registry / @inkeep/open-knowledge / 0.70.3

@inkeep/open-knowledge@0.70.3

Local-first, agent-friendly Markdown knowledge base with a cross-platform CLI and web editor

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No concrete malicious behavior was established by source inspection, but the runtime npx bootstrap is a real unresolved lifecycle risk. The static credential, network, native-loader, and dynamic-evaluation signals are otherwise consistent with CLI functionality and bundled dependencies.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

First contact with the shipped MCP client.

Impact

A later package release could execute in the user's environment through that runtime dependency path.

Mechanism

Runtime npx installation of the CLI.

AI rationale

Evidence

dist/index.mjs

Decision evidence

public snapshot

AI called this Suspicious at 76.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The shipped MCP client source allows a first-contact npx installation, creating a runtime supply-chain execution path.

Evidence against

package.json has no preinstall, install, postinstall, or prepare lifecycle hook.
The manifest exposes a CLI and library entrypoint; inspected credential and network code is tied to explicit GitHub authentication commands.
The native loader selects platform bindings and uses ldd only to detect musl.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareTelemetryUrlStrings

Manifest

Source & flagged code

21 flagged

dist/lib-CLRUBb2o.mjsView file

39patternName = private_key_rsa severity = critical line = 39

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib-CLRUBb2o.mjsView on unpkg · L39

39patternName = private_key_rsa severity = critical line = 39

Critical

Secret Pattern

RSA private key in dist/lib-CLRUBb2o.mjs

dist/lib-CLRUBb2o.mjsView on unpkg · L39

dist/js-exec-VXN6TZ7U-Z8_USGOo.mjsView file

28Available modules: L29: fs, path, child_process, process, console, L30: os, url, assert, util, events, buffer, stream,

High

Child Process

Package source references child process execution.

dist/js-exec-VXN6TZ7U-Z8_USGOo.mjsView on unpkg · L28

dist/init-Dl36o0mH.mjsView file

12Expecting one of '${n.join(`', '`)}'`);return this._lifeCycleHooks[e]?this._lifeCycleHooks[e].push(t):this._lifeCycleHooks[e]=[t],this}exitOverride(e){return this._exitCallback=e||... L13: - already used by option '${t.flags}'`)}this._initOptionGroup(e),this.options.push(e)}_registerCommand(e){let t=e=>[e.name()].concat(e.aliases()),n=t(e).find(e=>this._findCommand(... L14: - either make a new Command for each call to parse, or stop storing options as properties`);this._name=this._savedState._name,this._scriptPath=null,this.rawArgs=[],this._optionValu...

High

Shell

Package source references shell execution.

dist/init-Dl36o0mH.mjsView on unpkg · L12

dist/chunk-5QMZ5MUS-B37CnsNb.mjsView file

1import{t as e}from"./chunk-DXB73IDG-MLBj3lvC.mjs";function t(){let e=[{prop:`Function`,target:globalThis,violationType:`function_constructor`,strategy:`throw`,reason:`Function cons... L2:

High

Eval

Package source references dynamic code evaluation.

dist/chunk-5QMZ5MUS-B37CnsNb.mjsView on unpkg · L1

2L3: This is a defense-in-depth measure and indicates a bug in just-bash. Please report this at security@vercel.com`,o=class extends Error{violation;constructor(e,t){super(e+a),this.vio... L4: `);n.register(`data:text/javascript,${encodeURIComponent(e)}`),i.importHooksRegistered=!0}}catch(e){console.debug(`[DefenseInDepthBox] Could not register import() hooks:`,e instanc...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-5QMZ5MUS-B37CnsNb.mjsView on unpkg · L2

dist/src-DmZyPc_9.mjsView file

1import{o as e}from"./rolldown-runtime-tZXQYakl.mjs";import{$u as t,Bs as n,Dn as r,Gl as i,In as a,On as o,ac as s,ic as c,lo as l,ns as u,ps as ee,sc as te}from"./md-manager-BGnqy... L2: `);v.addBuffer(Buffer.from(M,`utf8`),`README.md`),v.end();let N=ue(r);return v.outputStream.pipe(N),await new Promise((e,t)=>{N.on(`close`,e),N.on(`error`,t)}),i?.info({bundlePath:... ... L7: `)?` L8: `:``;K(e,`${JSON.stringify(r,null,2)}${i}`)}catch{let r=yt(n,t.contentDir);r!==n&&K(e,r)}}function Ct(e,t){let n=U(e,`utf-8`),r=yt(n,t.contentDir);r!==n&&K(e,r)}function wt(e){try{... L9: `)}\n`:null}catch{return null}}function Xt(e){let t=L(e,`.git`,`ok`);if(!V(t))return null;let n=oe(`git`,[`-C`,t,`log`,`--oneline`,`-50`],E({encoding:`utf-8`,timeout:2e3}));return ...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src-DmZyPc_9.mjsView on unpkg · L1

