registry / AI-agent capability abuse / @inkeep/open-knowledge / 0.63.1

@inkeep/open-knowledge@0.63.1

Local-first, agent-friendly Markdown knowledge base with a cross-platform CLI and web editor

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Source inspection found no lifecycle hook or concrete exfiltration/payload behavior. The explicit agent-integration setup remains a warn-worthy capability under the firewall policy, not evidence of malicious intent.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

User runs `ok init` or another explicit CLI setup command.

Impact

Configures agent integrations for the OpenKnowledge tool in the selected project.

Mechanism

Project-scoped AI-agent MCP/skill configuration and native config loading.

AI rationale

Evidence

package.jsondist/resolve-project-root-Bc1ADd86.mjsdist/native/index.js.codex/config.toml.codex/skills/open-knowledge/SKILL.md

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Explicit CLI setup configures project MCP/skill paths for AI-agent tools.
Native loader permits a runtime environment-selected native library path.

Evidence against

package.json has no preinstall, install, or postinstall hook.
Agent configuration is tied to an explicit `ok init` command, not package installation.
No source-confirmed credential exfiltration, remote payload execution, or destructive behavior found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareTelemetryUrlStrings

Manifest

CopyleftLicense

Source & flagged code

18 flagged

dist/lib-B82GtN9K.mjsView file

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib-B82GtN9K.mjsView on unpkg · L39

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Secret Pattern

RSA private key in dist/lib-B82GtN9K.mjs

dist/lib-B82GtN9K.mjsView on unpkg · L39

1import{o as e,t}from"./chunk-DTipWd-i.mjs";import{n}from"./wrapper-BR9ZCXZF.mjs";import{Blob as r,Buffer as i}from"buffer";import{TextDecoder as a,TextEncoder as o}from"util";impor... L2: `+t+`at`)}else typeof r==`object`&&r.message&&r.stack?n+=r.stack.replace(/\n at/gm,` ... L38: Y3FblSokcA== L39: -----END CERTIFICATE-----`,key:`-----BEGIN PRIVATE KEY----- L40: [redacted] ... L67: \r L68: `);var qu=class e{reject=null;resolve=null;listeners={onSignalAbort:this.onSignalAbort.bind(this)};isChunkedTransfer=!1;isProperLastChunkReceived=!1;previousChunk=null;nodeRequest=... L69: ... L71: `),o+=a,i&&!i.disableErrorCapturing&&i.errorCapture===Ls.tryAndCatch&&(o+=`} catch(e) { $happy_dom.dispatchError(e); }`),o+=`})`;let s=null;try{s=r[Fe](o,{filename:r.location.href}... L72: `);let o=a;s

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/lib-B82GtN9K.mjsView on unpkg · L1

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/lib-B82GtN9K.mjsView on unpkg · L1

dist/resolve-project-root-Bc1ADd86.mjsView file

1import{i as e,o as t,t as n}from"./chunk-DTipWd-i.mjs";import{Ls as r,Ms as i,Ns as a,Vs as o,ws as s}from"./src-BOzh5nAU.mjs";import{An as c,Ri as l,_n as u,jr as d,pi as f}from".... L2: `)}displayWidth(e){return r(e).length}styleTitle(e){return e}styleUsage(e){return e.split(` `).map(e=>e===`[options]`?this.styleOptionText(e):e===`[command]`?this.styleSubcommandTe...

High

Child Process

Package source references child process execution.

dist/resolve-project-root-Bc1ADd86.mjsView on unpkg · L1

1Cross-file remote execution chain: dist/resolve-project-root-Bc1ADd86.mjs spawns dist/src-BOzh5nAU.mjs; helper contains network access plus dynamic code execution. L1: import{i as e,o as t,t as n}from"./chunk-DTipWd-i.mjs";import{Ls as r,Ms as i,Ns as a,Vs as o,ws as s}from"./src-BOzh5nAU.mjs";import{An as c,Ri as l,_n as u,jr as d,pi as f}from".... L2: `)}displayWidth(e){return r(e).length}styleTitle(e){return e}styleUsage(e){return e.split(` `).map(e=>e===`[options]`?this.styleOptionText(e):e===`[command]`?this.styleSubcommandTe... ... L9: - too many long flags`):Error(`${n} L10: - unrecognised flag format`)}if(t===void 0&&n===void 0)throw Error(`option creation failed due to no flags found in '${e}'.`);return{shortFlag:t,longFlag:n}}e.Option=n,e.DualOption... L11: - specify the name in

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/resolve-project-root-Bc1ADd86.mjsView on unpkg · L1

dist/chunk-5QMZ5MUS-C5NTf5Rj.mjsView file

1import{t as e}from"./chunk-DXB73IDG-BBwE27jK.mjs";function t(){let e=[{prop:`Function`,target:globalThis,violationType:`function_constructor`,strategy:`throw`,reason:`Function cons... L2:

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-5QMZ5MUS-C5NTf5Rj.mjsView on unpkg · L1

dist/native/index.jsView file

Lines 1-25javascript

1// prettier-ignore

2/* eslint-disable */

3// @ts-nocheck

4/* auto-generated by NAPI-RS */

6const { readFileSync } = require('fs')

