registry / @inkeep/open-knowledge / 0.86.18

@inkeep/open-knowledge@0.86.18

⚠ Under review

Local-first, agent-friendly Markdown knowledge base with a cross-platform CLI and web editor

AI Security Review

scanned 7d ago · by lpm-firewall-ai

The manifest has no install lifecycle hook, and the inspected agent registration is explicit CLI behavior. The shipped native bindings remain unresolved, so source inspection does not support either a clean verdict or a concrete attack finding.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Runtime use of native configuration support may load a platform binding.

Impact

The native code’s effects remain unknown, so the package cannot be cleared from the inspected source alone.

Mechanism

The generated loader selects a native binding, or loads a path supplied through NAPI_RS_NATIVE_LIBRARY_PATH.

AI rationale

Evidence

dist/native/index.jsdist/native/native-config.linux-arm64-musl.nodedist/native/native-config.linux-x64-gnu.nodedist/native/native-config.linux-x64-musl.nodedist/native/native-config.win32-arm64-msvc.nodedist/native/native-config.darwin-x64.nodedist/native/native-config.darwin-arm64.nodedist/native/native-config.linux-arm64-gnu.node

Decision evidence

public snapshot

AI called this Manual Review at 72.0% confidence as Unknown with medium false-positive risk.

AI review observations

The manifest exposes a CLI and runtime module; its scripts are build, test, and validation tasks, with no declared install lifecycle hook.
The inspected agent-related code points to known skills and MCP configuration locations; the host scan shown disables command, hook, and MCP checks.
Agent MCP registration is part of an explicit init command and can be disabled with --no-mcp.
The generated native loader can load a platform binding or a library selected by NAPI_RS_NATIVE_LIBRARY_PATH; the shipped native binaries’ behavior remains unresolved.
The CLI includes a GitHub OAuth device-code exchange, but the inspected excerpt does not establish unrelated credential forwarding.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

Source & flagged code

20 flagged

dist/native/index.jsView file

Lines 35-75javascript

35 let report = null

36 if (process.report && typeof process.report.getReport === 'function') {

37 process.report.excludeNetwork = true

38 report = process.report.getReport()

39 }

40 if (!report) {

41 return null

42 }

43 if (report.header && report.header.glibcVersionRuntime) {

44 return false

45 }

46 if (Array.isArray(report.sharedObjects)) {

47 if (report.sharedObjects.some(isFileMusl)) {

48 return true

49 }

50 }

51 return false

52}

54const isMuslFromChildProcess = () => {

55 try {

56 return require('child_process').execSync('ldd --version', { encoding: 'utf8' }).includes('musl')

57 } catch (e) {

High

Child Process

Package source references child process execution.

dist/native/index.jsView on unpkg · L55

58 // If we reach this case, we don't know if the system is musl or not, so is better to just fallback to false

59 return false

60 }

61}

63function requireNative() {

64 if (process.env.NAPI_RS_NATIVE_LIBRARY_PATH) {

65 try {

66 return require(process.env.NAPI_RS_NATIVE_LIBRARY_PATH);

67 } catch (err) {

68 loadErrors.push(err)

69 }

70 } else if (process.platform === 'android') {

71 if (process.arch === 'arm64') {

72 try {

73 return require('./native-config.android-arm64.node')

74 } catch (e) {

75 loadErrors.push(e)

•matchType = token_shingles matchedPackage = @inkeep/open-knowledge@0.31.0 matchedPath = dist/native/index.js matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.31.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/native/index.jsView on unpkg

dist/dist-CbA9Te53.mjsView file

High

Shell

Package source references shell execution.

dist/dist-CbA9Te53.mjsView on unpkg · L87

87var t=null;try{t=new WebAssembly.Instance(new WebAssembly.Module(new Uint8Array([0,97,115,109,1,0,0,0,1,13,2,96,0,1,127,96,4,127,127,127,127,1,127,3,7,6,0,1,1,1,1,1,6,6,1,127,1,65,... L88: changing to the minimum size of: 2`),this._maxSize=2)}record(e){this.updateByIncrement(e,1)}setStartTime(e){this.startTime=e}toPointValue(){return{hasMinMax:this._recordMinMax,min:... L89: \t- OR - create a new view with the name ${e.name} and description '${e.description}' and InstrumentSelector ${r} ... L97: causes have become circular...`;let o=r(e);return o?(t.add(e),a+` L98: caused by: `+i(o,t)):a},a=e=>i(e,new Set),o=(e,t,i)=>{if(!n(e))return``;let a=i?``:e.message||``;if(t.has(e))return a+`: ...`;let s=r(e);if(s){t.add(e);let n=typeof e.cause==`funct... L99: `:`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/dist-CbA9Te53.mjsView on unpkg · L87

