registry / @inkeep/open-knowledge / 0.79.9

@inkeep/open-knowledge@0.79.9

Local-first, agent-friendly Markdown knowledge base with a cross-platform CLI and web editor

AI Security Review

scanned 23d ago · by lpm-firewall-ai

Inspected source supports a guarded agent extension lifecycle warning because explicit setup installs a launcher capable of fetching and executing future releases. No concrete malicious attack supporting a publication block was identified.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Run init with MCP setup enabled, then start the configured MCP integration in an agent.

Impact

Agent startup can install and execute a newer release without a version pin or a separate npm confirmation.

Mechanism

Setup selects user or project configuration and registers a shell launcher whose fallback invokes npx with the latest package release.

AI rationale

Evidence

dist/cli.mjsdist/init-BYr6znQ5.mjs.codex/config.toml.mcp.json.cursor/mcp.json

Decision evidence

public snapshot

AI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The active CLI registers the explicit init command for editor MCP setup.
Init respects the MCP opt-out, prompts for scope interactively, and defaults to both scopes without a terminal.
Editor configuration includes Codex config.toml and uses format-specific writers.
The installed MCP launcher can automatically install and execute @inkeep/open-knowledge@latest through npx when the agent starts.

Evidence against

Package metadata contains no automatic npm install lifecycle hooks or runtime self-dependency.
Configuration changes are activated by an explicit setup command and target the package's own integration; no covert attack was established.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStrings

Source & flagged code

21 flagged

dist/public/assets/chunk-A66AFZZU-BPo37bmP.jsView file

Lines 1-7javascript

1var e={MODE:`production`,VITE_APP_BACKEND_V2_GET_URL:`https://json.excalidraw.com/api/v2/`,VITE_APP_BACKEND_V2_POST_URL:`https://json.excalidraw.com/api/v2/post/`,VITE_APP_LIBRARY_URL:`https://libraries.excalidraw.com`,VITE_APP_LIBRARY_BACKEND:`https://us-central1-excalidraw-room-persistence.cloudfunctions.net/libraries`,VITE_APP_PLUS_LP:`https://plus.excalidraw.com`,VITE_APP_PLUS_APP:`https://app.excalidraw.com`,VITE_APP_AI_BACKEND:`https://oss-ai.excalidraw.com`,VITE_APP_WS_SERVER_URL:`https://oss-collab.excalidraw.com`,VITE_APP_FIREBASE_CONFIG:`{"apiKey":"AIzaSyAd15pYlMci_xIp9ko6wkEsDzAAA0D ...

High

High Secret

Package contains a high-severity secret pattern.

dist/public/assets/chunk-A66AFZZU-BPo37bmP.jsView on unpkg · L1

2/WvuKSOJxiw6AR/ZcE3eFQWM/mbFdhQgyK8eHGkKQifKzH1xUZjCxyXcxW6ZO02t

3kPOPxhz+nxUrIoWCD/V4NGmUA1lxwHuO21HN1gzKrN3xHg5EGjyouR9vibT9VDGF

4gq6+4Ic/kJX+AD2MM7Yre2+FsOdysrmuW2Fu3ahuC1uQE7pOe1j0k7auNP0y1q53

5PrB8Ts2LUpepWC1l7zIXFm4ViDULuyWXTEpUcHSsEH8vpd1tckjypxCwkipfZsXx

6iPszy0o0Dx2iArPfWMXlFAI9mvyFCyFC3+nSvfyAUb2C4uZgCwAuyFh/ydPF4DEE

7PQIDAQAB`,VITE_APP_DEBUG_ENABLE_TEXT_CONTAINER_BOUNDING_BOX:`false`,VITE_APP_COLLAPSE_OVERLAY:`false`,VITE_APP_ENABLE_ESLINT:`false`,PKG_NAME:`@excalidraw/excalidraw`,PKG_VERSION:`0.18.0`,PROD:!0};export{e as t};

Long lines were clipped for display.

1patternName = google_api_key severity = high line = 1

High

Secret Pattern

Google API key in dist/public/assets/chunk-A66AFZZU-BPo37bmP.js

dist/public/assets/chunk-A66AFZZU-BPo37bmP.jsView on unpkg · L1

dist/open-browser-DXpUkcvz.mjsView file

1import{mo as e}from"./dist-DOZqscGz.mjs";import{execFile as t}from"node:child_process";const n=new Set([`http:`,`https:`]),r=/[\u0000-\u0020\u007F-\u009F"'`\\&|<>^()$;{}[\]*?!~]/;f...