7let nativeBinding = null

dist/src-B3B2YRvO.mjsView file

1import{o as e}from"./chunk-DTipWd-i.mjs";import{K as t,pt as n,q as r}from"./sleep-D4NlDISj.mjs";import{Ac as i,Co as a,Fc as o,Ic as s,jc as c,lt as l,ut as u}from"./src-BOzh5nAU.... L2: `);_.addBuffer(Buffer.from(E,`utf8`),`README.md`),_.end();let D=he(r);return _.outputStream.pipe(D),await new Promise((e,t)=>{D.on(`close`,e),D.on(`error`,t)}),a?.info({bundlePath:... L3: `),i=n.split(` ... L7: `)?` L8: `:``;V(e,`${JSON.stringify(r,null,2)}${i}`)}catch{let r=et(n,t.contentDir);r!==n&&V(e,r)}}function it(e,t){let n=z(e,`utf-8`),r=et(n,t.contentDir);r!==n&&V(e,r)}function at(e){try{... L9: `)}\n`:null}catch{return null}}function At(e){let t=F(e,`.git`,`ok`);if(!L(t))return null;let n=de(`git`,[`-C`,t,`log`,`--oneline`,`-50`],d({encoding:`utf-8`,timeout:2e3}));return ...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src-B3B2YRvO.mjsView on unpkg · L1

dist/public/assets/ku-TR-6OUDTVRD-CdE2By-R.jsView file

7contains invisible/control Unicode U+200C (zero width non-joiner) یان Alt ڕابگرە و کلیک بکە بۆ زیادکردنی خاڵە نوێیەکان`,placeImage:`کلیک بکە بۆ دانانی وێنەکە، یان کلیک بکە و ڕایبکێشە بۆ ئەوەی قەبارەکەی بە دەستی دابنێیت`,publishLibrary:`کتێبخانەی تایبەت بە خۆت بڵاوبکەرەوە`,bindTextToElement:`بۆ زیادکردنی د

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/public/assets/ku-TR-6OUDTVRD-CdE2By-R.jsView on unpkg · L7

dist/native/native-config.linux-arm64-musl.nodeView file

•path = dist/native/native-config.linux-arm64-musl.node kind = native_binary sizeBytes = 797800 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/native-config.linux-arm64-musl.nodeView on unpkg

dist/dist-bundle-EXrl9_Zm.mjsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/dist-bundle-EXrl9_Zm.mjsView on unpkg

•matchType = normalized_sha256 matchedPackage = @inkeep/open-knowledge@0.36.0 matchedPath = dist/dist-bundle-GEZgvZIe.mjs matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.36.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dist-bundle-EXrl9_Zm.mjsView on unpkg

dist/open-browser-ycZBGuNV.mjsView file

•matchType = normalized_sha256 matchedPackage = @inkeep/open-knowledge@0.30.0 matchedPath = dist/open-browser-B0EHWyOL.mjs matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.30.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/open-browser-ycZBGuNV.mjsView on unpkg

dist/chunk-WRU74C26-BESBlKtm.mjsView file

•matchType = normalized_sha256 matchedPackage = @inkeep/open-knowledge@0.36.0 matchedPath = dist/chunk-Q4XR5HBZ-DE_erWE4.mjs matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.36.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-WRU74C26-BESBlKtm.mjsView on unpkg

dist/chunk-ZIRB5QZD-B2znOhor.mjsView file

•matchType = normalized_sha256 matchedPackage = @inkeep/open-knowledge@0.30.0 matchedPath = dist/public/assets/chunk-XPW4576I-DZebSSCr.js matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.30.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-ZIRB5QZD-B2znOhor.mjsView on unpkg

dist/public/assets/chunk-ZUYEQ4TG-Z9Kr3Qsb.jsView file

1patternName = google_api_key severity = high line = 1 matchedText = var e={V...AZZX

High

Secret Pattern

Google API key in dist/public/assets/chunk-ZUYEQ4TG-Z9Kr3Qsb.js

dist/public/assets/chunk-ZUYEQ4TG-Z9Kr3Qsb.jsView on unpkg · L1

Source & flagged code

18 flagged · loading source

dist/lib-B82GtN9K.mjsView file

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib-B82GtN9K.mjsView on unpkg · L39

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Secret Pattern

RSA private key in dist/lib-B82GtN9K.mjs

dist/lib-B82GtN9K.mjsView on unpkg · L39

Findings

3 Critical11 High7 Medium8 Low

CriticalCritical Secretdist/lib-B82GtN9K.mjs

CriticalTrojan Source Unicodedist/public/assets/ku-TR-6OUDTVRD-CdE2By-R.js

CriticalSecret Patterndist/lib-B82GtN9K.mjs

HighChild Processdist/resolve-project-root-Bc1ADd86.mjs

HighShell

HighSame File Env Network Executiondist/src-B3B2YRvO.mjs

HighCross File Remote Execution Contextdist/resolve-project-root-Bc1ADd86.mjs

HighSemantic Analysis Limiteddist/dist-bundle-EXrl9_Zm.mjs

HighKnown Malware Source Similaritydist/native/index.js

HighKnown Malware Source Similaritydist/open-browser-ycZBGuNV.mjs

HighKnown Malware Source Similaritydist/chunk-WRU74C26-BESBlKtm.mjs

Affected versions and remediation

This report applies to @inkeep/open-knowledge@0.63.1.

See all versions of @inkeep/open-knowledge for other recorded verdicts.

Review the evidence and your use of @inkeep/open-knowledge@0.63.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-26 05:36:41.424Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code