registry / @inkeep/open-knowledge / 0.28.2

@inkeep/open-knowledge@0.28.2

⚠ Under review

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 23 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

Manifest

CopyleftLicense

scanned 567 file(s), 17.2 MB of source, external domains: 127.0.0.1, api.github.com, api.openai.com, bun.sh, cdn.jsdelivr.net, chevrotain.io, claude.com, cscott.net, cursor.com, developers.openai.com, discord.com, docs.claude.com, docs.github.com, docs.orama.com, en.wikipedia.org, example.com, fb.me, foo.bar, git-scm.com, github.com, gnu.org, html.spec.whatwg.org, json-schema.org, landley.net, langium.org, openai.com, opencode.ai, openknowledge.ai, pi.dev, placeholder.invalid, placeholder.local, player.vimeo.com, prosemirror.net, radix-ui.com, react.dev, uploads.github.com, vimeo.com, www.ibm.com, www.loom.com, www.w3.org, x.com

Oversized source lightweight scan

dist/dist-AMcKbNor.mjs2.68 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsMinifiedUrlStringsapi.github.com

dist/public/assets/pdf.worker-B1D2UnXD.mjs2.06 MB file, sampled 256 KB

NetworkChildProcessDynamicRequireUrlStringsexample.com

Source & flagged code

10 flagged

package.jsonView file

Lines 23-63json

23 "dist",

24 "scripts",

25 "!dist/**/*.map"

26 ],

27 "engines": {

28 "node": ">=24"

29 },

30 "publishConfig": {

31 "access": "public"

32 },

33 "scripts": {

34 "build:cli": "tsdown",

35 "build:app": "cp -r ../app/dist dist/public",

36 "build:skill-asset": "bun ../server/scripts/build-skill-bundles.ts && mkdir -p dist/assets/skills && cp -R ../server/dist/assets/skills/. dist/assets/skills/",

37 "build:notices": "mkdir -p dist && cp ../../THIRD_PARTY_NOTICES.md dist/THIRD_PARTY_NOTICES.md",

38 "build:license": "mkdir -p dist && cp ../../LICENSE dist/LICENSE",

39 "build:native": "mkdir -p dist/native && cp ../native-config/index.js ../native-config/index.d.ts ../native-config/package.json dist/native/ && (cp ../native-config/*.node dist/native/ 2>/dev/null || true)",

40 "build:schema": "bun --conditions=development scripts/build-config-schema.mjs",

41 "build:assets": "bun run build:app && bun run build:skill-asset && bun run build:notices && bun run build:license && bun run build:native && bun run build:schema",

42 "build": "bun run build:cli && bun run build:assets",

43 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L43

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L43

44 "test": "bun run build:schema && bun test --timeout 30000",

45 "test:e2e:cli": "bun test ./tests/e2e/cli-linux-e2e.ts",

46 "typecheck": "tsc --noEmit",

47 "prepublishOnly": "bash ../../scripts/check-notices-clean.sh && bun run build"

48 },

49 "dependencies": {

50 "@inquirer/checkbox": "^5.0.11",

51 "@inquirer/password": "^5.0.11",

52 "@inquirer/select": "^5.2.0",

53 "@modelcontextprotocol/sdk": "^1.28.0",

54 "@napi-rs/keyring": "^1.3.0",

55 "@octokit/auth-oauth-device": "^8.0.3",

56 "@octokit/request": "^10.0.8",

57 "@octokit/rest": "^22.0.1",

58 "cli-boxes": "^4.0.1",

59 "commander": "^14.0.0",

60 "jsonc-parser": "^3.3.1",

61 "picocolors": "^1.1.1",

62 "pino": "^10.3.1",

63 "simple-git": "^3.36.0",

dist/lib-CCQO9uWA.mjsView file

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib-CCQO9uWA.mjsView on unpkg · L39

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Secret Pattern

RSA private key in dist/lib-CCQO9uWA.mjs

dist/lib-CCQO9uWA.mjsView on unpkg · L39

dist/native/index.jsView file

Lines 1-25javascript

1// prettier-ignore

2/* eslint-disable */

3// @ts-nocheck

4/* auto-generated by NAPI-RS */

6const { readFileSync } = require('fs')

