registry / AI-agent capability abuse / @inkeep/open-knowledge / 0.86.4

@inkeep/open-knowledge@0.86.4

Local-first, agent-friendly Markdown knowledge base with a cross-platform CLI and web editor

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Source confirms a first-party MCP setup feature that writes editor configuration when the user runs the init command; non-interactive runs select both scopes. This merits a warning for agent capability, but the inspected behavior does not support a malicious verdict or publish block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

The user runs the init command with MCP registration enabled, which is the default; non-interactive setup selects user and project scopes.

Impact

Configured editors can invoke the package’s local MCP tools. The source supports a capability warning but does not show malicious use of that access.

Mechanism

The initializer writes the package’s MCP server entry to the chosen editor configurations. The no-MCP option skips those changes.

AI rationale

Evidence

dist/init-Dn4c5P9j.mjs~/.cursor/mcp.json$CODEX_HOME/config.toml.mcp.json

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest exposes the CLI through dist/cli.mjs under the open-knowledge and ok command names.
The init command registers the package’s MCP server with selected editors by default; the user can disable those changes, and the command passes its options to the initialization routine.
Interactive setup offers user and project scopes; non-interactive setup selects both, and the initialization routine writes entries for selected scopes.
The editor configuration writer creates structured server entries. Source identifies paths including ~/.cursor/mcp.json, CODEX_HOME/config.toml, and .mcp.json.
Other agent-related hint locations map skill directories, perform explicit cleanup, or check for project command, hook, and MCP directories.
The server’s OpenTelemetry initialization requires a local sink or an explicit environment setting to enable the exporter.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEval

Source & flagged code

22 flagged

dist/public/assets/chunk-A66AFZZU-SD63gUWy.jsView file

1patternName = google_api_key severity = high line = 1

High

High Secret

Package contains a high-severity secret pattern.

dist/public/assets/chunk-A66AFZZU-SD63gUWy.jsView on unpkg · L1

1patternName = google_api_key severity = high line = 1

High

Secret Pattern

Google API key in dist/public/assets/chunk-A66AFZZU-SD63gUWy.js

dist/public/assets/chunk-A66AFZZU-SD63gUWy.jsView on unpkg · L1

dist/start-D3w5OYYR.mjsView file

1import{F as e,S as t,X as n,Z as r,_l as i,i as a,pd as o}from"./md-manager-BGnqyqi1-CMF2qMhD.mjs";import{Ii as s,as as c,bi as l,ci as u,gs as d,k as f,rs as p,wi as m}from"./dist... L2: `)){let e=r.replace(me,``),i=de.exec(e)?.[1];if(i){n={login:i,active:!1},t.push(n);continue}if(fe.test(e)){n=void 0;continue}n&&pe.test(e)&&(n.active=!0)}return t}const ge={mode:`p...

High

Child Process

Package source references child process execution.

dist/start-D3w5OYYR.mjsView on unpkg · L1

dist/index.mjsView file

1import{a as e,i as t,n,r,t as i}from"./rolldown-runtime-DPpTSio4.mjs";import"./libesm-CSMdpGMF.mjs";import"./chunk-B74TABJS-DAm9lxFL.mjs";import"./chunk-R6VWJ2ZL-Cu1kOJ3f.mjs";impo... L2: `)){let e=r.replace(tt,``),i=Qe.exec(e)?.[1];if(i){n={login:i,active:!1},t.push(n);continue}if($e.test(e)){n=void 0;continue}n&&et.test(e)&&(n.active=!0)}return t}const rt={stable:... L3: `).filter(e=>e),n=Math.min(...t.map(e=>e.length-e.trimStart().length)),r=t.map(e=>e.slice(n)).map(e=>` `.repeat(this.indent*2)+e);for(let e of r)this.content.push(e)}compile(){let ... L4: `))}};const tte={major:4,minor:4,patch:3},Mn=F(`$ZodType`,(e,t)=>{var n;e??={},e._zod.def=t,e._zod.bag=e._zod.bag||{},e._zod.version=tte;let r=[...e._zod.def.checks??[]];e._zod.tra... L5: if (${n}.issues.length) { ... L182: `],o,s=0

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.mjsView on unpkg · L1

1Trigger-reachable chain: manifest.exports -> dist/index.mjs L1: import{a as e,i as t,n,r,t as i}from"./rolldown-runtime-DPpTSio4.mjs";import"./libesm-CSMdpGMF.mjs";import"./chunk-B74TABJS-DAm9lxFL.mjs";import"./chunk-R6VWJ2ZL-Cu1kOJ3f.mjs";impo... L2: `)){let e=r.replace(tt,``),i=Qe.exec(e)?.[1];if(i){n={login:i,active:!1},t.push(n);continue}if($e.test(e)){n=void 0;continue}n&&et.test(e)&&(n.active=!0)}return t}const rt={stable:... L3: `).filter(e=>e),n=Math.min(...t.map(e=>e.length-e.trimStart().length)),r=t.map(e=>e.slice(n)).map(e=>` `.repeat(this.indent*2)+e);for(let e of r)this.content.push(e)}compile(){let ... L4: `))}};const tte={major:4,minor:4,patch:3},Mn=F(`$ZodType`,(e,t)=>{var n;e??={},e._zod.def=t,e._zod.bag=e._zod.bag||{},e._zod.version=tte;let r=[...e._zod.def.checks??[]];e.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.mjsView on unpkg · L1

dist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:string-array:round1View file

