Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@inkeep/open-knowledge@0.36.0: AI-agent control-surface risk | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Soft block: AI-agent control surface

Warn by default; block when configured. Can inject package-controlled instructions into multiple installed AI agent hosts.

View on npm All versions Policy details

registry / @inkeep/open-knowledge / 0.36.0

@inkeep/open-knowledge@0.36.0

AI Security Review

scanned 21d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package triggers an unprompted postinstall hook that deploys its skill to detected AI-agent hosts. This mutates a broad foreign agent control surface.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm/bun/npx package installation

Impact

Can inject package-controlled instructions into multiple installed AI agent hosts.

Mechanism

postinstall-driven global AI-agent skill installation

Policy narrative

At dependency installation, postinstall imports dist/index.mjs and invokes installUserSkill without user approval. The package documents deployment to detected agent hosts and a global npx skills invocation targeting all agents. Its bundled repair code copies skill content into central and host-specific AI-editor skill directories, including overwriting existing package skill directories. This is an unconsented install-time mutation of a broad AI-agent instruction surface.

Rationale

Source inspection confirms the scanner’s lifecycle concern: this is not inert code or an explicit user command. The automatic broad agent-host skill installation meets the firewall block policy.

Evidence

package.jsonscripts/postinstall.mjsdist/index.mjsdist/repair-skills-CK9KuPiU.mjsdist/assets/skills/project/SKILL.mddist/assets/skills/discovery/SKILL.mddist/assets/skills/write-skill/SKILL.md

Decision evidence

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

public snapshot

AI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs postinstall on every install.
scripts/postinstall.mjs automatically calls installUserSkill().
Hook states it installs an Agent Skill to detected agent hosts.
Bundled code advertises global installation via npx skills --agent '*' -g -y --copy.
dist/repair-skills-CK9KuPiU.mjs writes/overwrites skills for central and detected editor host directories.

Evidence against

No credential harvesting or exfiltration found in the install hook.
No install-time network endpoint was confirmed.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

Manifest

CopyleftLicense

scanned 627 file(s), 20.7 MB of source, external domains: 127.0.0.1, antigravity.google, api.github.com, api.openai.com, bun.sh, cdn.jsdelivr.net, chevrotain.io, claude.com, cscott.net, cursor.com, developers.openai.com, docs.claude.com, docs.github.com, docs.openclaw.ai, docs.orama.com, en.wikipedia.org, example.com, fb.me, foo.bar, git-scm.com, gitforwindows.org, github.com, gnu.org, hermes-agent.nousresearch.com, html.spec.whatwg.org, json-schema.org, landley.net, langium.org, lodash.com, mermaid.js.org, openai.com, openclaw.ai, opencode.ai, openjsf.org, openknowledge.ai, pi.dev, placeholder.invalid, placeholder.local, prosemirror.net, radix-ui.com, raw.githubusercontent.com, react.dev, rolldown.rs, underscorejs.org, uploads.github.com, vimeo.com, www.ibm.com, www.w3.org

Oversized source lightweight scan

dist/public/assets/pdf.worker-B1D2UnXD.mjs2.06 MB file, sampled 256 KB

NetworkChildProcessDynamicRequireUrlStringsexample.com

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/lib-CW6dpYSh.mjsView file

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib-CW6dpYSh.mjsView on unpkg · L39

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Secret Pattern

RSA private key in dist/lib-CW6dpYSh.mjs

dist/lib-CW6dpYSh.mjsView on unpkg · L39

dist/src-S2yxN8_s.mjsView file

90contains invisible/control Unicode U+FEFF (zero width no-break space) `};delete e.items,Object.assign(e,{type:n,source:t,end:[r]});break}default:{let r=`indent`in e?e.indent:-1,i=`end`in e&&Array.isArray(e.end)?e.end.filter(e=>e.type===`space`||e.type===`comment`||e.type===`newline`):[];for(let t of Object.ke