7let nativeBinding = null

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/native/index.jsView on unpkg · L5

dist/chunk-6Z5SFZXK-C3WlMqq-.mjsView file

Lines 96-136javascript

96`)&&(n+=r>t?e.slice(t,r+1):i)}else n+=i}return(e[e.length-1]!==`"`||e.length===1)&&t(e.length,`MISSING_CHAR`,`Missing closing "quote`),n}function c(e,t){let n=``,r=e[t+1];for(;(r===` `||r===` `||r===`

97`||r===`\r`)&&!(r===`\r`&&e[t+2]!==`

98`);)r===`

99`&&(n+=`

100`),t+=1,r=e[t+1];return n||=` `,{fold:n,offset:t}}var l={0:`\0`,a:`\x07`,b:`\b`,e:`

dist/native/native-config.linux-arm64-musl.nodeView file

•path = dist/native/native-config.linux-arm64-musl.node kind = native_binary sizeBytes = 796488 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/native-config.linux-arm64-musl.nodeView on unpkg

dist/public/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/public/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/public/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/public/assets/pdf.worker-B1D2UnXD.mjsView file

•path = dist/public/assets/pdf.worker-B1D2UnXD.mjs kind = oversized_source_file sizeBytes = 2161149 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/public/assets/pdf.worker-B1D2UnXD.mjsView on unpkg

dist/git-handle-B4hCEi7c-CXOP12Ds.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @inkeep/open-knowledge@0.22.0 matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.22.0 similarity = 0.642 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/git-handle-B4hCEi7c-CXOP12Ds.mjsView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/lib-CCQO9uWA.mjsView file

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib-CCQO9uWA.mjsView on unpkg · L39

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Secret Pattern

RSA private key in dist/lib-CCQO9uWA.mjs

dist/lib-CCQO9uWA.mjsView on unpkg · L39

dist/native/index.jsView file

5L6: const { readFileSync } = require('fs') L7: let nativeBinding = null

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/native/index.jsView on unpkg · L5

dist/chunk-6Z5SFZXK-C3WlMqq-.mjsView file

116contains invisible/control Unicode U+FEFF (zero width no-break space) `};delete e.items,Object.assign(e,{type:n,source:t,end:[r]});break}default:{let r=`indent`in e?e.indent:-1,i=`end`in e&&Array.isArray(e.end)?e.end.filter(e=>e.type===`space`||e.type===`comment`||e.type===`newline`):[];for(let t of Object.ke

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/chunk-6Z5SFZXK-C3WlMqq-.mjsView on unpkg · L116

dist/native/native-config.linux-arm64-musl.nodeView file

•path = dist/native/native-config.linux-arm64-musl.node kind = native_binary sizeBytes = 796488 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/native-config.linux-arm64-musl.nodeView on unpkg

dist/public/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/public/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/public/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/public/assets/pdf.worker-B1D2UnXD.mjsView file

•path = dist/public/assets/pdf.worker-B1D2UnXD.mjs kind = oversized_source_file sizeBytes = 2161149 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/public/assets/pdf.worker-B1D2UnXD.mjsView on unpkg

dist/git-handle-B4hCEi7c-CXOP12Ds.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/git-handle-B4hCEi7c-CXOP12Ds.mjsView on unpkg

Findings

3 Critical4 High7 Medium9 Low

CriticalCritical Secretdist/lib-CCQO9uWA.mjs

CriticalTrojan Source Unicodedist/chunk-6Z5SFZXK-C3WlMqq-.mjs

CriticalSecret Patterndist/lib-CCQO9uWA.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Blobdist/public/assets/KaTeX_Script-Regular-D3wIWfF6.woff2

HighOversized Source Filedist/public/assets/pdf.worker-B1D2UnXD.mjs

HighPrevious Version Dangerous Deltadist/git-handle-B4hCEi7c-CXOP12Ds.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/native/index.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Native Binarydist/native/native-config.linux-arm64-musl.node

