Loading npm security reports…

@karajan-family/code@4.28.0: AI-agent control-surface risk | LPM Firewall

registry / @karajan-family/code / 4.28.0

@karajan-family/code@4.28.0

Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package silently registers a package-controlled MCP server in both Claude and Codex user configuration. This mutates broad AI-agent control surfaces without an explicit user command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation, through the postinstall lifecycle hook.

Impact

Future AI-agent sessions can launch the package's MCP server with the user's agent context.

Mechanism

Automatic overwrite of Claude and Codex MCP configuration.

Policy narrative

npm runs scripts/postinstall.js automatically. The script adds a karajan-mcp stdio server to the user's ~/.claude.json and writes a managed block to ~/.codex/config.toml. Both entries point to this installed package's MCP server. The hook does this non-interactively and catches errors so installation remains successful. This is an unconsented persistence and control-surface modification affecting AI-agent clients.

AI rationale

The package performs unconsented postinstall mutation of foreign, broad AI-agent configuration files. That concrete automatic control-surface change meets the publish-block policy even without observed exfiltration.

Evidence

package.jsonscripts/postinstall.js~/.claude.json~/.codex/config.tomlsrc/mcp/server.js

Decision evidence

public snapshot

Source & flagged code

25 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/dual-publish.mjsView file

17import { readFileSync, writeFileSync } from "node:fs"; L18: import { execFileSync } from "node:child_process"; L19: import { join, dirname, resolve } from "node:path";

High

Child Process

Package source references child process execution.

scripts/dual-publish.mjsView on unpkg · L17

src/agents/resolve-bin.jsView file

65L66: // 3. Fallback: return name as-is (let execa try PATH) L67: cache.set(name, name);

High

Shell

Package source references shell execution.

src/agents/resolve-bin.jsView on unpkg · L65

scripts/verify-pack.mjsView file

95// pattern lookalikes). L96: const { scanPaths, loadPrivacyList } = await import( L97: path.join(repoRoot, "src", "privacy", "scan.js")

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/verify-pack.mjsView on unpkg · L95

src/sonar/project-key.jsView file

59const explicit = String( L60: options.projectKey || process.env.KJ_SONAR_PROJECT_KEY || config?.sonarqube?.project_key || "" L61: ).trim(); ... L66: const remote = await runCommand("git", ["config", "--get", "remote.origin.url"]); L67: const remoteUrl = String(remote.stdout || "").trim(); L68: if (remote.exitCode !== 0 || !remoteUrl) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/sonar/project-key.jsView on unpkg · L59

scripts/install.jsView file

4import path from "node:path"; L5: import { spawn } from "node:child_process"; L6: import readline from "node:readline/promises"; L7: import { stdin as input, stdout as output } from "node:process"; L8: import { tomlPath } from "./toml-value.js"; ... L10: const rl = readline.createInterface({ input, output }); L11: const REGISTRY_PATH = path.join(os.homedir(), ".karajan", "instances.json"); L12: const INSTALL_STATE_PATH = path.join(os.homedir(), ".karajan", "install-state.json"); L13: const AGENT_META = { L14: codex: { bin: "codex", installUrl: "https://developers.openai.com/codex/cli" }, L15: claude: { bin: "claude", installUrl: "https://docs.anthropic.com/en/docs/claude-code" }, ... L120: if (cliValue !== undefined) return cliValue;

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/install.jsView on unpkg · L4

src/audit/circular-deps.jsView file

74package = @karajan-family/code; repositoryIdentity = karajan-code; dependency = madge L74: try { L75: ({ default: madge } = await import("madge")); L76: } catch (err) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/audit/circular-deps.jsView on unpkg · L74

scripts/postinstall.jsView file

26await fs.mkdir(path.dirname(file), { recursive: true }); L27: await fs.writeFile(file, `${JSON.stringify(obj, null, 2)}\n`, "utf8"); L28: } ... L49: async function setupClaudeMcp(kjHome) { L50: const claudeJsonPath = path.join(os.homedir(), ".claude.json"); L51: let config = {}; ... L57: L58: config.mcpServers = config.mcpServers || {}; L59: config.mcpServers["karajan-mcp"] = { L60: type: "stdio", ... L84: async function setupCodexMcp(kjHome) { L85: const configPath = path.join(os.homedir(), ".codex", "config.toml");

