@inkeep/open-knowledge@0.29.0: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

@inkeep/open-knowledge@0.29.0: AI-agent control-surface risk | LPM Firewall

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/lib-CCQO9uWA.mjsView file

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib-CCQO9uWA.mjsView on unpkg · L39

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Secret Pattern

RSA private key in dist/lib-CCQO9uWA.mjs

dist/lib-CCQO9uWA.mjsView on unpkg · L39

dist/gh-detect-V88Du2MF.mjsView file

1import{Ko as e}from"./server-lock-iLcBw_q0-CU5aT1xR.mjs";import{execFileSync as t}from"node:child_process";import{dirname as n,join as r}from"node:path";import{homedir as i}from"no... L2: `),d(()=>t?.onBackendSelected?.({backend:`keyring`})),new m(new f(t?.onKeychainRead),new p(e))}catch(n){let r=n instanceof Error?`${n.name}: ${n.message}`:String(n);return process....

High

Child Process

Package source references child process execution.

dist/gh-detect-V88Du2MF.mjsView on unpkg · L1

dist/init-D1K3Q6VH.mjsView file

1import{a as e,s as t,t as n}from"./chunk-C94x7I9S.mjs";import{Ba as r,Bt as i,Et as a,Va as o,Xi as s,bi as c,bn as l,ja as u,mt as d}from"./server-lock-iLcBw_q0-CU5aT1xR.mjs";impo... L2: `),u=!1;for(let e=0;e<l.length;e++){let t=l[e];if(r+=t,u)u=!1;else if(u=t>=`\ud800`&&t<=`\udbff`,u)continue;if(t===`\x1B`||t===``){Lt.lastIndex=e+1;let t=Lt.exec(l)?.groups;if(t?.... ... L11: `).length,bn=e=>e.split(` L12: `).pop()??``;var xn=class{height=0;extraLinesUnderPrompt=0;cursorPos;rl;constructor(e){this.rl=e,this.cursorPos=e.getCursorPos()}write(e){this.rl.output.unmute(),this.rl.output.wri... L13: `);let a=e+(t?` ... L21: `)}function Pn(e){let t=D(e);switch(t.kind){case`directory`:case`linked`:{let e=z(Fn(t.path),`info`);return H(e)?{kind:`ok`,path:z(e,`exclude`)}:{kind:`no-exclude`,result

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/init-D1K3Q6VH.mjsView on unpkg · L1

685unset PORT L686: exec node "${ie()}" start --ui-port "$UIPORT"`,i=t.platformName??process.platform,a=t.mode===`dev`?{name:Aa,runtimeExecutable:`/bin/sh`,runtimeArgs:[`-l`,`-c`,r()],port:Zi,autoPort... L687: `)}function Za(e,t){return{projectRoot:e.projectRoot,gitRootPromoted:e.gitRootPromoted,promotedFromDir:e.promotedFromDir??null,contentDir:t.contentDir,contentDirRequested:e.content...

High

Shell

Package source references shell execution.

dist/init-D1K3Q6VH.mjsView on unpkg · L685

679$probe = Join-Path $d 'npx.cmd' L680: if (Test-Path -LiteralPath $probe -PathType Leaf) { & $probe -y '@inkeep/open-knowledge@latest' start --ui-port $UIPORT; exit $LASTEXITCODE } L681: } ... L685: unset PORT L686: exec node "${ie()}" start --ui-port "$UIPORT"`,i=t.platformName??process.platform,a=t.mode===`dev`?{name:Aa,runtimeExecutable:`/bin/sh`,runtimeArgs:[`-l`,`-c`,r()],port:Zi,autoPort... L687: `)}function Za(e,t){return{projectRoot:e.projectRoot,gitRootPromoted:e.gitRootPromoted,promotedFromDir:e.promotedFromDir??null,contentDir:t.contentDir,contentDirRequested:e.content...

dist/native/native-config.linux-arm64-musl.nodeView file

•path = dist/native/native-config.linux-arm64-musl.node kind = native_binary sizeBytes = 796488 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/native-config.linux-arm64-musl.nodeView on unpkg

dist/public/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/public/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/public/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/dist-CzszUkVL.mjsView file

