registry / AI-agent capability abuse / @inkeep/open-knowledge / 0.79.3

@inkeep/open-knowledge@0.79.3

Local-first, agent-friendly Markdown knowledge base with a cross-platform CLI and web editor

AI Security Review

scanned 23d ago · by lpm-firewall-ai

The source supports a guarded, explicit agent-configuration capability rather than malware behavior. Under the agent integration policy, this merits a non-blocking warning.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A user runs ok init with MCP setup enabled.

Impact

A configured agent may gain access to the local Open Knowledge MCP server and its tools; no unconsented install-time configuration change was found.

Mechanism

The CLI selects agent targets and writes managed MCP command and argument entries into their configuration files.

AI rationale

The source supports a guarded, explicit agent-configuration capability rather than malware behavior. Under the agent integration policy, this merits a non-blocking warning.

Evidence

dist/init-D_DKMj1s.mjsdist/dist-Cmgb0r3p.mjs.mcp.json.cursor/mcp.json.codex/config.tomlopencode.json

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The package exposes an executable CLI rather than an install lifecycle hook.
The explicit ok init command registers an MCP server by default and provides a no-mcp opt-out.
The initializer selects editor configurations and can write structured configuration entries.
The configuration manager handles MCP command and argument fields for project agent configuration files.

Evidence against

No autonomous install-time execution or credential exfiltration was identified.
MCP configuration is activated by an explicit CLI command and supports opting out.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetry

Source & flagged code

18 flagged

dist/init-D_DKMj1s.mjsView file

Lines 1-21javascript

1import{i as e,o as t,t as n}from"./rolldown-runtime-tZXQYakl.mjs";import{$l as r,Ft as i,Gd as a,Gl as o,Jd as s,Kd as c,Qu as l,Uu as u,Xd as d,Zd as f,ef as p,qu as m,ru as h,sc as g,tf as _,xs as v,ys as y,zd as b}from"./md-manager-BGnqyqi1-BWyJhS5F.mjs";import{$i as x,Ao as S,Ar as ee,Bn as te,H as ne,L as re,Lr as ie,Mo as ae,No as oe,Po as se,Qi as ce,R as le,Ro as C,Tt as ue,Wo as de,Xo as fe,Xr as pe,_o as me,at as he,en as ge,ha as _e,jo as ve,m as ye,mo as be,na as xe,qn as Se,rt as Ce,wr as we,yo as Te}from"./dist-Cmgb0r3p.mjs";import{i as w,n as T,o as E,r as D,s as O,t as k}from". ...

2`)}displayWidth(e){return r(e).length}styleTitle(e){return e}styleUsage(e){return e.split(` `).map(e=>e===`[options]`?this.styleOptionText(e):e===`[command]`?this.styleSubcommandText(e):e[0]===`[`||e[0]===`<`?this.styleArgumentText(e):this.styleCommandText(e)).join(` `)}styleCommandDescription(e){return this.styleDescriptionText(e)}styleOptionDescription(e){return this.styleDescriptionText(e)}styleSubcommandDescription(e){return this.styleDescriptionText(e)}styleArgumentDescription(e){return this.styleDescriptionText(e)}styleDescriptionText(e){return e}styleOptionTerm(e){return this.styleOptio ...

High

Child Process

Package source references child process execution.

dist/init-D_DKMj1s.mjsView on unpkg · L1

3`+` `.repeat(t+2)),i+a+` `.repeat(2)+s.replace(/\n/g,`\n${i}`)}boxWrap(e,t){if(

4`)}};function r(e){return e.replace(/\x1b\[\d*(;\d*)*m/g,``)}e.Help=n,e.stripColor=r})),$e=n((e=>{let{InvalidArgumentError:t}=Xe();var n=class{constructor(e,t){this.flags=e,this.description=t||``,this.required=e.includes(`<`),this

5- a short flag is a single dash and a single character

6 - either use a single dash and a single character (for a short flag)

