registry / @inkeep/open-knowledge / 0.75.0

@inkeep/open-knowledge@0.75.0

Local-first, agent-friendly Markdown knowledge base with a cross-platform CLI and web editor

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No malicious install hook or confirmed exfiltration was found. Automatic user-global AI-agent skill replacement on ok start warrants a warning as a first-party extension lifecycle risk.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A user runs the ok start command.

Impact

The package can alter AI-agent skill content outside the current project after a user starts the CLI.

Mechanism

Automatic AI-editor skill installation and replacement.

AI rationale

No malicious install hook or confirmed exfiltration was found. Automatic user-global AI-agent skill replacement on ok start warrants a warning as a first-party extension lifecycle risk.

Evidence

dist/cli.mjsdist/dist-CwMAFvDv.mjs.ok/skill-install-events.jsonl

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The CLI automatically refreshes bundled skills for detected AI editors when the user runs ok start, including user-global targets.
The bundled installer removes and recursively replaces skill directories, creating an agent-extension lifecycle risk.

Evidence against

package.json has no npm preinstall, install, or postinstall hook.
The inspected network calls target a local 127.0.0.1 service; no credential exfiltration endpoint was confirmed.
The native loader and large generated chunks appear to be standard platform-loading and bundled application code.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

Source & flagged code

20 flagged

dist/lib-CLRUBb2o.mjsView file

39patternName = private_key_rsa severity = critical line = 39

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib-CLRUBb2o.mjsView on unpkg · L39

39patternName = private_key_rsa severity = critical line = 39

Critical

Secret Pattern

RSA private key in dist/lib-CLRUBb2o.mjs

dist/lib-CLRUBb2o.mjsView on unpkg · L39

dist/registry-probes-CExYC4JQ.mjsView file

Lines 1-17javascript

1import{i as e,o as t,t as n}from"./rolldown-runtime-tZXQYakl.mjs";import{Ad as r,Hu as i,Id as a,Md as o,Nd as s,Nl as c,Pd as l,ju as u}from"./md-manager-BGnqyqi1-Bwg54lLG.mjs";import{Cn as d,Eo as f,In as p,Ki as m,Mo as h,Zn as g,_o as _,jo as v,m as y,no as ee}from"./dist-CwMAFvDv.mjs";import{A as b,L as te,M as x,N as S,O as C,Q as ne,T as re,Y as w,ct as ie,d as ae,et as oe,f as se,it as ce,j as le,k as ue,nt as de,o as fe,q as pe,rt as me,st as he,tt as ge,ut as _e,v as ve,w as ye,x as be,y as xe}from"./init-DLDxilxo.mjs";import{t as Se}from"./is-object-BGze3w87.mjs";import{t as Ce}from ...

2`),B(()=>t?.onBackendSelected?.({backend:`keyring`})),new ze(new Re(t?.onKeychainRead),new V(e))}catch(n){let r=n instanceof Error?`${n.name}: ${n.message}`:String(n);return process.stderr.write(`[auth] token storage: file (~/.ok/auth.yml) — OS keychain unavailable: ${r}\n`),B(()=>t?.onBackendSelected?.({backend:`file`,reason:r})),new V(e)}}function Ve(e){let t=null;return function(){if(t)return t;let n=2e3;return t=(async()=>{let t=null,r=new Promise(r=>{t=setTimeout(()=>{process.stderr.write(`[auth] token storage: keyring init exceeded ${n}ms; falling back to file (~/.ok/auth.yml)\

3GFS4: `),console.error(e)}),r[c]||(d(r,global[c]||[]),r.close=(function(e){function t(t,n){return e.call(r,t,function(e){e||g(),typeof

4`)}:{state:`unreadable`,reason:`invalid-json`}}function Gt(e){switch(e){case`invalid-json`:return`the file is not a valid JSON object; repair its JSON, then retry`;case`path-changed`:return`the path changed while waiting for its lock; retry to check its current state`;case`unavailable-root`:return`the filesystem root is unavailable; reconnect the drive or network share, then retry`;default:return le(e)}}function Z(e,t){return{kind:`