1import{t as e}from"./chunk-DXB73IDG-MLBj3lvC.mjs";function t(){let e=[{prop:`Function`,target:globalThis,violationType:`function_constructor`,strategy:`throw`,reason:`Function cons... L2: `);n.register(`data:text/javascript,${encodeURIComponent(e)}`),i.importHooksRegistered=!0}}catch(e){console.debug(`[DefenseInDepthBox] Could not register import() hooks:`,e instanc...

High

Eval

Package source references dynamic code evaluation.

dist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:string-array:round1View on unpkg · L1

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:string-array:round1View on unpkg · L1

dist/src-D-ze6aYc.mjsView file

1import{o as e}from"./rolldown-runtime-tZXQYakl.mjs";import{Df as t,Fl as n,H as r,Jc as i,Pl as a,Sf as o,Tf as s,U as c,Uc as l,W as u,l as d,mf as f,qc as p,qu as m,u as ee,va as... L2: `)[0]??``).replace(/\S*\/journal\/\S*/g,`<journal path>`).replace(/\b[0-9a-f]{32}\b/gi,`<id>`);return`exit ${e.status}${t===``?``:`: ${t}`}`}function J(e,t,n){return{schemaVersion:... ... L10: `)?` L11: `:``;K(e,`${JSON.stringify(r,null,2)}${i}`)}catch{let r=yn(n,t.contentDirSpellings);r!==n&&K(e,r)}}function wn(e,t){let n=U(e,`utf-8`),r=yn(n,t.contentDirSpellings);r!==n&&K(e,r)}f... L12: `)}\n`:null}catch{return null}}function Zn(e){let t=R(e,`.git`,`ok`);if(!V(t))return null;let n=he(`git`,[`-C`,t,`log`,`--oneline`,`-50`],k({encoding:`utf-8`,timeout:2e3}));return ...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src-D-ze6aYc.mjsView on unpkg · L1

dist/dist-CaSGeKHK.mjsView file

1import{a as e,i as t,n,o as r,r as i,t as a}from"./rolldown-runtime-tZXQYakl.mjs";import{$ as o,$a as s,$c as c,$d as l,$i as u,$l as d,$n as f,$o as p,$r as m,$s as h,$t as g,$u a... L2: `,t),r=n===-1?e.length:n;if(r>t&&e[r-1]===`\r`&&--r,r-t>1024)return 0;let i=e.slice(t,r);return i.length===0||!Noe.test(i)&&!Poe.test(i)?0:i.length}const Ioe=/&#(?:x[0-9A-Fa-f]+|X[... ... L66: </div>`}];function qoe(e){return["```html preview",e.html,"```"].join(` L67: `)}const Joe=[{name:`--chart-1`,light:`oklch(0.62 0.19 259)`,dark:`oklch(0.72 0.14 259)`},{name:`--chart-2`,light:`oklch(0.58 0.14 145)`,dark:`oklch(0.73 0.13 145)`},{name:`--chart... L68: /** ... L87: var t=null;try{t=new WebAssembly.Instance(new WebAssembly.Module(new Uint8Array([0,97,115,109,1,0,0,0,1,13,2,96,0,1,127,96,4,127,127,127

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/dist-CaSGeKHK.mjsView on unpkg · L1

•matchType = previous_version_dangerous_delta matchedPackage = @inkeep/open-knowledge@0.86.8 matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.86.8 similarity = 0.992 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/dist-CaSGeKHK.mjsView on unpkg

1Cross-file remote execution chain: dist/dist-CaSGeKHK.mjs spawns dist/chunk-5QMZ5MUS-BuB3i_B5.mjs; helper contains network access plus dynamic code execution. L1: import{a as e,i as t,n,o as r,r as i,t as a}from"./rolldown-runtime-tZXQYakl.mjs";import{$ as o,$a as s,$c as c,$d as l,$i as u,$l as d,$n as f,$o as p,$r as m,$s as h,$t as g,$u a... L2: `,t),r=n===-1?e.length:n;if(r>t&&e[r-1]===`\r`&&--r,r-t>1024)return 0;let i=e.slice(t,r);return i.length===0||!Noe.test(i)&&!Poe.test(i)?0:i.length}const Ioe=/&#(?:x[0-9A-Fa-f]+|X[... ... L66: </div>`}];function qoe(e){return["```html preview",e.html,"```"].join(` L67: `)}const Joe=[{name:`--chart-1`,light:`oklch(0.62 0.19 259)`,dark:`oklch(0.72 0.14 259)`},{name:`--chart-2`,light:`oklch(0.58 0.14 145)`,dark:`oklch(0.73 0.13 145)`},{name:`--char