7 - or use a double dash for a long option (and can have two, like '--ws, --workspace')`):r.test(t)?Error(`${n}

8- too many short flags`):i.test(t)?Error(`${n}

9- too many long flags`):Error(`${n}

10- unrecognised flag format`)}if(t===void 0&&n===void 0)throw Error(`option creation failed due to no flags found in '${e}'.`);return{shortFlag:t,longFlag:n}}e.Option=n,e.DualOptions=r})),et=n((e=>{function t(e,t){if(Math.abs(e.length-t.length)>3)return Math.max(e.length,t.length);let n=[];for(let t=0;t<=e.length;t++)n[t]=[t];for(let e=0;e<=t.length;e++)n[0][e]=e;for(let r=1;r<=t.length;r++)for(let i=1;i<=e.length;i++){let a=1;a=e[i-1]===t[r-1]?0:1,n[i][r]=Math.min(n[i-1][r]+1,n[i][r-1]+1,n[i-1][r-1]+a),i>1&&r>1&&e[i-1]===t[r-2]&&e[i-2]===t[r-1]&&(n[i][r]=Math.min(n[i][r],n[i-2][r-2]+1))}return ...

11- specify the name in Command constructor or using .name()`);return t||={},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.hidden)&&(e._hidden=!0),this._registerCommand(e),e.parent=this,e._checkForBrokenPassThrough(),this}createArgument(e,t){return new s(e,t)}argument(e,t,n,r){let i=this.createArgument(e,t);return typeof n==`function`?i.default(r).argParser(n):i.default(n),this.addArgument(i),this}arguments(e){return e.trim().split(/ +/).forEach(e=>{this.argument(e)}),this}addArgument(e){let t=this.registeredArguments.slice(-1)[0];if(t?.variadic)throw Error(`only the last argument ...

12Expecting one of '${n.join(`', '`)}'`);return this._lifeCycleHooks[e]?this._lifeCycleHooks[e].push(t):this._lifeCycleHooks[e]=[t],this}exitOverride(e){return this._exitCallback=e||(e=>{if(e.code!==`commander.executeSubCommandAsync`)throw e}),this}_exit(e,t,n){this._exitCallback&&this._exitCallback(new l(e,t,n)),o.exit(e)}action(e){let t=t=>{let n=this.registeredArguments.length,r=t.slice(0,n);return r[n]=this._storeOptionsAsProperties?this:this.opts(),r.push(this),e.apply(this,r)};return this._actionHandler=t,this}createOption(e,t){return new f(e,t)}_callParseArg(e,t,n,r){try{return e.parseArg ...

13- already used by option '${t.flags}'`)}this._initOptionGroup(e),this.options.push(e)}_registerCommand(e){let t=e=>[e.name()].concat(e.aliases()),n=t(e).find(e=>this._findCommand(e));if(n){let r=t(this._findCommand(n)).join(`|`),i=t(e).join(`|`);throw Error(`cannot add command '${i}' as already have command '${r}'`)}this._initCommandGroup(e),this.commands.push(e)}addOption(e){this._registerOption(e);let t=e.name(),n=e.attributeName();if(e.negate){let t=e.long.replace(/^--no-/,`--`);this._findOption(t)||this.setOptionValueWithSource(n,e.defaultValue===void 0||e.defaultValue,`default`)}else e.d ...

14- either make a new Command for each call to parse, or stop storing options as properties`);this._name=this._savedState._name,this._scriptPath=null,this.rawArgs=[],this._optionValues={...this._savedState._optionValues},this._optionValueSources={...this._savedState._optionValueSources},this.args=[],

15 - if '${n}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead

16 - if the default executable name is not suitable, use the executableFile option to supply a custom name or path

17 - ${t?`searched for local subcommand relative to directory '${t}'`:`no directory for search for local subcommand, use .executableDir() to supply a custom directory`}`;throw Error(r)}_executeSubCommand(e,t){t=t.slice();let n=!1,s=[`.js`,`.ts`,`.tsx`,`.mjs`,`.cjs`];function