5`:``),p=C(s.path);f(s.path,d,p===void 0?void 0:{mode:p}),$(n,()=>_t(n,l)),a.action=`added`})}catch(e){return{action:`failed`,error:H(e instanceof Error

6`)}:n.detail===void 0?n:{...n,detail:i.join(`

7`)}}function $t(e,t,n,r={}){let i=Vt(e,t,n),a=t??L(),o=X(i.cwd),s=o.kind===`refused`&&r.recordedOnly?Zt

8`)}}let u=Bt(o.project.canonical,a,w.pi.projectConfigPath(o.project.canonical));if(u.kind===`unreadable`)return{action:`kept-unverified`,error:u.error};let d=u.kind===`shared`?u.paths:[],f=[],p=new Map,m=(e,t)=>{

9`:``),m=C(r);f(r,p,m===void 0?void 0:{mode:m}),i.entries=d,$(t,()=>J(t,l)),s.result={action:`removed`}}function

10`)?c.endsWith(`

11`)||(c=`${c}\n`):c=c.replace(/\n+$/,``),l&&(c=c.replace(/\r\n/g,`

12`).replace(/\n/g,`\r

13`));let u=`${i?``:``}${c}`;return u!==r&&f(e,u,{mode:C(e)}),{kind:`removed`}}function un(e,t){let n=

14`),c;try{c=n.removeEntry(a,t)}catch{return{kind:`declined`,reason:`unparseable`}}if(!c.existed)return{kind:`not-present`};let l=c.text;s?l.endsWith(`

15`)||(l=`${l}\n`):l=l.replace(/\n+$/,``),o&&(l=l.replace(/\r\n/g,`

16`).replace(/\n/g,`\r

17`));let u=`${i?``:``}${l}`;return u!==r&&f(e,u,{mode:C(e)}),{kind:`removed`}}function dn(e,t){let n=

Long lines were clipped for display.

dist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:string-array:round1View file

1import{t as e}from"./chunk-DXB73IDG-MLBj3lvC.mjs";function t(){let e=[{prop:`Function`,target:globalThis,violationType:`function_constructor`,strategy:`throw`,reason:`Function cons... L2: `);n.register(`data:text/javascript,${encodeURIComponent(e)}`),i.importHooksRegistered=!0}}catch(e){console.debug(`[DefenseInDepthBox] Could not register import() hooks:`,e instanc...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:string-array:round1View on unpkg · L1

dist/dist-CwMAFvDv.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @inkeep/open-knowledge@0.74.1 matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.74.1 similarity = 0.992 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/dist-CwMAFvDv.mjsView on unpkg

1import{a as e,i as t,n,o as r,r as i,t as a}from"./rolldown-runtime-tZXQYakl.mjs";import{$ as o,$a as s,$c as c,$i as l,$l as u,$n as d,$o as f,$r as p,$s as m,$t as h,$u as g,A as... L2: /** ... L10: * L11: * http://www.apache.org/licenses/LICENSE-2.0 L12: *

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/dist-CwMAFvDv.mjsView on unpkg · L1

20*/ L21: var t=null;try{t=new WebAssembly.Instance(new WebAssembly.Module(new Uint8Array([0,97,115,109,1,0,0,0,1,13,2,96,0,1,127,96,4,127,127,127,127,1,127,3,7,6,0,1,1,1,1,1,6,6,1,127,1,65,... L22: changing to the minimum size of: 2`),this._maxSize=2)}record(e){this.updateByIncrement(e,1)}setStartTime(e){this.startTime=e}toPointValue(){return{hasMinMax:this._recordMinMax,min:... L23: \t- OR - create a new view with the name ${e.name} and description '${e.description}' and InstrumentSelector ${r} ... L31: causes have become circular...`;let o=r(e);return o?(t.add(e),a+` L32: caused by: `+i(o,t)):a},a=e=>i(e,new Set),o=(e,t,i)=>{if(!n(e))return``;let a=i?``:e.message||``;if(t.has(e))return a+`: ...`;let s=r(e);if(s){t.add(e);let n=typeof e.cause==`funct... L33: `:`

