registry / AI-agent capability abuse / @inkeep/open-knowledge / 0.63.10

@inkeep/open-knowledge@0.63.10

Local-first, agent-friendly Markdown knowledge base with a cross-platform CLI and web editor

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

There is no install-time hook, and the risky MCP and GitHub-token behavior is a user-invoked CLI product surface rather than a proven secret-theft payload. Native .node binaries plus incomplete analysis of the minified dist still leave a dual-use agent-config capability that should not be marked clean.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

User runs the open-knowledge or ok CLI, especially ok init, login, or git-credential.

Impact

Installed editors may load this package as an MCP server, and GitHub tokens used for git stay available to the CLI; unreadable native code cannot be fully ruled out.

Mechanism

Explicit CLI MCP registration, native TOML config edits, and GitHub token relay

AI rationale

Evidence

dist/init-Df5Zuivf.mjsdist/native/package.jsondist/native/index.d.tsdist/native/index.jsdist/index.mjsdist/cli.mjsdist/index.d.mts~/.cursor/mcp.json~/.claude.json.mcp.json.cursor/mcp.jsonAGENTS.mdCLAUDE.mddist/native/native-config.darwin-arm64.node

Network endpoints3

api.github.comgithub.com127.0.0.1

Decision evidence

public snapshot

AI called this Suspicious at 68.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

User-invoked ok init writes MCP entries into Cursor, Claude, and project agent configs.
Native NAPI binaries implement MCP config edits; compiled .node files cannot be reviewed as JavaScript.
CLI and library code collect GitHub CLI tokens with gh auth token and a git-credential helper.
Init can mutate AGENTS.md and CLAUDE.md and install skills into editor skill directories.
The published dist is a huge minified bundle plus native binaries, so static coverage of every high-risk path is incomplete.

Evidence against

package.json has no preinstall, install, or postinstall scripts.
MCP registration is an explicit init command and can be skipped with --no-mcp.
GitHub login uses device flow against api.github.com and GitHub Enterprise hosts.
The native TypeScript surface is TOML MCP upsert/remove, not a generic loader API.
Scanner-flagged awk, curl, and markdown chunks are bundled editor/tooling libraries, not a hidden C2 path.

Behavioral surface

Source

ChildProcessCryptoDynamicRequire

Source & flagged code

26 flagged

dist/lib-B82GtN9K.mjsView file

39patternName = private_key_rsa severity = critical line = 39

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib-B82GtN9K.mjsView on unpkg · L39

39patternName = private_key_rsa severity = critical line = 39

Critical

Secret Pattern

RSA private key in dist/lib-B82GtN9K.mjs

dist/lib-B82GtN9K.mjsView on unpkg · L39

1import{o as e,t}from"./chunk-DTipWd-i.mjs";import{n}from"./wrapper-BR9ZCXZF.mjs";import{Blob as r,Buffer as i}from"buffer";import{TextDecoder as a,TextEncoder as o}from"util";impor... L2: `+t+`at`)}else typeof r==`object`&&r.message&&r.stack?n+=r.stack.replace(/\n at/gm,` ... L38: Y3FblSokcA== L39: -----END CERTIFICATE-----`,key:`-----BEGIN PRIVATE KEY----- L40: [redacted] ... L67: \r L68: `);var qu=class e{reject=null;resolve=null;listeners={onSignalAbort:this.onSignalAbort.bind(this)};isChunkedTransfer=!1;isProperLastChunkReceived=!1;previousChunk=null;nodeRequest=... L69: ... L71: `),o+=a,i&&!i.disableErrorCapturing&&i.errorCapture===Ls.tryAndCatch&&(o+=`} catch(e) { $happy_dom.dispatchError(e); }`),o+=`})`;let s=null;try{s=r[Fe](o,{filename:r.location.href}... L72: `);let o=a;s

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/lib-B82GtN9K.mjsView on unpkg · L1

dist/git-handle-29BNYqgw.mjsView file

Lines 1-10javascript

1import{i as e,o as t,t as n}from"./chunk-DTipWd-i.mjs";import{os as r}from"./src-DhKkOAcb.mjs";import{delimiter as i,normalize as a,resolve as o}from"node:path"

dist/native/index.jsView file

Lines 1-25javascript

1// prettier-ignore

2/* eslint-disable */

3// @ts-nocheck

4/* auto-generated by NAPI-RS */

6const { readFileSync } = require('fs')

7let nativeBinding = null

dist/src-CjFV1e1Z.mjsView file

1import{i as e,o as t,t as n}from"./chunk-DTipWd-i.mjs";import{$t as r,A as i,At as a,B as o,Bt as s,Ct as c,D as l,Dt as u,Et as d,Gt as f,H as p,Ht as m,I as h,It as g,J as _,Jt a... L2: `)){let e=n.trim();if(e.startsWith(`ok-contributors: `))try{let n=JSON.parse(e.slice(17));if(typeof n==`object`&&n&&`id`in n&&typeof n.id==`string`&&`name`in n&&typeof n.name==`str... L3: `)){let e=t.trim();if(!e.startsWith(Dd))continue;let n;try{n=JSON.parse(e.slice(10))}catch{return null}return typeof n!=`object`||!n?null:kd(n)}return null}function Ad(e){if(!e)ret... L4: `)){let e=n.trim();if(!e.startsWith(Dd))continue;let r;try{r=JSON.parse(e.slice(10))}catch{continue}if(typeof r!=`object`||!r)continue;let i=kd(r);i&&t.push(i)}return t}function kn... L5: `,i=e.getWriter();try{await i.write(n.encode

