registry / AI-agent capability abuse / @inkeep/open-knowledge / 0.63.5

@inkeep/open-knowledge@0.63.5

Local-first, agent-friendly Markdown knowledge base with a cross-platform CLI and web editor

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Source shows a knowledge-base CLI that writes editor MCP configs only when the user runs init, not during npm install, with no concrete hidden exfil sink. Opaque native binaries, incomplete AST coverage, and default-on MCP registration keep this as dual-use agent-config capability rather than a clean or blocking malware finding.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

The user runs the published open-knowledge or ok CLI init command (npm install does not run package scripts).

Impact

Editors such as Claude or Cursor may load this package's MCP server after init; remaining risk is consented-but-broad agent-config mutation and unreviewed native code, not a proven secret-theft chain.

Mechanism

user-invoked MCP editor-config writes plus opaque native helpers

AI rationale

Evidence

dist/init-wSrUXJrK.mjsdist/native/index.jsdist/index.mjs~/.claude.json~/.cursor/mcp.json.mcp.json.cursor/mcp.json

Decision evidence

public snapshot

AI called this Suspicious at 74.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

ok init defaults --mcp to true and is built to register this CLI as an MCP server in editors.
Init can write user-level ~/.claude.json and ~/.cursor/mcp.json plus matching project files; non-TTY runs skip the scope prompt.
Native NAPI-RS helpers export upsertMcpServer/removeMcpServer for MCP TOML edits, and the shipped .node binaries are not reviewable as source.
Bundled just-bash code throws on eval rather than executing it, but minified dist plus incomplete AST coverage leave dual-use interpreters incompletely traced.
Embeddings API keys stored via ok embeddings set-key are sent to whichever OpenAI-compatible base URL the project config names.
package.json exposes open-knowledge/ok bins and has no preinstall, install, or postinstall scripts.

Evidence against

npm install does not run this package's scripts; MCP and editor writes require a later CLI command.
--no-mcp skips editor config mutation, and a TTY prompt can limit user versus project scope.
GitHub device-flow and git-credential code talks to api.github.com or a named GitHub Enterprise host, not an unrelated sink.
Similarity-flagged files include mermaid treemap rendering, the marked parser, and the octokit request client.

Source & flagged code

27 flagged

dist/public/assets/chunk-ZUYEQ4TG-Z9Kr3Qsb.jsView file

1patternName = google_api_key severity = high line = 1

High

High Secret

Package contains a high-severity secret pattern.

dist/public/assets/chunk-ZUYEQ4TG-Z9Kr3Qsb.jsView on unpkg · L1

1patternName = google_api_key severity = high line = 1

High

Secret Pattern

Google API key in dist/public/assets/chunk-ZUYEQ4TG-Z9Kr3Qsb.js

dist/public/assets/chunk-ZUYEQ4TG-Z9Kr3Qsb.jsView on unpkg · L1

dist/init-wSrUXJrK.mjsView file

1import{i as e,o as t,t as n}from"./chunk-DTipWd-i.mjs";import{pt as r}from"./sleep-D4NlDISj.mjs";import{Fs as i,ec as a,fs as o,ot as s,rt as c}from"./src-Bt6_UxL9.mjs";import{Ai a... L2: `),u=!1;for(let e=0;e<l.length;e++){let t=l[e];if(r+=t,u)u=!1;else if(u=t>=`\ud800`&&t<=`\udbff`,u)continue;if(t===`\x1B`||t===``){zt.lastIndex=e+1;let t=zt.exec(l)?.groups;if(t?....