18`),this.outputHelp({error:!0}));let n=t||{},r=n.exitCode||1,i=n.code||`commander.error`;this._exit(r,i,e)}_parseOptionsEnv(){this.options.forEach(e=>{if(e.envVar&&e.envVar in o.env){let t=e.attributeName();(this.getOptionValue(t)===void 0||[`default`,`config`,`env`].includes(this.getOptionValueSource(t)))&&(e.required||e.optional?this.emit(`optionEnv:${e.name()}`,o.env[e.envVar]):this.emit(`optionEnv:${e.name()}`))}})}_parseOptionsImplied(){let e=new p(this.options),t=e=>this.getOptionValue(e)!==void 0&&![`default`,`implied`].includes(this.getOptionValueSource(e));this.options.filter(n=>n.impl ...

19Expecting one of '${n.join(`', '`)}'`);let r=`${e}Help`;return this.on(r,e=>{let n;n=typeof t==`function`?t({error:e.error,command:e.command}):t,n&&e.write

20`),u=!1;for(let e=0;e<l.length;e++){let t=l[e];if(r+=t,u)u=!1;else if(u=t>=`\ud800`&&t<=`\udbff`,u)continue;if(t===`\x1B`||t===``){pn.lastIndex=e+1;let t=pn.exec(l)?.groups;if(t?.code!==void 0){let e=Number.parseFloat(t.code);i=e===39?void 0:e}else t?.uri!==void 0&&(a=t.uri.length===0?void 0:t.uri)}if(l[e+1]===`

21`){a&&(r+=gn(``));let e=i?mn(i):void 0;i&&e&&(r+=hn(e))}else t===`

Long lines were clipped for display.

dist/dist-Cmgb0r3p.mjsView file

21var t=null;try{t=new WebAssembly.Instance(new WebAssembly.Module(new Uint8Array([0,97,115,109,1,0,0,0,1,13,2,96,0,1,127,96,4,127,127,127,127,1,127,3,7,6,0,1,1,1,1,1,6,6,1,127,1,65,... L22: changing to the minimum size of: 2`),this._maxSize=2)}record(e){this.updateByIncrement(e,1)}setStartTime(e){this.startTime=e}toPointValue(){return{hasMinMax:this._recordMinMax,min:... L23: \t- OR - create a new view with the name ${e.name} and description '${e.description}' and InstrumentSelector ${r}

High

Shell

Package source references shell execution.

dist/dist-Cmgb0r3p.mjsView on unpkg · L21

1import{a as e,i as t,n,o as r,r as i,t as a}from"./rolldown-runtime-tZXQYakl.mjs";import{$ as o,$a as s,$i as c,$l as l,$n as u,$o as d,$r as f,$s as p,$t as m,A as h,Aa as g,Ac as... L2: /** ... L10: * L11: * http://www.apache.org/licenses/LICENSE-2.0 L12: *

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/dist-Cmgb0r3p.mjsView on unpkg · L1

20*/ L21: var t=null;try{t=new WebAssembly.Instance(new WebAssembly.Module(new Uint8Array([0,97,115,109,1,0,0,0,1,13,2,96,0,1,127,96,4,127,127,127,127,1,127,3,7,6,0,1,1,1,1,1,6,6,1,127,1,65,... L22: changing to the minimum size of: 2`),this._maxSize=2)}record(e){this.updateByIncrement(e,1)}setStartTime(e){this.startTime=e}toPointValue(){return{hasMinMax:this._recordMinMax,min:... L23: \t- OR - create a new view with the name ${e.name} and description '${e.description}' and InstrumentSelector ${r} ... L31: causes have become circular...`;let o=r(e);return o?(t.add(e),a+` L32: caused by: `+i(o,t)):a},a=e=>i(e,new Set),o=(e,t,i)=>{if(!n(e))return``;let a=i?``:e.message||``;if(t.has(e))return a+`: ...`;let s=r(e);if(s){t.add(e);let n=typeof e.cause==`funct... L33: `:`

dist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:string-array:round1View file

1import{t as e}from"./chunk-DXB73IDG-MLBj3lvC.mjs";function t(){let e=[{prop:`Function`,target:globalThis,violationType:`function_constructor`,strategy:`throw`,reason:`Function cons... L2: `);n.register(`data:text/javascript,${encodeURIComponent(e)}`),i.importHooksRegistered=!0}}catch(e){console.debug(`[DefenseInDepthBox] Could not register import() hooks:`,e instanc...