86*/ L87: var t=null;try{t=new WebAssembly.Instance(new WebAssembly.Module(new Uint8Array([0,97,115,109,1,0,0,0,1,13,2,96,0,1,127,96,4,127,127,127,127,1,127,3,7,6,0,1,1,1,1,1,6,6,1,127,1,65,... L88: changing to the minimum size of: 2`),this._maxSize=2)}record(e){this.updateByIncrement(e,1)}setStartTime(e){this.startTime=e}toPointValue(){return{hasMinMax:this._recordMinMax,min:... L89: \t- OR - create a new view with the name ${e.name} and description '${e.description}' and InstrumentSelector ${r} ... L97: causes have become circular...`;let o=r(e);return o?(t.add(e),a+` L98: caused by: `+i(o,t)):a},a=e=>i(e,new Set),o=(e,t,i)=>{if(!n(e))return``;let a=i?``:e.message||``;if(t.has(e))return a+`: ...`;let s=r(e);if(s){t.add(e);let n=typeof e.cause==`funct... L99: `:`

dist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:string-array:round1View file

1import{t as e}from"./chunk-DXB73IDG-MLBj3lvC.mjs";function t(){let e=[{prop:`Function`,target:globalThis,violationType:`function_constructor`,strategy:`throw`,reason:`Function cons... L2: `);n.register(`data:text/javascript,${encodeURIComponent(e)}`),i.importHooksRegistered=!0}}catch(e){console.debug(`[DefenseInDepthBox] Could not register import() hooks:`,e instanc...

High

Eval

Package source references dynamic code evaluation.

dist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:string-array:round1View on unpkg · L1

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:string-array:round1View on unpkg · L1

dist/index.mjsView file

1import{a as e,i as t,n,r,t as i}from"./rolldown-runtime-DPpTSio4.mjs";import"./libesm-CSMdpGMF.mjs";import"./chunk-B74TABJS-DAm9lxFL.mjs";import"./chunk-R6VWJ2ZL-Cu1kOJ3f.mjs";impo... L2: `)){let e=r.replace(tt,``),i=Qe.exec(e)?.[1];if(i){n={login:i,active:!1},t.push(n);continue}if($e.test(e)){n=void 0;continue}n&&et.test(e)&&(n.active=!0)}return t}const rt={stable:... L3: `).filter(e=>e),n=Math.min(...t.map(e=>e.length-e.trimStart().length)),r=t.map(e=>e.slice(n)).map(e=>` `.repeat(this.indent*2)+e);for(let e of r)this.content.push(e)}compile(){let ... L4: `))}};const rte={major:4,minor:4,patch:3},In=F(`$ZodType`,(e,t)=>{var n;e??={},e._zod.def=t,e._zod.bag=e._zod.bag||{},e._zod.version=rte;let r=[...e._zod.def.checks??[]];e._zod.tra... L5: if (${n}.issues.length) { ... L182: `],o,s=0

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.mjsView on unpkg · L1

1Trigger-reachable chain: manifest.exports -> dist/index.mjs L1: import{a as e,i as t,n,r,t as i}from"./rolldown-runtime-DPpTSio4.mjs";import"./libesm-CSMdpGMF.mjs";import"./chunk-B74TABJS-DAm9lxFL.mjs";import"./chunk-R6VWJ2ZL-Cu1kOJ3f.mjs";impo... L2: `)){let e=r.replace(tt,``),i=Qe.exec(e)?.[1];if(i){n={login:i,active:!1},t.push(n);continue}if($e.test(e)){n=void 0;continue}n&&et.test(e)&&(n.active=!0)}return t}const rt={stable:... L3: `).filter(e=>e),n=Math.min(...t.map(e=>e.length-e.trimStart().length)),r=t.map(e=>e.slice(n)).map(e=>` `.repeat(this.indent*2)+e);for(let e of r)this.content.push(e)}compile(){let ... L4: `))}};const rte={major:4,minor:4,patch:3},In=F(`$ZodType`,(e,t)=>{var n;e??={},e._zod.def=t,e._zod.bag=e._zod.bag||{},e._zod.version=rte;let r=[...e._zod.def.checks??[]];e.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.mjsView on unpkg · L1