High

Child Process

Package source references child process execution.

dist/open-browser-DXpUkcvz.mjsView on unpkg · L1

dist/index.mjsView file

1import{a as e,i as t,n,r,t as i}from"./rolldown-runtime-DPpTSio4.mjs";import"./libesm-CSMdpGMF.mjs";import"./chunk-B74TABJS-DAm9lxFL.mjs";import"./chunk-R6VWJ2ZL-Cu1kOJ3f.mjs";impo... L2: `)){let e=r.replace($e,``),i=Xe.exec(e)?.[1];if(i){n={login:i,active:!1},t.push(n);continue}if(Ze.test(e)){n=void 0;continue}n&&Qe.test(e)&&(n.active=!0)}return t}var tt=i((e=>{let... ... L82: `:` L83: `)+(a.substring(1)||` `),n=!0,r=!1;break;case`%`:e[i+1]?.[0]!==`#`&&(i+=1),n=!1;break;default:n||(r=!0),n=!1}}return{comment:t,afterEmptyLine:r}}e.Composer=class{constructor(e={}){... L84: `}];switch(c[0]){case`|`:case`>`:{let e=c.indexOf(` ... L115: `)+1;for(;e!==0;)this.onNewLine(this.offset+e),e=this.source.indexOf(` L116: `,e)+1}return{type:e,offset:this.offset,indent:this.indent,source:this.source}

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.mjsView on unpkg · L1

1Trigger-reachable chain: manifest.exports -> dist/index.mjs L1: import{a as e,i as t,n,r,t as i}from"./rolldown-runtime-DPpTSio4.mjs";import"./libesm-CSMdpGMF.mjs";import"./chunk-B74TABJS-DAm9lxFL.mjs";import"./chunk-R6VWJ2ZL-Cu1kOJ3f.mjs";impo... L2: `)){let e=r.replace($e,``),i=Xe.exec(e)?.[1];if(i){n={login:i,active:!1},t.push(n);continue}if(Ze.test(e)){n=void 0;continue}n&&Qe.test(e)&&(n.active=!0)}return t}var tt=i((e=>{let... ... L82: `:` L83: `)+(a.substring(1)||` `),n=!0,r=!1;break;case`%`:e[i+1]?.[0]!==`#`&&(i+=1),n=!1;break;default:n||(r=!0),n=!1}}return{comment:t,afterEmptyLine:r}}e.Composer=class{constructor(e={}){... L84: `}];switch(c[0]){case`|`:case`>`:{let e=c.indexOf(` ... L115: `)+1;for(;e!==0;)this.onNewLine(this.offset+e),e=this.source.indexOf(` L116: `,e)+1}return{type

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.mjsView on unpkg · L1

dist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:string-array:round1View file

1import{t as e}from"./chunk-DXB73IDG-MLBj3lvC.mjs";function t(){let e=[{prop:`Function`,target:globalThis,violationType:`function_constructor`,strategy:`throw`,reason:`Function cons... L2: `);n.register(`data:text/javascript,${encodeURIComponent(e)}`),i.importHooksRegistered=!0}}catch(e){console.debug(`[DefenseInDepthBox] Could not register import() hooks:`,e instanc...

High

Eval

Package source references dynamic code evaluation.

dist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:string-array:round1View on unpkg · L1

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:string-array:round1View on unpkg · L1

dist/cli.mjsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: import{o as e}from"./rolldown-runtime-tZXQYakl.mjs";import{$d as t,$n as n,$u as r,Al as i,Bo as a,Cs as o,Ed as s,Eo as c,Fc as l,Fo as u,Gl as d,Ia as f,Jd as p,Mc as m,Oo as h,P... `)}const Ii={out:e=>process.stdout.write(`${e}\n`),err:e=>process.stderr.write(`${e}\n`)};function Li(e){return new A(`audit`).description(`Unified validation audit (markdown lint ... `)){let e=n.trim();if(e===``)continue;let r=e.indexOf(`=`);r!==-1&&(t[e.slice(0,r)]=e.slice(r+1))}return t}function Ui(e){return new Promise((t,n)=>{let r=[];e.on(`data`,e=>r.push(... `:`Pass --host <hostname> to target a GitHub host explicitly, or, if ${e} run

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.mjsView on unpkg

dist/public/assets/dist-bQ5kvrpa.jsView file

155contains invisible/control Unicode U+FEFF (zero width no-break space) `,this.pos),this.lineEndPos=e),e===-1?this.atEnd?this.buffer.substring(this.pos):null:(this.buffer[e-1]===`\r`&&--e,this.buffer.substring(this.pos,e))}hasChars(e){return this.pos+e<=this.buffer.length}setNext(e){return this.buffer=this.buff