High

Eval

Package source references dynamic code evaluation.

dist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:string-array:round1View on unpkg · L1

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:string-array:round1View on unpkg · L1

dist/index.mjsView file

1import{a as e,i as t,n,r,t as i}from"./rolldown-runtime-DPpTSio4.mjs";import"./libesm-CSMdpGMF.mjs";import"./chunk-B74TABJS-DAm9lxFL.mjs";import"./chunk-R6VWJ2ZL-Cu1kOJ3f.mjs";impo... L2: `)){let e=r.replace($e,``),i=Xe.exec(e)?.[1];if(i){n={login:i,active:!1},t.push(n);continue}if(Ze.test(e)){n=void 0;continue}n&&Qe.test(e)&&(n.active=!0)}return t}var tt=i((e=>{let... ... L82: `:` L83: `)+(a.substring(1)||` `),n=!0,r=!1;break;case`%`:e[i+1]?.[0]!==`#`&&(i+=1),n=!1;break;default:n||(r=!0),n=!1}}return{comment:t,afterEmptyLine:r}}e.Composer=class{constructor(e={}){... L84: `}];switch(c[0]){case`|`:case`>`:{let e=c.indexOf(` ... L115: `)+1;for(;e!==0;)this.onNewLine(this.offset+e),e=this.source.indexOf(` L116: `,e)+1}return{type:e,offset:this.offset,indent:this.indent,source:this.source}

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.mjsView on unpkg · L1

1Trigger-reachable chain: manifest.exports -> dist/index.mjs L1: import{a as e,i as t,n,r,t as i}from"./rolldown-runtime-DPpTSio4.mjs";import"./libesm-CSMdpGMF.mjs";import"./chunk-B74TABJS-DAm9lxFL.mjs";import"./chunk-R6VWJ2ZL-Cu1kOJ3f.mjs";impo... L2: `)){let e=r.replace($e,``),i=Xe.exec(e)?.[1];if(i){n={login:i,active:!1},t.push(n);continue}if(Ze.test(e)){n=void 0;continue}n&&Qe.test(e)&&(n.active=!0)}return t}var tt=i((e=>{let... ... L82: `:` L83: `)+(a.substring(1)||` `),n=!0,r=!1;break;case`%`:e[i+1]?.[0]!==`#`&&(i+=1),n=!1;break;default:n||(r=!0),n=!1}}return{comment:t,afterEmptyLine:r}}e.Composer=class{constructor(e={}){... L84: `}];switch(c[0]){case`|`:case`>`:{let e=c.indexOf(` ... L115: `)+1;for(;e!==0;)this.onNewLine(this.offset+e),e=this.source.indexOf(` L116: `,e)+1}return{type

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.mjsView on unpkg · L1

dist/cli.mjsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: import{o as e}from"./rolldown-runtime-tZXQYakl.mjs";import{$d as t,$n as n,$u as r,Al as i,Bo as a,Cs as o,Ed as s,Eo as c,Fc as l,Fo as u,Gl as d,Ia as f,Jd as p,Mc as m,Oo as h,P... `)}const Fi={out:e=>process.stdout.write(`${e}\n`),err:e=>process.stderr.write(`${e}\n`)};function Ii(e){return new A(`audit`).description(`Unified validation audit (markdown lint ... `)){let e=n.trim();if(e===``)continue;let r=e.indexOf(`=`);r!==-1&&(t[e.slice(0,r)]=e.slice(r+1))}return t}function Hi(e){return new Promise((t,n)=>{let r=[];e.on(`data`,e=>r.push(... `:`Pass --host <hostname> to target a GitHub host explicitly, or, if ${e} run