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEval

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowCopyleft License

Source & flagged code

10 flagged

package.jsonView file

Lines 23-63json

23 "dist",

24 "scripts",

25 "!dist/**/*.map"

26 ],

27 "engines": {

28 "node": ">=24"

29 },

30 "publishConfig": {

31 "access": "public"

32 },

33 "scripts": {

34 "build:cli": "tsdown",

35 "build:app": "cp -r ../app/dist dist/public",

36 "build:skill-asset": "bun ../server/scripts/build-skill-bundles.ts && mkdir -p dist/assets/skills && cp -R ../server/dist/assets/skills/. dist/assets/skills/",

37 "build:notices": "mkdir -p dist && cp ../../THIRD_PARTY_NOTICES.md dist/THIRD_PARTY_NOTICES.md",

38 "build:license": "mkdir -p dist && cp ../../LICENSE dist/LICENSE",

40 "build:schema": "bun --conditions=development scripts/build-config-schema.mjs",

41 "build:assets": "bun run build:app && bun run build:skill-asset && bun run build:notices && bun run build:license && bun run build:native && bun run build:schema",

42 "build": "bun run build:cli && bun run build:assets",

43 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L43

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L43

44 "test": "bun run build:schema && bun test --timeout 30000",

45 "test:e2e:cli": "bun test ./tests/e2e/cli-linux-e2e.ts",

46 "typecheck": "tsc --noEmit",

47 "prepublishOnly": "bash ../../scripts/check-notices-clean.sh && bun run build"

48 },

49 "dependencies": {

50 "@inquirer/checkbox": "^5.0.11",

51 "@inquirer/password": "^5.0.11",

52 "@inquirer/select": "^5.2.0",

53 "@modelcontextprotocol/sdk": "^1.28.0",

54 "@napi-rs/keyring": "^1.3.0",

55 "@octokit/auth-oauth-device": "^8.0.3",

56 "@octokit/request": "^10.0.8",

57 "@octokit/rest": "^22.0.1",

58 "cli-boxes": "^4.0.1",

59 "commander": "^14.0.0",

60 "jsonc-parser": "^3.3.1",

61 "picocolors": "^1.1.1",

62 "pino": "^10.3.1",

63 "simple-git": "^3.36.0",

dist/lib-CCQO9uWA.mjsView file

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib-CCQO9uWA.mjsView on unpkg · L39

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Secret Pattern

RSA private key in dist/lib-CCQO9uWA.mjs

dist/lib-CCQO9uWA.mjsView on unpkg · L39

dist/native/index.jsView file

Lines 1-25javascript

1// prettier-ignore

2/* eslint-disable */

3// @ts-nocheck

4/* auto-generated by NAPI-RS */

6const { readFileSync } = require('fs')

7let nativeBinding = null

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/native/index.jsView on unpkg · L5

dist/chunk-6Z5SFZXK-C3WlMqq-.mjsView file

Lines 96-136javascript

97`||r===`\r`)&&!(r===`\r`&&e[t+2]!==`

98`);)r===`

99`&&(n+=`

100`),t+=1,r=e[t+1];return n||=` `,{fold:n,offset:t}}var l={0:`\0`,a:`\x07`,b:`\b`,e:`

dist/native/native-config.linux-arm64-musl.nodeView file

•path = dist/native/native-config.linux-arm64-musl.node kind = native_binary sizeBytes = 796488 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/native-config.linux-arm64-musl.nodeView on unpkg

dist/public/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/public/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/public/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/public/assets/pdf.worker-B1D2UnXD.mjsView file

•path = dist/public/assets/pdf.worker-B1D2UnXD.mjs kind = oversized_source_file sizeBytes = 2161149 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/public/assets/pdf.worker-B1D2UnXD.mjsView on unpkg

dist/git-handle-B4hCEi7c-CXOP12Ds.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/git-handle-B4hCEi7c-CXOP12Ds.mjsView on unpkg