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src-CjFV1e1Z.mjsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/src-CjFV1e1Z.mjs

dist/index.mjsView file

1import{a as e,i as t,n,r,t as i}from"./chunk-DHbaKqs-.mjs";import"./libesm-qUf-Au5c.mjs";import{t as a}from"./yazl-BlMyAOcT.mjs";import"./chunk-B74TABJS-BJwhrR8a.mjs";import"./chun... L2: `)){let e=r.replace(Ye,``),i=Ke.exec(e)?.[1];if(i){n={login:i,active:!1},t.push(n);continue}if(qe.test(e)){n=void 0;continue}n&&Je.test(e)&&(n.active=!0)}return t}var Ze=i((e=>{let... ... L82: `:` L83: `)+(a.substring(1)||` `),n=!0,r=!1;break;case`%`:e[i+1]?.[0]!==`#`&&(i+=1),n=!1;break;default:n||(r=!0),n=!1}}return{comment:t,afterEmptyLine:r}}e.Composer=class{constructor(e={}){... L84: `}];switch(c[0]){case`|`:case`>`:{let e=c.indexOf(` ... L115: `)+1;for(;e!==0;)this.onNewLine(this.offset+e),e=this.source.indexOf(` L116: `,e)+1}return{type:e,offset:this.offset,indent:this.indent,source:this.source}

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.mjsView on unpkg · L1

1Trigger-reachable chain: manifest.exports -> dist/index.mjs L1: import{a as e,i as t,n,r,t as i}from"./chunk-DHbaKqs-.mjs";import"./libesm-qUf-Au5c.mjs";import{t as a}from"./yazl-BlMyAOcT.mjs";import"./chunk-B74TABJS-BJwhrR8a.mjs";import"./chun... L2: `)){let e=r.replace(Ye,``),i=Ke.exec(e)?.[1];if(i){n={login:i,active:!1},t.push(n);continue}if(qe.test(e)){n=void 0;continue}n&&Je.test(e)&&(n.active=!0)}return t}var Ze=i((e=>{let... ... L82: `:` L83: `)+(a.substring(1)||` `),n=!0,r=!1;break;case`%`:e[i+1]?.[0]!==`#`&&(i+=1),n=!1;break;default:n||(r=!0),n=!1}}return{comment:t,afterEmptyLine:r}}e.Composer=class{constructor(e={}){... L84: `}];switch(c[0]){case`|`:case`>`:{let e=c.indexOf(` ... L115: `)+1;for(;e!==0;)this.onNewLine(this.offset+e),e=this.source.indexOf(` L116: `,e)+1}return{type

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.mjsView on unpkg · L1

dist/cli.mjsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: import{o as e}from"./chunk-DTipWd-i.mjs";import{At as t,It as n,Kt as r,Lt as i,M as a,Ot as o,R as s,Rt as c,Ut as l,Xt as u,d,i as f,j as p,kt as m,ln as h,m as g,o as _,wt as v,... `)){let e=n.trim();if(e===``)continue;let r=e.indexOf(`=`);r!==-1&&(t[e.slice(0,r)]=e.slice(r+1))}return t}function ai(e){return new Promise((t,n)=>{let r=[];e.on(`data`,e=>r.push(... `)}var Ri=class extends Error{constructor(e,t,n){super(Li(n)),this.request=e,this.headers=t,this.response=n,this.errors=n.errors,this.data=n.data,Error.captureStackTrace&&Error.cap... `),process.exit(1));let o=r===`github.com`?void 0:`https://${r}/api/v3`,s=new

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.mjsView on unpkg

dist/public/assets/dist-CWxNQtC52.jsView file

155contains invisible/control Unicode U+FEFF (zero width no-break space) `,this.pos),this.lineEndPos=e),e===-1?this.atEnd?this.buffer.substring(this.pos):null:(this.buffer[e-1]===`\r`&&--e,this.buffer.substring(this.pos,e))}hasChars(e){return this.pos+e<=this.buffer.length}setNext(e){return this.buffer=this.buff

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/public/assets/dist-CWxNQtC52.jsView on unpkg · L155

dist/native/native-config.linux-arm64-musl.nodeView file

•path = dist/native/native-config.linux-arm64-musl.node kind = native_binary sizeBytes = 797800 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/native-config.linux-arm64-musl.nodeView on unpkg

dist/awk2-BBAGSFUB-ClUuupKf.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 26

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/awk2-BBAGSFUB-ClUuupKf.mjs#virtual:normalized:round1View on unpkg

dist/chunk-4I5QYGJK-DDH8bQMO.mjsView file

•matchType = normalized_sha256 matchedPackage = @p4code/cli@0.4.12 matchedPath = dist/client/assets/chunk-4I5QYGJK-CYvb6li-.js matchedIdentity = npm:QHA0Y29kZS9jbGk:0.4.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High