registry / AI-agent capability abuse / @inkeep/open-knowledge / 0.76.1

@inkeep/open-knowledge@0.76.1

Local-first, agent-friendly Markdown knowledge base with a cross-platform CLI and web editor

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This package does not run extra scripts at npm install; it is a user-run CLI that can write first-party Open Knowledge skills and MCP entries into other editors when the user starts or repairs a project. That editor-config change, plus shipped native addons and vendor bundles that static analysis could not fully parse, is leftover dual-use risk rather than a proven install-time attack.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A user runs the open-knowledge or ok CLI (init, start, or repair-skills). npm install does not run package scripts.

Impact

Installed editors may load Open Knowledge skills and MCP tools in the project or user config after the user runs setup.

Mechanism

Explicit CLI writes first-party editor skills and MCP config

AI rationale

Evidence

dist/cli.mjsdist/dist-Cao3SE0M.mjsdist/init-S1_zVNWd.mjsdist/index.mjsdist/native/index.js.claude/skills/open-knowledge/.cursor/skills/open-knowledge/.codex/skills/open-knowledge/.github/skills/open-knowledge/.opencode/skills/open-knowledge/.pi/skills/open-knowledge/.cursor/mcp.json

Decision evidence

public snapshot

AI called this Suspicious at 74.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

User-run CLI bins install first-party Open Knowledge skills into Claude, Cursor, Codex, GitHub, OpenCode, and Pi skill folders.
Setup writes editor MCP files such as the user-global Cursor mcp.json path.
The repair-skills command refreshes editor skill files and is described as running automatically during ok start.
Native NAPI-RS config addons load from shipped .node files, including an environment override for the library path.
Bundled vendor code lists eval so it can throw instead of running it, and several large bundles still failed static parse.
GitHub login helpers read gh auth tokens for GitHub hosts.

Evidence against

package.json has no preinstall, install, or postinstall scripts.
Agent writes are first-party Open Knowledge skills from explicit CLI use, not npm install.
GitHub tokens are used for GitHub device-flow and git-credential against GitHub hosts.
The eval finding is a throw-on-eval sandbox table, not live evaluation.
High-similarity files include marked.js GFM lexer and mermaid TreeMapDB vendor code.

Behavioral surface

Source & flagged code

21 flagged

dist/public/assets/chunk-A66AFZZU-BIdRzPTk.jsView file

Lines 1-7javascript

1var e={MODE:`production`,VITE_APP_BACKEND_V2_GET_URL:`https://json.excalidraw.com/api/v2/`,VITE_APP_BACKEND_V2_POST_URL:`https://json.excalidraw.com/api/v2/post/`,VITE_APP_LIBRARY_URL:`https://libraries.excalidraw.com`,VITE_APP_LIBRARY_BACKEND:`https://us-central1-excalidraw-room-persistence.cloudfunctions.net/libraries`,VITE_APP_PLUS_LP:`https://plus.excalidraw.com`,VITE_APP_PLUS_APP:`https://app.excalidraw.com`,VITE_APP_AI_BACKEND:`https://oss-ai.excalidraw.com`,VITE_APP_WS_SERVER_URL:`https://oss-collab.excalidraw.com`,VITE_APP_FIREBASE_CONFIG:`{"apiKey":"AIzaSyAd15pYlMci_xIp9ko6wkEsDzAAA0D ...

High

High Secret

Package contains a high-severity secret pattern.

dist/public/assets/chunk-A66AFZZU-BIdRzPTk.jsView on unpkg · L1

2/WvuKSOJxiw6AR/ZcE3eFQWM/mbFdhQgyK8eHGkKQifKzH1xUZjCxyXcxW6ZO02t

3kPOPxhz+nxUrIoWCD/V4NGmUA1lxwHuO21HN1gzKrN3xHg5EGjyouR9vibT9VDGF

4gq6+4Ic/kJX+AD2MM7Yre2+FsOdysrmuW2Fu3ahuC1uQE7pOe1j0k7auNP0y1q53

5PrB8Ts2LUpepWC1l7zIXFm4ViDULuyWXTEpUcHSsEH8vpd1tckjypxCwkipfZsXx

6iPszy0o0Dx2iArPfWMXlFAI9mvyFCyFC3+nSvfyAUb2C4uZgCwAuyFh/ydPF4DEE

7PQIDAQAB`,VITE_APP_DEBUG_ENABLE_TEXT_CONTAINER_BOUNDING_BOX:`false`,VITE_APP_COLLAPSE_OVERLAY:`false`,VITE_APP_ENABLE_ESLINT:`false`,PKG_NAME:`@excalidraw/excalidraw`,PKG_VERSION:`0.18.0`,PROD:!0};export{e as t};

Long lines were clipped for display.