dist/index.mjsView file

1import{a as e,i as t,n,r,t as i}from"./rolldown-runtime-DPpTSio4.mjs";import"./libesm-CSMdpGMF.mjs";import"./chunk-B74TABJS-DAm9lxFL.mjs";import"./chunk-R6VWJ2ZL-Cu1kOJ3f.mjs";impo... L2: `)){let e=r.replace(Ye,``),i=Ke.exec(e)?.[1];if(i){n={login:i,active:!1},t.push(n);continue}if(qe.test(e)){n=void 0;continue}n&&Je.test(e)&&(n.active=!0)}return t}var Ze=i((e=>{let... ... L82: `:` L83: `)+(a.substring(1)||` `),n=!0,r=!1;break;case`%`:e[i+1]?.[0]!==`#`&&(i+=1),n=!1;break;default:n||(r=!0),n=!1}}return{comment:t,afterEmptyLine:r}}e.Composer=class{constructor(e={}){... L84: `}];switch(c[0]){case`|`:case`>`:{let e=c.indexOf(` ... L115: `)+1;for(;e!==0;)this.onNewLine(this.offset+e),e=this.source.indexOf(` L116: `,e)+1}return{type:e,offset:this.offset,indent:this.indent,source:this.source}

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.mjsView on unpkg · L1

1Trigger-reachable chain: manifest.exports -> dist/index.mjs L1: import{a as e,i as t,n,r,t as i}from"./rolldown-runtime-DPpTSio4.mjs";import"./libesm-CSMdpGMF.mjs";import"./chunk-B74TABJS-DAm9lxFL.mjs";import"./chunk-R6VWJ2ZL-Cu1kOJ3f.mjs";impo... L2: `)){let e=r.replace(Ye,``),i=Ke.exec(e)?.[1];if(i){n={login:i,active:!1},t.push(n);continue}if(qe.test(e)){n=void 0;continue}n&&Je.test(e)&&(n.active=!0)}return t}var Ze=i((e=>{let... ... L82: `:` L83: `)+(a.substring(1)||` `),n=!0,r=!1;break;case`%`:e[i+1]?.[0]!==`#`&&(i+=1),n=!1;break;default:n||(r=!0),n=!1}}return{comment:t,afterEmptyLine:r}}e.Composer=class{constructor(e={}){... L84: `}];switch(c[0]){case`|`:case`>`:{let e=c.indexOf(` ... L115: `)+1;for(;e!==0;)this.onNewLine(this.offset+e),e=this.source.indexOf(` L116: `,e)+1}return{type

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.mjsView on unpkg · L1

dist/cli.mjsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: import{o as e}from"./rolldown-runtime-tZXQYakl.mjs";import{$u as t,Bu as n,Ft as r,Gl as i,Gs as a,Hn as o,Io as s,Ju as c,Kc as l,Ks as u,La as d,Nc as f,Ou as p,Ps as m,Qo as h,T... `)){let e=n.trim();if(e===``)continue;let r=e.indexOf(`=`);r!==-1&&(t[e.slice(0,r)]=e.slice(r+1))}return t}function bi(e){return new Promise((t,n)=>{let r=[];e.on(`data`,e=>r.push(... `)}var ea=class extends Error{constructor(e,t,n){super($i(n)),this.request=e,this.headers=t,this.response=n,this.errors=n.errors,this.data=n.data,Error.captureStackTrace&&Error.cap... `),process.exit(1));let o=r===`github.com`?void 0:`https://${r}/api/v3`,s=new

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.mjsView on unpkg

dist/dist-BfGPmTI1.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @inkeep/open-knowledge@0.70.4 matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.70.4 similarity = 0.992 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/dist-BfGPmTI1.mjsView on unpkg

20*/ L21: var t=null;try{t=new WebAssembly.Instance(new WebAssembly.Module(new Uint8Array([0,97,115,109,1,0,0,0,1,13,2,96,0,1,127,96,4,127,127,127,127,1,127,3,7,6,0,1,1,1,1,1,6,6,1,127,1,65,... L22: changing to the minimum size of: 2`),this._maxSize=2)}record(e){this.updateByIncrement(e,1)}setStartTime(e){this.startTime=e}toPointValue(){return{hasMinMax:this._recordMinMax,min:... L23: \t- OR - create a new view with the name ${e.name} and description '${e.description}' and InstrumentSelector ${r} ... L31: causes have become circular...`;let o=r(e);return o?(t.add(e),a+` L32: caused by: `+i(o,t)):a},a=e=>i(e,new Set),o=(e,t,i)=>{if(!n(e))return``;let a=i?``:e.message||``;if(t.has(e))return a+`: ...`;let s=r(e);if(s){t.add(e);let n=typeof e.cause==`funct... L33: `:`

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/dist-BfGPmTI1.mjsView on unpkg · L20