•path = dist/dist-CzszUkVL.mjs kind = oversized_source_file sizeBytes = 2809087 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/dist-CzszUkVL.mjsView on unpkg

dist/git-handle-XXj9bu6B-B4fXubq8.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @inkeep/open-knowledge@0.22.0 matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.22.0 similarity = 0.633 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/git-handle-XXj9bu6B-B4fXubq8.mjsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 23-63json

23 "dist",

24 "scripts",

25 "!dist/**/*.map"

26 ],

27 "engines": {

28 "node": ">=24"

29 },

30 "publishConfig": {

31 "access": "public"

32 },

33 "scripts": {

34 "build:cli": "tsdown",

35 "build:app": "cp -r ../app/dist dist/public",

36 "build:skill-asset": "bun ../server/scripts/build-skill-bundles.ts && mkdir -p dist/assets/skills && cp -R ../server/dist/assets/skills/. dist/assets/skills/",

37 "build:notices": "mkdir -p dist && cp ../../THIRD_PARTY_NOTICES.md dist/THIRD_PARTY_NOTICES.md",

38 "build:license": "mkdir -p dist && cp ../../LICENSE dist/LICENSE",

39 "build:native": "mkdir -p dist/native && cp ../native-config/index.js ../native-config/index.d.ts ../native-config/package.json dist/native/ && (cp ../native-config/*.node dist/native/ 2>/dev/null || true)",

40 "build:schema": "bun --conditions=development scripts/build-config-schema.mjs",

41 "build:assets": "bun run build:app && bun run build:skill-asset && bun run build:notices && bun run build:license && bun run build:native && bun run build:schema",

42 "build": "bun run build:cli && bun run build:assets",

43 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L43

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L43

44 "test": "bun run build:schema && bun test --timeout 30000",

45 "test:e2e:cli": "bun test ./tests/e2e/cli-linux-e2e.ts",

46 "typecheck": "tsc --noEmit",

47 "prepublishOnly": "bash ../../scripts/check-notices-clean.sh && bun run build"

48 },

49 "dependencies": {

50 "@inquirer/checkbox": "^5.0.11",

51 "@inquirer/password": "^5.0.11",

52 "@inquirer/select": "^5.2.0",

53 "@modelcontextprotocol/sdk": "^1.28.0",

54 "@napi-rs/keyring": "^1.3.0",

55 "@octokit/auth-oauth-device": "^8.0.3",

56 "@octokit/request": "^10.0.8",

57 "@octokit/rest": "^22.0.1",

58 "cli-boxes": "^4.0.1",

59 "commander": "^14.0.0",

60 "jsonc-parser": "^3.3.1",

61 "picocolors": "^1.1.1",

62 "pino": "^10.3.1",

63 "simple-git": "^3.36.0",

dist/lib-CCQO9uWA.mjsView file

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib-CCQO9uWA.mjsView on unpkg · L39

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Secret Pattern

RSA private key in dist/lib-CCQO9uWA.mjs

dist/lib-CCQO9uWA.mjsView on unpkg · L39

dist/gh-detect-V88Du2MF.mjsView file

Lines 1-3javascript

1import{Ko as e}from"./server-lock-iLcBw_q0-CU5aT1xR.mjs";import{execFileSync as t}from"node:child_process";import{dirname as n,join as r}from"node:path";import{homedir as i}from

dist/init-D1K3Q6VH.mjsView file

Lines 1-21javascript

1import{a as e,s as t,t as n}from"./chunk-C94x7I9S.mjs";import{Ba as r,Bt as i,Et as a,Va as o,Xi as s,bi as c,bn as l,ja as u,mt

dist/native/native-config.linux-arm64-musl.nodeView file

•path = dist/native/native-config.linux-arm64-musl.node kind = native_binary sizeBytes = 796488 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/native-config.linux-arm64-musl.nodeView on unpkg

dist/public/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/public/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/public/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/dist-CzszUkVL.mjsView file

•path = dist/dist-CzszUkVL.mjs kind = oversized_source_file sizeBytes = 2809087 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/dist-CzszUkVL.mjsView on unpkg

dist/git-handle-XXj9bu6B-B4fXubq8.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @inkeep/open-knowledge@0.22.0 matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.22.0 similarity = 0.633 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/git-handle-XXj9bu6B-B4fXubq8.mjsView on unpkg

Lines 659-690javascript

659$UIPORT = if ($env:PORT) { $env:PORT } else { '${Zi}' }

660Remove-Item Env:PORT -ErrorAction SilentlyContinue

661if ($env:APPDATA) {

662 $shim = Join-Path $env:APPDATA 'npm\\ok.cmd'