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L26

src/audit/basal-cost.jsView file

76return new Promise((resolve) => { L77: execFile("npx", ["depcheck", "--json"], { cwd: projectDir, timeout: 30000 }, (err, stdout) => { L78: if (err && !stdout) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/audit/basal-cost.jsView on unpkg · L76

vendor/tree-sitter-grammars/python.wasmView file

•path = vendor/tree-sitter-grammars/python.wasm kind = wasm_module sizeBytes = 457883 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

vendor/tree-sitter-grammars/python.wasmView on unpkg

scripts/install-binary.shView file

•path = scripts/install-binary.sh kind = build_helper sizeBytes = 7790 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-binary.shView on unpkg

bin/kj-tailView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 22

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/kj-tailView on unpkg

src/commands/board.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.24.0 matchedPath = src/commands/board.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.24.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/board.jsView on unpkg

src/utils/update-check.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.24.0 matchedPath = src/utils/update-check.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.24.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/update-check.jsView on unpkg

packages/ai-trash/src/git-snapshot.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.24.0 matchedPath = packages/ai-trash/src/git-snapshot.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.24.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/ai-trash/src/git-snapshot.jsView on unpkg

src/commands/audit.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.24.0 matchedPath = src/commands/audit.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.24.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/audit.jsView on unpkg

src/commands/install-tools.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.24.0 matchedPath = src/commands/install-tools.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.24.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/install-tools.jsView on unpkg

src/hu/store.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.24.0 matchedPath = src/hu/store.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.24.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/hu/store.jsView on unpkg

src/sonar/scanner.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.24.0 matchedPath = src/sonar/scanner.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.24.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sonar/scanner.jsView on unpkg

src/utils/tool-installer.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.24.0 matchedPath = src/utils/tool-installer.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.24.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/tool-installer.jsView on unpkg

src/checks/mcp-health.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.24.0 matchedPath = src/checks/mcp-health.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.24.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/checks/mcp-health.jsView on unpkg

src/commands/standby.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.24.0 matchedPath = src/commands/standby.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.24.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/standby.jsView on unpkg

src/commands/watch.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.24.0 matchedPath = src/commands/watch.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.24.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/watch.jsView on unpkg

src/harden/sentinel-hooks.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.24.0 matchedPath = src/harden/sentinel-hooks.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.24.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/harden/sentinel-hooks.jsView on unpkg

Source & flagged code

25 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/dual-publish.mjsView file

17import { readFileSync, writeFileSync } from "node:fs"; L18: import { execFileSync } from "node:child_process"; L19: import { join, dirname, resolve } from "node:path";

High

Child Process

Package source references child process execution.

scripts/dual-publish.mjsView on unpkg · L17

src/agents/resolve-bin.jsView file

65L66: // 3. Fallback: return name as-is (let execa try PATH) L67: cache.set(name, name);

High

Shell

Package source references shell execution.

src/agents/resolve-bin.jsView on unpkg · L65

scripts/verify-pack.mjsView file

95// pattern lookalikes). L96: const { scanPaths, loadPrivacyList } = await import( L97: path.join(repoRoot, "src", "privacy", "scan.js")

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/verify-pack.mjsView on unpkg · L95

src/sonar/project-key.jsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/sonar/project-key.jsView on unpkg · L59

scripts/install.jsView file

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/install.jsView on unpkg · L4

src/audit/circular-deps.jsView file

74package = @karajan-family/code; repositoryIdentity = karajan-code; dependency = madge L74: try { L75: ({ default: madge } = await import("madge")); L76: } catch (err) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/audit/circular-deps.jsView on unpkg · L74

scripts/postinstall.jsView file

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L26

src/audit/basal-cost.jsView file

76return new Promise((resolve) => { L77: execFile("npx", ["depcheck", "--json"], { cwd: projectDir, timeout: 30000 }, (err, stdout) => { L78: if (err && !stdout) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/audit/basal-cost.jsView on unpkg · L76