High

Child Process

Package source references child process execution.

dist/init-wSrUXJrK.mjsView on unpkg · L1

635`)}function Ji(e,t){return{projectRoot:e.projectRoot,gitRootPromoted:e.gitRootPromoted,promotedFromDir:e.promotedFromDir??null,contentDir:t.contentDir,contentDirRequested:e.content... L636: `),e.stderr&&process.stderr.write(`${e.stderr.trim()}\n`),process.exitCode=1;return}throw e}let i=r.contentDir??`.`,a=null,{loadConfig:o}=await import(`./loader-DemlsGk6.mjs`),{res... L637: `))n.push(t.length>0?` ${t}`:``);return n.push(` Re-run ${O(`ok config-sharing unshare`)} after resolving to complete the switch.`),n;case`no-exclude`:if(e.localOnlyRequested)n.p...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/init-wSrUXJrK.mjsView on unpkg · L635

dist/index.mjsView file

1import{a as e,i as t,n,r,t as i}from"./chunk-DHbaKqs-.mjs";import"./libesm-qUf-Au5c.mjs";import{t as a}from"./yazl-BlMyAOcT.mjs";import"./chunk-B74TABJS-BJwhrR8a.mjs";import"./chun... L2: `)){let e=r.replace(Ye,``),i=Ke.exec(e)?.[1];if(i){n={login:i,active:!1},t.push(n);continue}if(qe.test(e)){n=void 0;continue}n&&Je.test(e)&&(n.active=!0)}return t}var Ze=i((e=>{let... ... L82: `:` L83: `)+(a.substring(1)||` `),n=!0,r=!1;break;case`%`:e[i+1]?.[0]!==`#`&&(i+=1),n=!1;break;default:n||(r=!0),n=!1}}return{comment:t,afterEmptyLine:r}}e.Composer=class{constructor(e={}){... L84: `}];switch(c[0]){case`|`:case`>`:{let e=c.indexOf(` ... L115: `)+1;for(;e!==0;)this.onNewLine(this.offset+e),e=this.source.indexOf(` L116: `,e)+1}return{type:e,offset:this.offset,indent:this.indent,source:this.source}

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.mjsView on unpkg · L1

1Trigger-reachable chain: manifest.exports -> dist/index.mjs L1: import{a as e,i as t,n,r,t as i}from"./chunk-DHbaKqs-.mjs";import"./libesm-qUf-Au5c.mjs";import{t as a}from"./yazl-BlMyAOcT.mjs";import"./chunk-B74TABJS-BJwhrR8a.mjs";import"./chun... L2: `)){let e=r.replace(Ye,``),i=Ke.exec(e)?.[1];if(i){n={login:i,active:!1},t.push(n);continue}if(qe.test(e)){n=void 0;continue}n&&Je.test(e)&&(n.active=!0)}return t}var Ze=i((e=>{let... ... L82: `:` L83: `)+(a.substring(1)||` `),n=!0,r=!1;break;case`%`:e[i+1]?.[0]!==`#`&&(i+=1),n=!1;break;default:n||(r=!0),n=!1}}return{comment:t,afterEmptyLine:r}}e.Composer=class{constructor(e={}){... L84: `}];switch(c[0]){case`|`:case`>`:{let e=c.indexOf(` ... L115: `)+1;for(;e!==0;)this.onNewLine(this.offset+e),e=this.source.indexOf(` L116: `,e)+1}return{type

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.mjsView on unpkg · L1

dist/chunk-5QMZ5MUS-C5NTf5Rj.mjs#virtual:string-array:round1View file

1import{t as e}from"./chunk-DXB73IDG-BBwE27jK.mjs";function t(){let e=[{prop:`Function`,target:globalThis,violationType:`function_constructor`,strategy:`throw`,reason:`Function cons... L2: `);n.register(`data:text/javascript,${encodeURIComponent(e)}`),i.importHooksRegistered=!0}}catch(e){console.debug(`[DefenseInDepthBox] Could not register import() hooks:`,e instanc...

High

Eval

Package source references dynamic code evaluation.

dist/chunk-5QMZ5MUS-C5NTf5Rj.mjs#virtual:string-array:round1View on unpkg · L1

dist/lib-B82GtN9K.mjsView file

1import{o as e,t}from"./chunk-DTipWd-i.mjs";import{n}from"./wrapper-BR9ZCXZF.mjs";import{Blob as r,Buffer as i}from"buffer";import{TextDecoder as a,TextEncoder as o}from"util";impor... L2: `+t+`at`)}else typeof r==`object`&&r.message&&r.stack?n+=r.stack.replace(/\n at/gm,` ... L38: Y3FblSokcA== L39: -----END CERTIFICATE-----`,key:`-----BEGIN PRIVATE KEY----- L40: [redacted] ... L67: \r L68: `);var qu=class e{reject=null;resolve=null;listeners={onSignalAbort:this.onSignalAbort.bind(this)};isChunkedTransfer=!1;isProperLastChunkReceived=!1;previousChunk=null;nodeRequest=... L69: ... L71: `),o+=a,i&&!i.disableErrorCapturing&&i.errorCapture===Ls.tryAndCatch&&(o+=`} catch(e) { $happy_dom.dispatchError(e); }`),o+=`})`;let s=null;try{s=r[Fe](o,{filename:r.location.href}... L72: `);let o=a;s