dist/index.mjsView file

1import{a as e,i as t,n,r,t as i}from"./rolldown-runtime-DPpTSio4.mjs";import"./libesm-CSMdpGMF.mjs";import"./chunk-B74TABJS-DAm9lxFL.mjs";import"./chunk-R6VWJ2ZL-Cu1kOJ3f.mjs";impo... L2: `)){let e=r.replace($e,``),i=Xe.exec(e)?.[1];if(i){n={login:i,active:!1},t.push(n);continue}if(Ze.test(e)){n=void 0;continue}n&&Qe.test(e)&&(n.active=!0)}return t}var tt=i((e=>{let... ... L82: `:` L83: `)+(a.substring(1)||` `),n=!0,r=!1;break;case`%`:e[i+1]?.[0]!==`#`&&(i+=1),n=!1;break;default:n||(r=!0),n=!1}}return{comment:t,afterEmptyLine:r}}e.Composer=class{constructor(e={}){... L84: `}];switch(c[0]){case`|`:case`>`:{let e=c.indexOf(` ... L115: `)+1;for(;e!==0;)this.onNewLine(this.offset+e),e=this.source.indexOf(` L116: `,e)+1}return{type:e,offset:this.offset,indent:this.indent,source:this.source}

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.mjsView on unpkg · L1

1Trigger-reachable chain: manifest.exports -> dist/index.mjs L1: import{a as e,i as t,n,r,t as i}from"./rolldown-runtime-DPpTSio4.mjs";import"./libesm-CSMdpGMF.mjs";import"./chunk-B74TABJS-DAm9lxFL.mjs";import"./chunk-R6VWJ2ZL-Cu1kOJ3f.mjs";impo... L2: `)){let e=r.replace($e,``),i=Xe.exec(e)?.[1];if(i){n={login:i,active:!1},t.push(n);continue}if(Ze.test(e)){n=void 0;continue}n&&Qe.test(e)&&(n.active=!0)}return t}var tt=i((e=>{let... ... L82: `:` L83: `)+(a.substring(1)||` `),n=!0,r=!1;break;case`%`:e[i+1]?.[0]!==`#`&&(i+=1),n=!1;break;default:n||(r=!0),n=!1}}return{comment:t,afterEmptyLine:r}}e.Composer=class{constructor(e={}){... L84: `}];switch(c[0]){case`|`:case`>`:{let e=c.indexOf(` ... L115: `)+1;for(;e!==0;)this.onNewLine(this.offset+e),e=this.source.indexOf(` L116: `,e)+1}return{type

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.mjsView on unpkg · L1

dist/cli.mjsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: import{o as e}from"./rolldown-runtime-tZXQYakl.mjs";import{$a as t,Bo as n,Ec as r,Gu as i,Hd as a,Io as o,Iu as s,Kc as c,Ld as l,Ma as u,Ml as d,Nd as f,Nl as p,Pa as m,Ps as h,Q... `)}const Ai={out:e=>process.stdout.write(`${e}\n`),err:e=>process.stderr.write(`${e}\n`)};function ji(e){return new A(`audit`).description(`Unified validation audit (markdown lint ... `)){let e=n.trim();if(e===``)continue;let r=e.indexOf(`=`);r!==-1&&(t[e.slice(0,r)]=e.slice(r+1))}return t}function Li(e){return new Promise((t,n)=>{let r=[];e.on(`data`,e=>r.push(... `)}var ga=class extends Error{constructor(e,t,n){super(ha(n)),this.request=e,