dist/cli.mjsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: import{o as e}from"./rolldown-runtime-tZXQYakl.mjs";import{$a as t,$s as n,$u as r,Af as i,Bf as a,Ed as o,Ef as s,Eo as c,F as l,Fo as u,Fr as d,Gc as f,Hc as p,Hd as m,Ho as h,Ic... `)}const _a={out:e=>process.stdout.write(`${e}\n`),err:e=>process.stderr.write(`${e}\n`)},va=T({title:E().optional(),error:E().optional(),message:E().optional()});function ya(){let... `)){let e=n.trim();if(e===``)continue;let r=e.indexOf(`=`);r!==-1&&(t[e.slice(0,r)]=e.slice(r+1))}return t}function Ea(e){return new Promise((t,n)=>{let r=[];e.on(`data`,e=>r.push(... `;return`${I(`Error:`)} this project's git remote is ${n}, which is not a Git

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.mjsView on unpkg

dist/public/assets/ku-TR-NAH2Q5B7-B_Ztkp8s.jsView file

Lines 1-6javascript

1import"./chunk-SRAX5OIU-krA6W3W1.js";var e={paste:`دانانەوە`,pasteAsPlaintext:`دایبنێ وەک دەقی سادە`,pasteCharts:`دانانەوەی خشتەکان`,chartType_bar:``,chartType_line:``,chartType_radar:``,chartType_plaintext:``,selectAll:`دیاریکردنی هەموو`,multiSelect:`زیادکردنی بۆ دیاریکراوەکان`,moveCanvas:`تابلۆ بجوڵێنە`

dist/native/native-config.linux-arm64-musl.nodeView file

•path = dist/native/native-config.linux-arm64-musl.node kind = native_binary sizeBytes = 801680 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/native-config.linux-arm64-musl.nodeView on unpkg

dist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 31

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:normalized:round1View on unpkg

dist/chunk-WRU74C26-CKoV7Oqa.mjsView file

•matchType = normalized_sha256 matchedPackage = @p4code/cli@0.4.12 matchedPath = dist/client/assets/chunk-WRU74C26-C2Rb3ATV.js matchedIdentity = npm:QHA0Y29kZS9jbGk:0.4.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-WRU74C26-CKoV7Oqa.mjsView on unpkg

dist/diagram-Q27KOJAE-7KO1ITMW.mjsView file

•matchType = token_shingles matchedPackage = @p4code/cli@0.4.12 matchedPath = dist/client/assets/diagram-Q27KOJAE-Dp_H6G_V.js matchedIdentity = npm:QHA0Y29kZS9jbGk:0.4.12 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/diagram-Q27KOJAE-7KO1ITMW.mjsView on unpkg

Source & flagged code

20 flagged · loading source

dist/native/index.jsView file

55try { L56: return require('child_process').execSync('ldd --version', { encoding: 'utf8' }).includes('musl') L57: } catch (e) {

High

Child Process

Package source references child process execution.

dist/native/index.jsView on unpkg · L55

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/native/index.jsView on unpkg

dist/dist-CbA9Te53.mjsView file

Findings

4 Critical14 High5 Medium6 Low

CriticalCredential Exfiltrationdist/index.mjs

CriticalTrojan Source Unicodedist/public/assets/ku-TR-NAH2Q5B7-B_Ztkp8s.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.mjs

CriticalPrevious Version Dangerous Deltadist/index.mjs

HighChild Processdist/native/index.js

HighShelldist/dist-CbA9Te53.mjs

HighEvaldist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:string-array:round1

HighSame File Env Network Executiondist/dist-CbA9Te53.mjs

HighCredential Redirect Persistencedist/cli.mjs

HighCommand Output Exfiltrationdist/dist-CbA9Te53.mjs

HighCross File Remote Execution Contextdist/dist-CbA9Te53.mjs

Affected versions and remediation

This report applies to @inkeep/open-knowledge@0.86.18.

See all versions of @inkeep/open-knowledge for other recorded verdicts.

Review the evidence and your use of @inkeep/open-knowledge@0.86.18 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-15 21:29:18.611Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.