1patternName = google_api_key severity = high line = 1

High

Secret Pattern

Google API key in dist/public/assets/chunk-A66AFZZU-BIdRzPTk.js

dist/public/assets/chunk-A66AFZZU-BIdRzPTk.jsView on unpkg · L1

dist/native/index.jsView file

Lines 35-75javascript

35 let report = null

36 if (process.report && typeof process.report.getReport === 'function') {

37 process.report.excludeNetwork = true

38 report = process.report.

dist/index.mjsView file

1import{a as e,i as t,n,r,t as i}from"./rolldown-runtime-DPpTSio4.mjs";import"./libesm-CSMdpGMF.mjs";import"./chunk-B74TABJS-DAm9lxFL.mjs";import"./chunk-R6VWJ2ZL-Cu1kOJ3f.mjs";impo... L2: `)){let e=r.replace($e,``),i=Xe.exec(e)?.[1];if(i){n={login:i,active:!1},t.push(n);continue}if(Ze.test(e)){n=void 0;continue}n&&Qe.test(e)&&(n.active=!0)}return t}var tt=i((e=>{let... ... L82: `:` L83: `)+(a.substring(1)||` `),n=!0,r=!1;break;case`%`:e[i+1]?.[0]!==`#`&&(i+=1),n=!1;break;default:n||(r=!0),n=!1}}return{comment:t,afterEmptyLine:r}}e.Composer=class{constructor(e={}){... L84: `}];switch(c[0]){case`|`:case`>`:{let e=c.indexOf(` ... L115: `)+1;for(;e!==0;)this.onNewLine(this.offset+e),e=this.source.indexOf(` L116: `,e)+1}return{type:e,offset:this.offset,indent:this.indent,source:this.source}

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.mjsView on unpkg · L1

1Trigger-reachable chain: manifest.exports -> dist/index.mjs L1: import{a as e,i as t,n,r,t as i}from"./rolldown-runtime-DPpTSio4.mjs";import"./libesm-CSMdpGMF.mjs";import"./chunk-B74TABJS-DAm9lxFL.mjs";import"./chunk-R6VWJ2ZL-Cu1kOJ3f.mjs";impo... L2: `)){let e=r.replace($e,``),i=Xe.exec(e)?.[1];if(i){n={login:i,active:!1},t.push(n);continue}if(Ze.test(e)){n=void 0;continue}n&&Qe.test(e)&&(n.active=!0)}return t}var tt=i((e=>{let... ... L82: `:` L83: `)+(a.substring(1)||` `),n=!0,r=!1;break;case`%`:e[i+1]?.[0]!==`#`&&(i+=1),n=!1;break;default:n||(r=!0),n=!1}}return{comment:t,afterEmptyLine:r}}e.Composer=class{constructor(e={}){... L84: `}];switch(c[0]){case`|`:case`>`:{let e=c.indexOf(` ... L115: `)+1;for(;e!==0;)this.onNewLine(this.offset+e),e=this.source.indexOf(` L116: `,e)+1}return{type

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.mjsView on unpkg · L1

dist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:string-array:round1View file

1import{t as e}from"./chunk-DXB73IDG-MLBj3lvC.mjs";function t(){let e=[{prop:`Function`,target:globalThis,violationType:`function_constructor`,strategy:`throw`,reason:`Function cons... L2: `);n.register(`data:text/javascript,${encodeURIComponent(e)}`),i.importHooksRegistered=!0}}catch(e){console.debug(`[DefenseInDepthBox] Could not register import() hooks:`,e instanc...

High

Eval

Package source references dynamic code evaluation.

dist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:string-array:round1View on unpkg · L1

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:string-array:round1View on unpkg · L1

dist/src-CQfRqvyR.mjsView file

Lines 1-11javascript

1import{o as e}from"./rolldown-runtime-tZXQYakl.mjs";import{Es as t,Gc as n,Hd as r,Ls as i,Mn as a,Nn as o,To as s,Vn as c,Wc as l,ju as u,qc

dist/cli.mjsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: import{o as e}from"./rolldown-runtime-tZXQYakl.mjs";import{$a as t,Bo as n,Ec as r,Gu as i,Hd as a,Io as o,Iu as s,Kc as c,Ld as l,Ma as u,Ml as d,Nd as f,Nl as p,Pa as m,Ps as h,Q... `)}const Ai={out:e=>process.stdout.write(`${e}\n`),err:e=>process.stderr.write(`${e}\n`)};function ji(e){return new j(`audit`).description(`Unified validation audit (markdown lint ... `)){let e=n.trim();if(e===``)continue;let r=e.indexOf(`=`);r!==-1&&(t[e.slice(0,r)]=e.slice(r+1))}return t}function Li(e){return new Promise((t,n)=>{let r=[];e.on(`data`,e=>r.push(... `)}var ga=class extends Error{constructor(e,t,n){super(ha(n)),this.request=e,