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/src-S2yxN8_s.mjsView on unpkg · L90

dist/native/native-config.linux-arm64-musl.nodeView file

•path = dist/native/native-config.linux-arm64-musl.node kind = native_binary sizeBytes = 796488 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/native-config.linux-arm64-musl.nodeView on unpkg

Findings

3 Critical1 High7 Medium8 Low

CriticalCritical Secretdist/lib-CW6dpYSh.mjs

CriticalTrojan Source Unicodedist/src-S2yxN8_s.mjs

CriticalSecret Patterndist/lib-CW6dpYSh.mjs

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Require

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Native Binarydist/native/native-config.linux-arm64-musl.node

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowCopyleft License

99%Soft block

Verdict confidence

TypeSoft block: AI-agent control surface

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn by default

Package metadata

npm

Version0.38.4

PublishedJul 22, 2026

LicenseGPL-3.0-or-later

Dependencies20

Integrityverified

Package size10.7 MB

Files757

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsexports mapbin → ok, open-knowledge

Runtimenode >=24

Artifact31.1 MB · 757 files1 signature(s) · provenance

Install lifecyclepostinstall

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocketHighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStringsCopyleftLicense

LPM CLI

Source & flagged code

6 flagged

package.jsonView file

Lines 59-84json

59 "@types/yazl": "^3.3.1",

60 "ajv": "^8.18.0",

61 "ajv-formats": "^3.0.1",

62 "tsdown": "^0.21.7",

63 "typescript": "^5.9.3",

64 "@inkeep/open-knowledge-app": "0.36.0",

65 "@inkeep/open-knowledge-native-config": "0.0.0",

66 "@inkeep/open-knowledge-server": "0.36.0",

67 "@inkeep/open-knowledge-core": "0.36.0"

68 },

69 "scripts": {

70 "build:cli": "tsdown",

71 "build:app": "cp -r ../app/dist dist/public",

72 "build:skill-asset": "tsx ../server/scripts/build-skill-bundles.ts && mkdir -p dist/assets/skills && cp -R ../server/dist/assets/skills/. dist/assets/skills/",

73 "build:notices": "mkdir -p dist && cp ../../THIRD_PARTY_NOTICES.md dist/THIRD_PARTY_NOTICES.md",

74 "build:license": "mkdir -p dist && cp ../../LICENSE dist/LICENSE",

75 "build:native": "mkdir -p dist/native && cp ../native-config/index.js ../native-config/index.d.ts ../native-config/package.json dist/native/ && (cp ../native-config/*.node dist/native/ 2>/dev/null || true)",

76 "build:schema": "node --import tsx --conditions=development scripts/build-config-schema.mjs",

77 "build:assets": "pnpm run build:app && pnpm run build:skill-asset && pnpm run build:notices && pnpm run build:license && pnpm run build:native && pnpm run build:schema",

78 "build": "pnpm run build:cli && pnpm run build:assets",

79 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L79

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L79

80 "test": "pnpm run build:schema && vitest run",

81 "test:e2e:cli": "vitest run --config vitest.e2e.config.ts",

82 "typecheck": "tsc --noEmit"

83 }

84}

dist/lib-CW6dpYSh.mjsView file

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib-CW6dpYSh.mjsView on unpkg · L39

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Secret Pattern

RSA private key in dist/lib-CW6dpYSh.mjs

dist/lib-CW6dpYSh.mjsView on unpkg · L39

dist/src-S2yxN8_s.mjsView file

90contains invisible/control Unicode U+FEFF (zero width no-break space) `};delete e.items,Object.assign(e,{type:n,source:t,end:[r]});break}default:{let r=`indent`in e?e.indent:-1,i=`end`in e&&Array.isArray(e.end)?e.end.filter(e=>e.type===`space`||e.type===`comment`||e.type===`newline`):[];for(let t of Object.ke

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/src-S2yxN8_s.mjsView on unpkg · L90

dist/native/native-config.linux-arm64-musl.nodeView file

•path = dist/native/native-config.linux-arm64-musl.node kind = native_binary sizeBytes = 796488 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/native-config.linux-arm64-musl.nodeView on unpkg