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/lib-B82GtN9K.mjsView on unpkg · L1

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/lib-B82GtN9K.mjsView on unpkg · L1

dist/src-C7IJWx9K.mjsView file

1import{o as e}from"./chunk-DTipWd-i.mjs";import{K as t,pt as n,q as r}from"./sleep-D4NlDISj.mjs";import{Ac as i,Co as a,Fc as o,Ic as s,jc as c,lt as l,ut as u}from"./src-Bt6_UxL9.... L2: `);_.addBuffer(Buffer.from(E,`utf8`),`README.md`),_.end();let D=he(r);return _.outputStream.pipe(D),await new Promise((e,t)=>{D.on(`close`,e),D.on(`error`,t)}),a?.info({bundlePath:... L3: `),i=n.split(` ... L7: `)?` L8: `:``;V(e,`${JSON.stringify(r,null,2)}${i}`)}catch{let r=et(n,t.contentDir);r!==n&&V(e,r)}}function it(e,t){let n=z(e,`utf-8`),r=et(n,t.contentDir);r!==n&&V(e,r)}function at(e){try{... L9: `)}\n`:null}catch{return null}}function At(e){let t=F(e,`.git`,`ok`);if(!L(t))return null;let n=de(`git`,[`-C`,t,`log`,`--oneline`,`-50`],d({encoding:`utf-8`,timeout:2e3}));return ...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src-C7IJWx9K.mjsView on unpkg · L1

dist/cli.mjsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: import{o as e}from"./chunk-DTipWd-i.mjs";import{At as t,Ct as n,E as r,It as i,M as a,Mt as o,St as s,T as c,Ut as l,_t as u,a as d,c as f,jt as p,kt as m,nn as h,p as g,pt as _,xt... `)){let e=n.trim();if(e===``)continue;let r=e.indexOf(`=`);r!==-1&&(t[e.slice(0,r)]=e.slice(r+1))}return t}function Qr(e){return new Promise((t,n)=>{let r=[];e.on(`data`,e=>r.push(... `)}var ji=class extends Error{constructor(e,t,n){super(Ai(n)),this.request=e,this.headers=t,this.response=n,this.errors=n.errors,this.data=n.data,Error.captureStackTrace&&Error.cap... `),process.exit(1));let o=r===`github.com`?void 0:`https://${r}/api/v3`,s=new

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.mjsView on unpkg

dist/public/assets/dist-Ce8QgKUj2.jsView file

155contains invisible/control Unicode U+FEFF (zero width no-break space) `,this.pos),this.lineEndPos=e),e===-1?this.atEnd?this.buffer.substring(this.pos):null:(this.buffer[e-1]===`\r`&&--e,this.buffer.substring(this.pos,e))}hasChars(e){return this.pos+e<=this.buffer.length}setNext(e){return this.buffer=this.buff

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/public/assets/dist-Ce8QgKUj2.jsView on unpkg · L155

dist/native/native-config.linux-arm64-musl.nodeView file

•path = dist/native/native-config.linux-arm64-musl.node kind = native_binary sizeBytes = 797800 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/native-config.linux-arm64-musl.nodeView on unpkg

dist/awk2-BBAGSFUB-ClUuupKf.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 27

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/awk2-BBAGSFUB-ClUuupKf.mjs#virtual:normalized:round1View on unpkg

dist/native/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @inkeep/open-knowledge@0.76.1 matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.76.1 similarity = 0.508 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/native/index.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @inkeep/open-knowledge@0.31.0 matchedPath = dist/native/index.js matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.31.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High