Loading npm security reports…

@inkeep/open-knowledge@0.30.2: AI-agent control-surface risk | LPM Firewall

registry / @inkeep/open-knowledge / 0.30.2

@inkeep/open-knowledge@0.30.2

AI Security Review

scanned 21d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation silently invokes a package-supplied skill installer. It uses npx with automatic confirmation to copy a bundled skill into every detected global AI-agent host and removes prior host skill paths.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm/bun install or npx cache population

Impact

Unconsented mutation of foreign global AI-agent control surfaces; installed instructions can influence future agent behavior.

Mechanism

postinstall broad AI-agent skill installation

Policy narrative

On package installation, postinstall loads installUserSkill. That function launches npx skills@~1.5.0 with --agent * -g -y --copy, causing noninteractive global installation into detected AI-agent hosts; it also removes legacy skills from .claude, .cursor, and .agents. This is an unconsented install-time mutation of broad, foreign agent control surfaces.

Rationale

Direct source inspection confirms the policy-defined blocking behavior, independent of scanner labels. The bundled payload appears product-aligned, but its unconsented broad postinstall deployment is itself concrete attack behavior under the stated policy.

Evidence

package.jsonscripts/postinstall.mjsdist/dist-CmLjR_Cj.mjsdist/write-project-skill-fM8HWeYm.mjsdist/assets/skills/discovery/SKILL.mddist/index.mjs~/.agents/skills/open-knowledge-discovery~/.claude/skills/open-knowledge

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/lib-BLR9KuxL.mjsView file

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib-BLR9KuxL.mjsView on unpkg · L39

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Secret Pattern

RSA private key in dist/lib-BLR9KuxL.mjs

dist/lib-BLR9KuxL.mjsView on unpkg · L39

dist/native/index.jsView file

5L6: const { readFileSync } = require('fs') L7: let nativeBinding = null

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/native/index.jsView on unpkg · L5

dist/chunk-6Z5SFZXK-DHOjsS81.mjsView file

116contains invisible/control Unicode U+FEFF (zero width no-break space) `};delete e.items,Object.assign(e,{type:n,source:t,end:[r]});break}default:{let r=`indent`in e?e.indent:-1,i=`end`in e&&Array.isArray(e.end)?e.end.filter(e=>e.type===`space`||e.type===`comment`||e.type===`newline`):[];for(let t of Object.ke

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/chunk-6Z5SFZXK-DHOjsS81.mjsView on unpkg · L116

dist/native/native-config.linux-arm64-musl.nodeView file

•path = dist/native/native-config.linux-arm64-musl.node kind = native_binary sizeBytes = 796488 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/native-config.linux-arm64-musl.nodeView on unpkg

dist/public/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/public/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/public/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/dist-CmLjR_Cj.mjsView file

•path = dist/dist-CmLjR_Cj.mjs kind = oversized_source_file sizeBytes = 2812066 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/dist-CmLjR_Cj.mjsView on unpkg

dist/git-handle-XXj9bu6B-B4fXubq8.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @inkeep/open-knowledge@0.22.0 matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.22.0 similarity = 0.567 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/git-handle-XXj9bu6B-B4fXubq8.mjsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 23-63json

23 "dist",

24 "scripts",

25 "!dist/**/*.map"

26 ],

27 "engines": {

28 "node": ">=24"

29 },

30 "publishConfig": {

31 "access": "public"

32 },

33 "scripts": {

34 "build:cli": "tsdown",

35 "build:app": "cp -r ../app/dist dist/public",

36 "build:skill-asset": "bun ../server/scripts/build-skill-bundles.ts && mkdir -p dist/assets/skills && cp -R ../server/dist/assets/skills/. dist/assets/skills/",

37 "build:notices": "mkdir -p dist && cp ../../THIRD_PARTY_NOTICES.md dist/THIRD_PARTY_NOTICES.md",

38 "build:license": "mkdir -p dist && cp ../../LICENSE dist/LICENSE",

39 "build:native": "mkdir -p dist/native && cp ../native-config/index.js ../native-config/index.d.ts ../native-config/package.json dist/native/ && (cp ../native-config/*.node dist/native/ 2>/dev/null || true)",

40 "build:schema": "bun --conditions=development scripts/build-config-schema.mjs",

41 "build:assets": "bun run build:app && bun run build:skill-asset && bun run build:notices && bun run build:license && bun run build:native && bun run build:schema",

42 "build": "bun run build:cli && bun run build:assets",

43 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L43

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L43

44 "test": "bun run build:schema && bun test --timeout 30000",

45 "test:e2e:cli": "bun test ./tests/e2e/cli-linux-e2e.ts",

46 "typecheck": "tsc --noEmit",

47 "prepublishOnly": "bash ../../scripts/check-notices-clean.sh && bun run build"

48 },

49 "dependencies": {

50 "@inquirer/checkbox": "^5.0.11",

51 "@inquirer/password": "^5.0.11",

52 "@inquirer/select": "^5.2.0",

53 "@modelcontextprotocol/sdk": "^1.28.0",

54 "@napi-rs/keyring": "^1.3.0",

55 "@octokit/auth-oauth-device": "^8.0.3",

56 "@octokit/request": "^10.0.8",

57 "@octokit/rest": "^22.0.1",

58 "cli-boxes": "^4.0.1",

59 "commander": "^14.0.0",

60 "jsonc-parser": "^3.3.1",

61 "picocolors": "^1.1.1",

62 "pino": "^10.3.1",

63 "simple-git": "^3.36.0",

dist/lib-BLR9KuxL.mjsView file

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib-BLR9KuxL.mjsView on unpkg · L39

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Secret Pattern

RSA private key in dist/lib-BLR9KuxL.mjs

dist/lib-BLR9KuxL.mjsView on unpkg · L39

dist/native/index.jsView file

Lines 1-25javascript

1// prettier-ignore

2/* eslint-disable */

3// @ts-nocheck

4/* auto-generated by NAPI-RS */

5

6const { readFileSync } = require('fs')

7let nativeBinding = null

dist/chunk-6Z5SFZXK-DHOjsS81.mjsView file

Lines 96-136javascript

96`)&&(n+=r>t?e.slice(t,r+1):i)}else n+=i}return(e[e.length-1]!==`"`||e.length===1)&&t(e.length,`MISSING_CHAR`,`Missing closing "quote`),n}function c(e,t){let n=``,r=e[t+1];for(;(r===` `||r===` `||r===`

97`||r===`\r`)&&!(r===`\r`&&e[t+2]!==`

98`);)r===`

99`&&(n+=`

100`),t+=1,r=e[t+1];return n||=` `,{fold:n,offset:t}}var l={0:`\

dist/native/native-config.linux-arm64-musl.nodeView file

•path = dist/native/native-config.linux-arm64-musl.node kind = native_binary sizeBytes = 796488 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/native-config.linux-arm64-musl.nodeView on unpkg

dist/public/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/public/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/public/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

dist/dist-CmLjR_Cj.mjsView file

•path = dist/dist-CmLjR_Cj.mjs kind = oversized_source_file sizeBytes = 2812066 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/dist-CmLjR_Cj.mjsView on unpkg

dist/git-handle-XXj9bu6B-B4fXubq8.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @inkeep/open-knowledge@0.22.0 matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.22.0 similarity = 0.567 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/git-handle-XXj9bu6B-B4fXubq8.mjsView on unpkg