dist/cli.mjsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: import{o as e}from"./rolldown-runtime-tZXQYakl.mjs";import{$d as t,$l as n,Ac as r,Ao as i,Co as a,Dd as o,Df as s,Ed as c,Ef as l,Hc as u,Ic as d,Id as f,Io as p,Ja as m,Jl as h,J... `)}const ga={out:e=>process.stdout.write(`${e}\n`),err:e=>process.stderr.write(`${e}\n`)},_a=T({title:C().optional(),error:C().optional(),message:C().optional()});function va(e){re... `)){let e=n.trim();if(e===``)continue;let r=e.indexOf(`=`);r!==-1&&(t[e.slice(0,r)]=e.slice(r+1))}return t}function wa(e){return new Promise((t,n)=>{let r=[];e.on(`data`,e=>r.push(... `;return`${I(`Error:`)} this project's git remote is ${r}, which is not a Git

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.mjsView on unpkg

dist/public/assets/src-MzLcycFi.jsView file

2contains invisible/control Unicode U+2060 (word joiner) `);e!==r&&t.delete(e+n,r-e),s.length>0&&t.insert(e+n,s),n+=s.length-(r-e)})},this.conf)}destroy(){this._ytext.unobserve(this._observer)}},T=h.fromClass(w),E=p.baseTheme({".cm-ySelection":{},".cm-yLineSelection":{padding:0,margin:`0px 2px 0p

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/public/assets/src-MzLcycFi.jsView on unpkg · L2

dist/native/native-config.linux-arm64-musl.nodeView file

•path = dist/native/native-config.linux-arm64-musl.node kind = native_binary sizeBytes = 801680 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/native-config.linux-arm64-musl.nodeView on unpkg

dist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 33

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:normalized:round1View on unpkg

dist/native/index.jsView file

•matchType = token_shingles matchedPackage = @inkeep/open-knowledge@0.31.0 matchedPath = dist/native/index.js matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.31.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/native/index.jsView on unpkg

dist/chunk-WRU74C26-CKoV7Oqa.mjsView file

•matchType = normalized_sha256 matchedPackage = @p4code/cli@0.4.12 matchedPath = dist/client/assets/chunk-WRU74C26-C2Rb3ATV.js matchedIdentity = npm:QHA0Y29kZS9jbGk:0.4.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-WRU74C26-CKoV7Oqa.mjsView on unpkg

dist/diagram-Q27KOJAE-7KO1ITMW.mjsView file

•matchType = token_shingles matchedPackage = @p4code/cli@0.4.12 matchedPath = dist/client/assets/diagram-Q27KOJAE-Dp_H6G_V.js matchedIdentity = npm:QHA0Y29kZS9jbGk:0.4.12 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/diagram-Q27KOJAE-7KO1ITMW.mjsView on unpkg

Source & flagged code

22 flagged · loading source

dist/public/assets/chunk-A66AFZZU-SD63gUWy.jsView file

1patternName = google_api_key severity = high line = 1

High

High Secret

Package contains a high-severity secret pattern.

dist/public/assets/chunk-A66AFZZU-SD63gUWy.jsView on unpkg · L1

1patternName = google_api_key severity = high line = 1

High

Secret Pattern

Google API key in dist/public/assets/chunk-A66AFZZU-SD63gUWy.js

dist/public/assets/chunk-A66AFZZU-SD63gUWy.jsView on unpkg · L1

dist/start-D3w5OYYR.mjsView file

Findings

5 Critical15 High5 Medium6 Low

CriticalHardcoded Runtime Data Exfiltrationdist/dist-CaSGeKHK.mjs

CriticalCredential Exfiltrationdist/index.mjs

CriticalTrojan Source Unicodedist/public/assets/src-MzLcycFi.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.mjs

CriticalPrevious Version Dangerous Deltadist/dist-CaSGeKHK.mjs

HighHigh Secretdist/public/assets/chunk-A66AFZZU-SD63gUWy.js

HighChild Processdist/start-D3w5OYYR.mjs

HighShelldist/index.mjs

HighEvaldist/chunk-5QMZ5MUS-B37CnsNb.mjs#virtual:string-array:round1

HighSame File Env Network Executiondist/src-D-ze6aYc.mjs

HighCredential Redirect Persistencedist/cli.mjs

Affected versions and remediation

This report applies to @inkeep/open-knowledge@0.86.4.

See all versions of @inkeep/open-knowledge for other recorded verdicts.

Review the evidence and your use of @inkeep/open-knowledge@0.86.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-12 22:47:39.158Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code