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/public/assets/dist-bQ5kvrpa.jsView on unpkg · L155

dist/dist-DOZqscGz.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @inkeep/open-knowledge@0.79.7 matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.79.7 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/dist-DOZqscGz.mjsView on unpkg

1Cross-file remote execution chain: dist/dist-DOZqscGz.mjs spawns dist/chunk-5QMZ5MUS-BuB3i_B5.mjs; helper contains network access plus dynamic code execution. L1: import{a as e,i as t,n,o as r,r as i,t as a}from"./rolldown-runtime-tZXQYakl.mjs";import{$ as o,$a as s,$i as c,$l as l,$n as u,$o as d,$r as f,$s as p,$t as m,A as h,Aa as g,Ac as... L2: /** ... L10: * L11: * http://www.apache.org/licenses/LICENSE-2.0 L12: * ... L21: var t=null;try{t=new WebAssembly.Instance(new WebAssembly.Module(new Uint8Array([0,97,115,109,1,0,0,0,1,13,2,96,0,1,127,96,4,127,127,127,127,1,127,3,7,6,0,1,1,1,1,1,6,6,1,127,1,65,... L22: changing to the minimum size of: 2`),this._maxSize=2)}record(e){this.updateByIncrement(e,1)}setStartTime(e){this.startTime=e}toPointValue(){return{hasMinMax:this._recordMinMax

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/dist-DOZqscGz.mjsView on unpkg · L1

dist/native/native-config.linux-arm64-musl.nodeView file

•path = dist/native/native-config.linux-arm64-musl.node kind = native_binary sizeBytes = 801864 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/native-config.linux-arm64-musl.nodeView on unpkg

dist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 28

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:normalized:round1View on unpkg

dist/native/index.jsView file

•matchType = token_shingles matchedPackage = @inkeep/open-knowledge@0.31.0 matchedPath = dist/native/index.js matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.31.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/native/index.jsView on unpkg

dist/chunk-WRU74C26-CKoV7Oqa.mjsView file

•matchType = normalized_sha256 matchedPackage = @p4code/cli@0.4.12 matchedPath = dist/client/assets/chunk-WRU74C26-C2Rb3ATV.js matchedIdentity = npm:QHA0Y29kZS9jbGk:0.4.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-WRU74C26-CKoV7Oqa.mjsView on unpkg

dist/diagram-Q27KOJAE-7KO1ITMW.mjsView file

•matchType = token_shingles matchedPackage = @p4code/cli@0.4.12 matchedPath = dist/client/assets/diagram-Q27KOJAE-Dp_H6G_V.js matchedIdentity = npm:QHA0Y29kZS9jbGk:0.4.12 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/diagram-Q27KOJAE-7KO1ITMW.mjsView on unpkg

Source & flagged code

21 flagged · loading source

dist/public/assets/chunk-A66AFZZU-BPo37bmP.jsView file

1patternName = google_api_key severity = high line = 1

High

High Secret

Package contains a high-severity secret pattern.

dist/public/assets/chunk-A66AFZZU-BPo37bmP.jsView on unpkg · L1

1patternName = google_api_key severity = high line = 1

High

Secret Pattern

Google API key in dist/public/assets/chunk-A66AFZZU-BPo37bmP.js

dist/public/assets/chunk-A66AFZZU-BPo37bmP.jsView on unpkg · L1

dist/open-browser-DXpUkcvz.mjsView file

1import{mo as e}from"./dist-DOZqscGz.mjs";import{execFile as t}from"node:child_process";const n=new Set([`http:`,`https:`]),r=/[\u0000-\u0020\u007F-\u009F"'`\\&|<>^()$;{}[\]*?!~]/;f...

High

Findings

4 Critical15 High5 Medium6 Low

CriticalCredential Exfiltrationdist/index.mjs

CriticalTrojan Source Unicodedist/public/assets/dist-bQ5kvrpa.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.mjs

CriticalPrevious Version Dangerous Deltadist/dist-DOZqscGz.mjs

HighHigh Secretdist/public/assets/chunk-A66AFZZU-BPo37bmP.js

HighChild Processdist/open-browser-DXpUkcvz.mjs

HighShelldist/index.mjs

HighEvaldist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:string-array:round1

HighSame File Env Network Executiondist/index.mjs

HighCredential Redirect Persistencedist/cli.mjs

HighCommand Output Exfiltrationdist/index.mjs

Affected versions and remediation

This report applies to @inkeep/open-knowledge@0.79.9.

See all versions of @inkeep/open-knowledge for other recorded verdicts.

Review the evidence and your use of @inkeep/open-knowledge@0.79.9 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-30 16:57:08.799Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code