1Cross-file remote execution chain: dist/dist-BfGPmTI1.mjs spawns dist/chunk-5QMZ5MUS-BuB3i_B5.mjs; helper contains network access plus dynamic code execution. L1: import{a as e,i as t,n,o as r,r as i,t as a}from"./rolldown-runtime-tZXQYakl.mjs";import{$ as o,$a as s,$c as c,$i as l,$l as u,$n as d,$o as f,$r as p,$s as m,$t as h,$u as g,A as... L2: /** ... L10: * L11: * http://www.apache.org/licenses/LICENSE-2.0 L12: * ... L21: var t=null;try{t=new WebAssembly.Instance(new WebAssembly.Module(new Uint8Array([0,97,115,109,1,0,0,0,1,13,2,96,0,1,127,96,4,127,127,127,127,1,127,3,7,6,0,1,1,1,1,1,6,6,1,127,1,65,... L22: changing to the minimum size of: 2`),this._maxSize=2)}record(e){this.updateByIncrement(e,1)}setStartTime(e){this.startTime=e}toPointValue(){return{hasMinMax:this._recordMinMax

dist/public/assets/he-IL-ZX43XLGP-KskW1AnW.jsView file

4contains invisible/control Unicode U+200F (right-to-left mark) השינויים שלך לא ישמרו!`,localStorageQuotaExceeded:`הגעת למכסת השימוש בזיכרון הדפדפן. השינויים לא יישמרו.`},o={unsupportedFileType:`סוג הקובץ אינו נתמך.`,imageInsertError:`לא ניתן היה להוסיף את התמונה. אנא נסה שוב מאוחר יותר...`,fileTooBig:`

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/public/assets/he-IL-ZX43XLGP-KskW1AnW.jsView on unpkg · L4

dist/native/native-config.linux-arm64-musl.nodeView file

•path = dist/native/native-config.linux-arm64-musl.node kind = native_binary sizeBytes = 800640 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/native-config.linux-arm64-musl.nodeView on unpkg

dist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 28

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:normalized:round1View on unpkg

dist/native/index.jsView file

•matchType = token_shingles matchedPackage = @inkeep/open-knowledge@0.31.0 matchedPath = dist/native/index.js matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.31.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/native/index.jsView on unpkg

dist/diagram-Q27KOJAE-7KO1ITMW.mjsView file

•matchType = token_shingles matchedPackage = @p4code/cli@0.4.6 matchedPath = dist/client/assets/diagram-Q27KOJAE-Dp_H6G_V.js matchedIdentity = npm:QHA0Y29kZS9jbGk:0.4.6 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/diagram-Q27KOJAE-7KO1ITMW.mjsView on unpkg

dist/public/assets/chunk-A66AFZZU-BMhkYg5H.jsView file

1patternName = google_api_key severity = high line = 1

High

Secret Pattern

Google API key in dist/public/assets/chunk-A66AFZZU-BMhkYg5H.js

dist/public/assets/chunk-A66AFZZU-BMhkYg5H.jsView on unpkg · L1

Source & flagged code

21 flagged · loading source

dist/lib-CLRUBb2o.mjsView file

39patternName = private_key_rsa severity = critical line = 39

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib-CLRUBb2o.mjsView on unpkg · L39

39patternName = private_key_rsa severity = critical line = 39

Critical

Secret Pattern

RSA private key in dist/lib-CLRUBb2o.mjs

dist/lib-CLRUBb2o.mjsView on unpkg · L39

dist/js-exec-VXN6TZ7U-Z8_USGOo.mjsView file

28Available modules: L29: fs, path, child_process, process, console, L30: os, url, assert, util, events, buffer, stream,

High

Child Process

Package source references child process execution.

dist/js-exec-VXN6TZ7U-Z8_USGOo.mjsView on unpkg · L28

Findings

6 Critical13 High6 Medium6 Low

CriticalCritical Secretdist/lib-CLRUBb2o.mjs

CriticalCredential Exfiltrationdist/index.mjs

CriticalTrojan Source Unicodedist/public/assets/he-IL-ZX43XLGP-KskW1AnW.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.mjs

CriticalPrevious Version Dangerous Deltadist/dist-BfGPmTI1.mjs

CriticalSecret Patterndist/lib-CLRUBb2o.mjs

HighChild Processdist/js-exec-VXN6TZ7U-Z8_USGOo.mjs

HighShelldist/init-Dl36o0mH.mjs

HighEvaldist/chunk-5QMZ5MUS-B37CnsNb.mjs

HighSame File Env Network Executiondist/src-DmZyPc_9.mjs

HighCredential Redirect Persistencedist/cli.mjs

Affected versions and remediation

This report applies to @inkeep/open-knowledge@0.70.3.

See all versions of @inkeep/open-knowledge for other recorded verdicts.

Review the evidence and your use of @inkeep/open-knowledge@0.70.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-10 02:42:53.340Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code