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.mjsView on unpkg

dist/public/assets/dist-bQ5kvrpa.jsView file

155contains invisible/control Unicode U+FEFF (zero width no-break space) `,this.pos),this.lineEndPos=e),e===-1?this.atEnd?this.buffer.substring(this.pos):null:(this.buffer[e-1]===`\r`&&--e,this.buffer.substring(this.pos,e))}hasChars(e){return this.pos+e<=this.buffer.length}setNext(e){return this.buffer=this.buff

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/public/assets/dist-bQ5kvrpa.jsView on unpkg · L155

dist/native/native-config.linux-arm64-musl.nodeView file

•path = dist/native/native-config.linux-arm64-musl.node kind = native_binary sizeBytes = 801864 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/native-config.linux-arm64-musl.nodeView on unpkg

dist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 28

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:normalized:round1View on unpkg

dist/native/index.jsView file

•matchType = token_shingles matchedPackage = @inkeep/open-knowledge@0.31.0 matchedPath = dist/native/index.js matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.31.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/native/index.jsView on unpkg

dist/chunk-WRU74C26-CKoV7Oqa.mjsView file

•matchType = normalized_sha256 matchedPackage = @p4code/cli@0.4.12 matchedPath = dist/client/assets/chunk-WRU74C26-C2Rb3ATV.js matchedIdentity = npm:QHA0Y29kZS9jbGk:0.4.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-WRU74C26-CKoV7Oqa.mjsView on unpkg

dist/diagram-Q27KOJAE-7KO1ITMW.mjsView file

•matchType = token_shingles matchedPackage = @p4code/cli@0.4.12 matchedPath = dist/client/assets/diagram-Q27KOJAE-Dp_H6G_V.js matchedIdentity = npm:QHA0Y29kZS9jbGk:0.4.12 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/diagram-Q27KOJAE-7KO1ITMW.mjsView on unpkg

Source & flagged code

18 flagged · loading source

dist/init-D_DKMj1s.mjsView file

1import{i as e,o as t,t as n}from"./rolldown-runtime-tZXQYakl.mjs";import{$l as r,Ft as i,Gd as a,Gl as o,Jd as s,Kd as c,Qu as l,Uu as u,Xd as d,Zd as f,ef as p,qu as m,ru as h,sc ... L2: `)}displayWidth(e){return r(e).length}styleTitle(e){return e}styleUsage(e){return e.split(` `).map(e=>e===`[options]`?this.styleOptionText(e):e===`[command]`?this.styleSubcommandTe...

High

Child Process

Package source references child process execution.

dist/init-D_DKMj1s.mjsView on unpkg · L1

dist/dist-Cmgb0r3p.mjsView file

High

Shell

Package source references shell execution.

dist/dist-Cmgb0r3p.mjsView on unpkg · L21

Findings

3 Critical13 High5 Medium6 Low

CriticalCredential Exfiltrationdist/index.mjs

CriticalTrojan Source Unicodedist/public/assets/dist-bQ5kvrpa.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.mjs

HighChild Processdist/init-D_DKMj1s.mjs

HighShelldist/dist-Cmgb0r3p.mjs

HighEvaldist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:string-array:round1

HighSame File Env Network Executiondist/dist-Cmgb0r3p.mjs

HighCredential Redirect Persistencedist/cli.mjs

HighCommand Output Exfiltrationdist/dist-Cmgb0r3p.mjs

HighCross File Remote Execution Contextdist/dist-Cmgb0r3p.mjs

HighTrigger Reachable Credential Exfiltrationdist/index.mjs

Affected versions and remediation

This report applies to @inkeep/open-knowledge@0.79.3.

See all versions of @inkeep/open-knowledge for other recorded verdicts.

Review the evidence and your use of @inkeep/open-knowledge@0.79.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-29 21:12:22.505Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code