "publishConfig": {

31 "access": "public"

32 },

33 "scripts": {

34 "build:cli": "tsdown",

35 "build:app": "cp -r ../app/dist dist/public",

36 "build:skill-asset": "bun ../server/scripts/build-skill-bundles.ts && mkdir -p dist/assets/skills && cp -R ../server/dist/assets/skills/. dist/assets/skills/",

37 "build:notices": "mkdir -p dist && cp ../../THIRD_PARTY_NOTICES.md dist/THIRD_PARTY_NOTICES.md",

38 "build:license": "mkdir -p dist && cp ../../LICENSE dist/LICENSE",

40 "build:schema": "bun --conditions=development scripts/build-config-schema.mjs",

41 "build:assets": "bun run build:app && bun run build:skill-asset && bun run build:notices && bun run build:license && bun run build:native && bun run build:schema",

42 "build": "bun run build:cli && bun run build:assets",

43 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L43

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L43

44 "test": "bun run build:schema && bun test --timeout 30000",

45 "test:e2e:cli": "bun test ./tests/e2e/cli-linux-e2e.ts",

46 "typecheck": "tsc --noEmit",

47 "prepublishOnly": "bash ../../scripts/check-notices-clean.sh && bun run build"

48 },

49 "dependencies": {

50 "@inquirer/checkbox": "^5.0.11",

51 "@inquirer/password": "^5.0.11",

52 "@inquirer/select": "^5.2.0",

53 "@modelcontextprotocol/sdk": "^1.28.0",

54 "@napi-rs/keyring": "^1.3.0",

55 "@octokit/auth-oauth-device": "^8.0.3",

56 "@octokit/request": "^10.0.8",

57 "@octokit/rest": "^22.0.1",

58 "cli-boxes": "^4.0.1",

59 "commander": "^14.0.0",

60 "jsonc-parser": "^3.3.1",

61 "picocolors": "^1.1.1",

62 "pino": "^10.3.1",

63 "simple-git": "^3.36.0",

dist/lib-CItGM3rN.mjsView file

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib-CItGM3rN.mjsView on unpkg · L39

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Secret Pattern

RSA private key in dist/lib-CItGM3rN.mjs

dist/lib-CItGM3rN.mjsView on unpkg · L39

scripts/probe-exec.tsView file

Lines 39-79typescript

39 const agent: WriterIdentity = { id: 'agent-claude-7x', name: 'Claude (Tim)', email: 'a@ok.test' };

40 const human: WriterIdentity = { id: 'human-tim', name: 'Tim Cardona', email: 't@ok.test' };

41 await commitWip

dist/chunk-XORM457F-BuPOSqOe.mjsView file

Lines 96-136javascript

97`||r===`\r`)&&!(r===`\r`&&e[t+2]!==`

98`);)r===`

99`&&(n+=`

100`),t+=1,r=e[t+1];return n||=` `,{fold:n,offset:t}}var l={0:`\0`,a:`\x07`,b:`\b`,e:`

dist/js-exec-M6UR76J5-Cu6NIWHE.mjsView file

Lines 8-48javascript

8 --strip-types Strip TypeScript type annotations

9 --version, -V Show version

10 --help Show this help

12Examples:

13 js-exec -c "console.log(1 + 2)"

14 js-exec script.js

15 js-exec app.ts

16 echo 'console.log("hello")' | js-exec

18File Extension Auto-Detection:

dist/native/native-config.linux-arm64-musl.nodeView file

•path = dist/native/native-config.linux-arm64-musl.node kind = native_binary sizeBytes = 796488 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/native-config.linux-arm64-musl.nodeView on unpkg

dist/public/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/public/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/public/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/dist-B8zi8Gb4.mjsView file

•path = dist/dist-B8zi8Gb4.mjs kind = oversized_source_file sizeBytes = 2782835 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/dist-B8zi8Gb4.mjsView on unpkg

dist/init-DJdnlEKc.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/init-DJdnlEKc.mjsView on unpkg