vendor/tree-sitter-grammars/python.wasmView file

•path = vendor/tree-sitter-grammars/python.wasm kind = wasm_module sizeBytes = 457883 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

vendor/tree-sitter-grammars/python.wasmView on unpkg

scripts/install-binary.shView file

•path = scripts/install-binary.sh kind = build_helper sizeBytes = 7790 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-binary.shView on unpkg

bin/kj-tailView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 22

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/kj-tailView on unpkg

src/commands/board.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/board.jsView on unpkg

src/utils/update-check.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/update-check.jsView on unpkg

packages/ai-trash/src/git-snapshot.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/ai-trash/src/git-snapshot.jsView on unpkg

src/commands/audit.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/audit.jsView on unpkg

src/commands/install-tools.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/install-tools.jsView on unpkg

src/hu/store.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/hu/store.jsView on unpkg

src/sonar/scanner.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sonar/scanner.jsView on unpkg

src/utils/tool-installer.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/tool-installer.jsView on unpkg

src/checks/mcp-health.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/checks/mcp-health.jsView on unpkg

src/commands/standby.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/standby.jsView on unpkg

src/commands/watch.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/watch.jsView on unpkg

src/harden/sentinel-hooks.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/harden/sentinel-hooks.jsView on unpkg

Source & flagged code

25 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/dual-publish.mjsView file

17import { readFileSync, writeFileSync } from "node:fs"; L18: import { execFileSync } from "node:child_process"; L19: import { join, dirname, resolve } from "node:path";

High

Child Process

Package source references child process execution.

scripts/dual-publish.mjsView on unpkg · L17

src/agents/resolve-bin.jsView file

65L66: // 3. Fallback: return name as-is (let execa try PATH) L67: cache.set(name, name);

High

Shell

Package source references shell execution.

src/agents/resolve-bin.jsView on unpkg · L65

scripts/verify-pack.mjsView file

95// pattern lookalikes). L96: const { scanPaths, loadPrivacyList } = await import( L97: path.join(repoRoot, "src", "privacy", "scan.js")

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/verify-pack.mjsView on unpkg · L95

src/sonar/project-key.jsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/sonar/project-key.jsView on unpkg · L59

scripts/install.jsView file

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/install.jsView on unpkg · L4

src/audit/circular-deps.jsView file

74package = @karajan-family/code; repositoryIdentity = karajan-code; dependency = madge L74: try { L75: ({ default: madge } = await import("madge")); L76: } catch (err) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/audit/circular-deps.jsView on unpkg · L74

scripts/postinstall.jsView file

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L26

src/audit/basal-cost.jsView file

76return new Promise((resolve) => { L77: execFile("npx", ["depcheck", "--json"], { cwd: projectDir, timeout: 30000 }, (err, stdout) => { L78: if (err && !stdout) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/audit/basal-cost.jsView on unpkg · L76

vendor/tree-sitter-grammars/python.wasmView file

•path = vendor/tree-sitter-grammars/python.wasm kind = wasm_module sizeBytes = 457883 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

vendor/tree-sitter-grammars/python.wasmView on unpkg

scripts/install-binary.shView file

•path = scripts/install-binary.sh kind = build_helper sizeBytes = 7790 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-binary.shView on unpkg

bin/kj-tailView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 22

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/kj-tailView on unpkg

src/commands/board.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/board.jsView on unpkg

src/utils/update-check.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/update-check.jsView on unpkg

packages/ai-trash/src/git-snapshot.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/ai-trash/src/git-snapshot.jsView on unpkg

src/commands/audit.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/audit.jsView on unpkg

src/commands/install-tools.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/install-tools.jsView on unpkg

src/hu/store.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/hu/store.jsView on unpkg

src/sonar/scanner.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sonar/scanner.jsView on unpkg

src/utils/tool-installer.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/tool-installer.jsView on unpkg

src/checks/mcp-health.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/checks/mcp-health.jsView on unpkg

src/commands/standby.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/standby.jsView on unpkg

src/commands/watch.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/watch.jsView on unpkg

src/harden/sentinel-hooks.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/harden/sentinel-hooks.jsView on unpkg

@karajan-family/code@4.28.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code