registry / AI-agent capability abuse / @inkeep/open-knowledge / 0.63.3

@inkeep/open-knowledge@0.63.3

Local-first, agent-friendly Markdown knowledge base with a cross-platform CLI and web editor

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The static malicious label is unsupported by the inspected source: no lifecycle hook or covert exfiltration chain was found. The explicit agent-configuration capability warrants a warning under the firewall policy.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

User runs `ok init` and selects or permits MCP/skill setup.

Impact

Configured agents may receive OpenKnowledge tools with project content access.

Mechanism

User-invoked MCP and agent-extension configuration.

AI rationale

Evidence

package.jsondist/cli.mjsdist/init-BLfb1sRA.mjsdist/acp-harness-probe-BRVdx2Mx.mjsdist/native/index.js~/.claude.json~/.cursor/mcp.json.mcp.json.cursor/mcp.json.ok/

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`ok init` configures user- and project-level MCP surfaces.
It generates a managed Pi bridge that spawns its MCP server.
Init writes editor config entries and may install project skills.

Evidence against

package.json has CLI bins but no preinstall/install/postinstall hook.
Agent configuration is an explicit CLI-init feature with scope selection.
No source evidence of secret exfiltration, remote payload loading, or stealth install-time execution.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareTelemetryUrlStrings

Manifest

Source & flagged code

20 flagged

dist/lib-B82GtN9K.mjsView file

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib-B82GtN9K.mjsView on unpkg · L39

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Secret Pattern

RSA private key in dist/lib-B82GtN9K.mjs

dist/lib-B82GtN9K.mjsView on unpkg · L39

1import{o as e,t}from"./chunk-DTipWd-i.mjs";import{n}from"./wrapper-BR9ZCXZF.mjs";import{Blob as r,Buffer as i}from"buffer";import{TextDecoder as a,TextEncoder as o}from"util";impor... L2: `+t+`at`)}else typeof r==`object`&&r.message&&r.stack?n+=r.stack.replace(/\n at/gm,` ... L38: Y3FblSokcA== L39: -----END CERTIFICATE-----`,key:`-----BEGIN PRIVATE KEY----- L40: [redacted] ... L67: \r L68: `);var qu=class e{reject=null;resolve=null;listeners={onSignalAbort:this.onSignalAbort.bind(this)};isChunkedTransfer=!1;isProperLastChunkReceived=!1;previousChunk=null;nodeRequest=... L69: ... L71: `),o+=a,i&&!i.disableErrorCapturing&&i.errorCapture===Ls.tryAndCatch&&(o+=`} catch(e) { $happy_dom.dispatchError(e); }`),o+=`})`;let s=null;try{s=r[Fe](o,{filename:r.location.href}... L72: `);let o=a;s

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/lib-B82GtN9K.mjsView on unpkg · L1

dist/acp-harness-probe-BRVdx2Mx.mjsView file

1import{pt as e}from"./sleep-D4NlDISj.mjs";import{Ri as t}from"./src-yn8SArMz.mjs";import{F as n,M as r,N as i}from"./fs-traced-Dm4NQ6S5.mjs";import{b as a,g as o,m as s,p as c,s as... L2: `),T(()=>t?.onBackendSelected?.({backend:`keyring`})),new ce(new E(t?.onKeychainRead),new D(e))}catch(n){let r=n instanceof Error?`${n.name}: ${n.message}`:String(n);return process...

High

Child Process

Package source references child process execution.

dist/acp-harness-probe-BRVdx2Mx.mjsView on unpkg · L1

dist/src-yn8SArMz.mjsView file

24`).map(e=>e.trim()).find(e=>e!==``),r=t??`exit code ${e}`;d(n===void 0?r:`${r}: ${n.slice(0,300)}`)})})}function bue(e,t=5e3,n){let r=process.platform===`win32`,i=Cue(e);return new... L25: `).map(e=>e.trim()).find(e=>e!==``),r=t??`exit code ${e}`;u(n===void 0?`Node.js version probe failed with ${r}`:`Node.js version probe failed with ${r}: ${n.slice(0,300)}`);return}... L26: `)}\n`;this.enqueue(e,async()=>{if(!this.appendBroken.has(e))try{await Ks(this.eventsPath(e),n)}catch(t){this.appendBroken.add(e),this.log.error({err:t,threadId:e},`[acp-persist] e...

High

Shell

Package source references shell execution.

dist/src-yn8SArMz.mjsView on unpkg · L24

1import{i as e,o as t,t as n}from"./chunk-DTipWd-i.mjs";import{$t as r,A as i,At as a,B as o,Bt as s,C as c,Ct as l,Dt as u,Et as d,F as f,Ft as p,Gt as m,H as h,Ht as g,I as _,It a... L2: `)){let e=n.trim();if(e.startsWith(`ok-contributors: `))try{let n=JSON.parse(e.slice(17));if(typeof n==`object`&&n&&`id`in n&&typeof n.id==`string`&&`name`in n&&typeof n.name==`str... L3: `)){let e=t.trim();if(!e.startsWith(Ud))continue;let n;try{n=JSON.parse(e.slice(10))}catch{return null}return typeof n!=`object`||!n?null:Gd(n)}return null}function Kd(e){if(!e)ret... L4: `)){let e=n.trim();if(!e.startsWith(Ud))continue;let r;try{r=JSON.parse(e.slice(10))}catch{continue}if(typeof r!=`object`||!r)continue;let i=Gd(r);i&&t.push(i)}return t}function an... L5: `,i=e.getWriter();try{await i.write(n.encode

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src-yn8SArMz.mjsView on unpkg · L1

dist/chunk-5QMZ5MUS-C5NTf5Rj.mjsView file

1import{t as e}from"./chunk-DXB73IDG-BBwE27jK.mjs";function t(){let e=[{prop:`Function`,target:globalThis,violationType:`function_constructor`,strategy:`throw`,reason:`Function cons... L2:

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-5QMZ5MUS-C5NTf5Rj.mjsView on unpkg · L1

dist/public/assets/dist-Ce8QgKUj2.jsView file

155contains invisible/control Unicode U+FEFF (zero width no-break space) `,this.pos),this.lineEndPos=e),e===-1?this.atEnd?this.buffer.substring(this.pos):null:(this.buffer[e-1]===`\r`&&--e,this.buffer.substring(this.pos,e))}hasChars(e){return this.pos+e<=this.buffer.length}setNext(e){return this.buffer=this.buff

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/public/assets/dist-Ce8QgKUj2.jsView on unpkg · L155

dist/native/native-config.linux-arm64-musl.nodeView file

•path = dist/native/native-config.linux-arm64-musl.node kind = native_binary sizeBytes = 797800 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/native-config.linux-arm64-musl.nodeView on unpkg

dist/dist-bundle-EXrl9_Zm.mjsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/dist-bundle-EXrl9_Zm.mjsView on unpkg

•matchType = normalized_sha256 matchedPackage = @inkeep/open-knowledge@0.36.0 matchedPath = dist/dist-bundle-GEZgvZIe.mjs matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.36.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High