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.mjsView on unpkg

dist/public/assets/src-Ct05JYMM.jsView file

Lines 1-2javascript

1import{jt as e}from"./CodeMirrorPropInput-s4NvdTOo.js";import{B as t,C as n,H as r,P as i,V as a,b as o,et as s,p as c,tt as l,w as

dist/native/native-config.linux-arm64-musl.nodeView file

•path = dist/native/native-config.linux-arm64-musl.node kind = native_binary sizeBytes = 801864 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/native-config.linux-arm64-musl.nodeView on unpkg

dist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 30

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:normalized:round1View on unpkg

dist/native/index.jsView file

•matchType = token_shingles matchedPackage = @inkeep/open-knowledge@0.31.0 matchedPath = dist/native/index.js matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.31.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/native/index.jsView on unpkg

dist/chunk-WRU74C26-CKoV7Oqa.mjsView file

•matchType = normalized_sha256 matchedPackage = @p4code/cli@0.4.12 matchedPath = dist/client/assets/chunk-WRU74C26-C2Rb3ATV.js matchedIdentity = npm:QHA0Y29kZS9jbGk:0.4.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-WRU74C26-CKoV7Oqa.mjsView on unpkg

dist/diagram-Q27KOJAE-7KO1ITMW.mjsView file

•matchType = token_shingles matchedPackage = @p4code/cli@0.4.12 matchedPath = dist/client/assets/diagram-Q27KOJAE-Dp_H6G_V.js matchedIdentity = npm:QHA0Y29kZS9jbGk:0.4.12 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/diagram-Q27KOJAE-7KO1ITMW.mjsView on unpkg

dist/public/assets/chunk-A66AFZZU-BIdRzPTk.jsView file

1patternName = google_api_key severity = high line = 1

High

Secret Pattern

Google API key in dist/public/assets/chunk-A66AFZZU-BIdRzPTk.js

dist/public/assets/chunk-A66AFZZU-BIdRzPTk.jsView on unpkg · L1

Source & flagged code

20 flagged · loading source

dist/lib-CLRUBb2o.mjsView file

39patternName = private_key_rsa severity = critical line = 39

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib-CLRUBb2o.mjsView on unpkg · L39

39patternName = private_key_rsa severity = critical line = 39

Critical

Secret Pattern

RSA private key in dist/lib-CLRUBb2o.mjs

dist/lib-CLRUBb2o.mjsView on unpkg · L39

dist/registry-probes-CExYC4JQ.mjsView file

1import{i as e,o as t,t as n}from"./rolldown-runtime-tZXQYakl.mjs";import{Ad as r,Hu as i,Id as a,Md as o,Nd as s,Nl as c,Pd as l,ju as u}from"./md-manager-BGnqyqi1-Bwg54lLG.mjs";im... L2: `),B(()=>t?.onBackendSelected?.({backend:`keyring`})),new ze(new Re(t?.onKeychainRead),new V(e))}catch(n){let r=n instanceof Error?`${n.name}: ${n.message}`:String(n);return proces...

High

Findings

6 Critical13 High5 Medium6 Low

CriticalCritical Secretdist/lib-CLRUBb2o.mjs

CriticalCredential Exfiltrationdist/index.mjs

CriticalTrojan Source Unicodedist/public/assets/src-Ct05JYMM.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.mjs

CriticalPrevious Version Dangerous Deltadist/dist-CwMAFvDv.mjs

CriticalSecret Patterndist/lib-CLRUBb2o.mjs

HighChild Processdist/registry-probes-CExYC4JQ.mjs

HighShell

HighSame File Env Network Executiondist/dist-CwMAFvDv.mjs

HighCredential Redirect Persistencedist/cli.mjs

HighCommand Output Exfiltrationdist/dist-CwMAFvDv.mjs

High

Affected versions and remediation

This report applies to @inkeep/open-knowledge@0.75.0.

See all versions of @inkeep/open-knowledge for other recorded verdicts.

Review the evidence and your use of @inkeep/open-knowledge@0.75.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-16 22:45:59.661Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code