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.mjsView on unpkg

dist/public/assets/hi-IN-UTYRMTUF-DQZO1yHB.jsView file

2contains invisible/control Unicode U+200B (zero width space) आपके बदलाव सहेजे नहीं जाएंगे!`,localStorageQuotaExceeded:``},o={unsupportedFileType:`असमर्थित फाइल प्रकार`,imageInsertError:`प्रतिमा सन्निवेश नहीं की जा सकी. पुनः प्रयत्न करे...`,fileTooBig:`फ़ाइल ज़रूरत से ज़्यादा बड़ी हैं. अधिकतम अनुमित प

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/public/assets/hi-IN-UTYRMTUF-DQZO1yHB.jsView on unpkg · L2

dist/dist-Cao3SE0M.mjsView file

1Cross-file remote execution chain: dist/dist-Cao3SE0M.mjs spawns dist/chunk-5QMZ5MUS-BuB3i_B5.mjs; helper contains network access plus dynamic code execution. L1: import{a as e,i as t,n,o as r,r as i,t as a}from"./rolldown-runtime-tZXQYakl.mjs";import{$ as o,$a as s,$c as c,$i as l,$l as u,$n as d,$o as f,$r as p,$s as m,$t as h,$u as g,A as... L2: /** ... L10: * L11: * http://www.apache.org/licenses/LICENSE-2.0 L12: * ... L21: var t=null;try{t=new WebAssembly.Instance(new WebAssembly.Module(new Uint8Array([0,97,115,109,1,0,0,0,1,13,2,96,0,1,127,96,4,127,127,127,127,1,127,3,7,6,0,1,1,1,1,1,6,6,1,127,1,65,... L22: changing to the minimum size of: 2`),this._maxSize=2)}record(e){this.updateByIncrement(e,1)}setStartTime(e){this.startTime=e}toPointValue(){return{hasMinMax:this._recordMinMax

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/dist-Cao3SE0M.mjsView on unpkg · L1

dist/native/native-config.linux-arm64-musl.nodeView file

•path = dist/native/native-config.linux-arm64-musl.node kind = native_binary sizeBytes = 801864 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/native-config.linux-arm64-musl.nodeView on unpkg

dist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 29

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:normalized:round1View on unpkg

dist/chunk-WRU74C26-CKoV7Oqa.mjsView file

•matchType = normalized_sha256 matchedPackage = @p4code/cli@0.4.12 matchedPath = dist/client/assets/chunk-WRU74C26-C2Rb3ATV.js matchedIdentity = npm:QHA0Y29kZS9jbGk:0.4.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-WRU74C26-CKoV7Oqa.mjsView on unpkg

dist/diagram-Q27KOJAE-7KO1ITMW.mjsView file

•matchType = token_shingles matchedPackage = @p4code/cli@0.4.12 matchedPath = dist/client/assets/diagram-Q27KOJAE-Dp_H6G_V.js matchedIdentity = npm:QHA0Y29kZS9jbGk:0.4.12 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/diagram-Q27KOJAE-7KO1ITMW.mjsView on unpkg

Source & flagged code

21 flagged · loading source

dist/public/assets/chunk-A66AFZZU-BIdRzPTk.jsView file

1patternName = google_api_key severity = high line = 1

High

High Secret

Package contains a high-severity secret pattern.

dist/public/assets/chunk-A66AFZZU-BIdRzPTk.jsView on unpkg · L1

1patternName = google_api_key severity = high line = 1

High

Secret Pattern

Google API key in dist/public/assets/chunk-A66AFZZU-BIdRzPTk.js

dist/public/assets/chunk-A66AFZZU-BIdRzPTk.jsView on unpkg · L1

dist/native/index.jsView file

55try { L56: return require('child_process').execSync('ldd --version', { encoding: 'utf8' }).includes('musl') L57: } catch (e) {

High

Child Process

Package source references child process execution.

Findings

4 Critical15 High5 Medium6 Low

CriticalCredential Exfiltrationdist/index.mjs

CriticalTrojan Source Unicodedist/public/assets/hi-IN-UTYRMTUF-DQZO1yHB.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.mjs

CriticalPrevious Version Dangerous Deltadist/index.mjs

HighHigh Secretdist/public/assets/chunk-A66AFZZU-BIdRzPTk.js

HighChild Processdist/native/index.js

HighShelldist/index.mjs

HighEvaldist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:string-array:round1

HighSame File Env Network Executiondist/src-CQfRqvyR.mjs

HighCredential Redirect Persistencedist/cli.mjs

HighCommand Output Exfiltrationdist/index.mjs

Affected versions and remediation

This report applies to @inkeep/open-knowledge@0.76.1.

See all versions of @inkeep/open-knowledge for other recorded verdicts.

Review the evidence and your use of @inkeep/open-knowledge@0.76.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-18 16:31:12.155Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code