663 if (Test-Path -LiteralPath $shim -PathType Leaf) { & $shim start --ui-port $UIPORT; exit $LASTEXITCODE }

664}

665$ok = Get-Command ok.cmd -CommandType Application -ErrorAction SilentlyContinue

666if ($ok) { & $ok.Source start --ui-port $UIPORT; exit $LASTEXITCODE }

667$npx = Get-Command npx.cmd -CommandType Application -ErrorAction SilentlyContinue

668if ($npx) { & $npx.Source -y '@inkeep/open-knowledge@latest' start --ui-port $UIPORT; exit $LASTEXITCODE }

669$dirs = @()

670if ($env:ProgramFiles) { $dirs += Join-Path $env:ProgramFiles 'nodejs' }

671if ($env:NVM_SYMLINK) { $dirs += $env:NVM_SYMLINK }

672if ($env:LOCALAPPDATA) {

673 $dirs += Join-Path $env:LOCALAPPDATA 'fnm\\aliases\\default'

674 $dirs += Join-Path $env:LOCALAPPDATA 'Volta\\bin'

675 $dirs += Join-Path $env:LOCALAPPDATA 'pnpm'

676}

677if ($env:USERPROFILE) { $dirs += Join-Path $env:USERPROFILE 'scoop\\shims' }

678foreach ($d in $dirs) {

679 $probe = Join-Path $d 'npx.cmd'

680 if (Test-Path -LiteralPath $probe -PathType Leaf) { & $probe -y '@inkeep/open-knowledge@latest' start --ui-port $UIPORT; exit $LASTEXITCODE }

681}

682[Console]::Error.WriteLine('OpenKnowledge: install Node.js 24+ (npm i -g @inkeep/open-knowledge), then restart your editor')

683exit 127`;function Ia(e,t={}){let n=z(e,`.claude`,`launch.json`),r=()=>`${Ma}

684UIPORT="\${PORT:-${Zi}}"

685unset PORT

686exec node "${ie()}" start --ui-port "$UIPORT"`,i=t.platformName??process.platform,a=t.mode===`dev`?{name:Aa,runtimeExecutable:`/bin/sh`,runtimeArgs:[`-l`,`-c`,r()],port:Zi,autoPort:!0}:i===`win32`?{name:Aa,runtimeExecutable:`powershell`,runtimeArgs:[`-NoProfile`,`-NonInteractive`,`-Command

687`)}function Za(e,t){return{projectRoot:e.projectRoot,gitRootPromoted:e.gitRootPromoted,promotedFromDir:e.promotedFromDir??null,contentDir:t.contentDir,contentDirRequested:e.contentDirRequested??null,contentDirApplied:e.contentDir!==void 0,contentFileCount:t.contentFileCount,previewError:e.previewWarning??null,didGitInit:e.didGitInit,mcpAction:e.mcpAction,editors:e.editors.map(e=>({editorId:e.editorId,label:e.label,action:e.action,configPath:e.configPath,scope:e.configScope===

688`),e.stderr&&process.stderr.write(`${e.stderr.trim()}\n`),process.exitCode=1;return}throw e}let i=r.contentDir??`.`,a=null,{loadConfig:o}=await import(`./loader-CFHAWDpx.mjs`),{resolveContentDir:s}=await import(`./dist-YCnI0BBU.mjs`),c;try{c=o(r.projectRoot).config,i=c.content.dir}catch(e){r.previewWarning=e instanceof Error?e.message:String(e)}if(c)try{let{previewContent:e}=await import(`./preview-XRLPRoJj.mjs`),t=s(c,r.projectRoot);r.preview=e({projectDir:r.projectRoot,contentDir:t}),a=r.preview.totalCount}catch(e){r.previewWarning=e instanceof Error?e.message:String(e)}e.json?process.stdout ...

689`))n.push(t.length>0?` ${t}`:``);return n.push(` Re-run ${P(`ok config-sharing unshare`)} after resolving to complete the switch.`),n;case`no-exclude`:if(e.localOnlyRequested)n.push(I(`Sharing mode: --local-only requested but no git repo found — option ignored`

690//# sourceMappingURL=init-D1K3Q6VH.mjs.map

Long lines were clipped for display.