registry / @karajan-family/code / 4.43.0

@karajan-family/code@4.43.0

Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline

AI Security Review

scanned 5d ago · by lpm-firewall-ai

Source inspection confirms that installation automatically changes global agent configuration to register the package's own MCP server. This is a first-party extension setup with residual consent risk, so it warrants a warning; the inspected source does not establish a concrete malicious attack.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package through a lifecycle that runs its postinstall hook.

Impact

The agent clients gain access to package tools, including pipeline operations, when they next use the registered server.

Mechanism

The hook writes a local stdio server entry into the user's Claude and Codex configuration files without prompting.

AI rationale

Evidence

package.jsonscripts/postinstall.jssrc/mcp/server.jssrc/mcp/tools.js~/.claude.json~/.codex/config.toml

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package manifest runs scripts/postinstall.js automatically after installation.
That hook registers the package's local stdio MCP server in the global Claude and Codex configurations without asking first.
The registered server exposes tools for running the package's coding pipeline.
Other inspected agent integration locations cover configuration checks, project-scoped MCP wiring, or separate setup paths.

Evidence against

The configured MCP server is a local stdio process; the inspected registration code does not send credentials to a remote endpoint.
The separate installer and trash hook setup are exposed through distinct setup paths, not the postinstall registration.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

25 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/dual-publish.mjsView file

Lines 1-37javascript

1#!/usr/bin/env node

2/**

3 * dual-publish (MIG-A, KJC-TSK-0751, épica KJC-PCS-0077, ADR 0004) — el

4 * MISMO contenido sale bajo dos nombres npm durante la migración al scope:

5 * karajan-code (legacy, publish normal) y @karajan-family/code (scoped).

6 *

7 * Uso:

8 * node scripts/dual-publish.mjs --pack-only # genera+verifica el tarball scoped

9 * node scripts/dual-publish.mjs --publish --otp=XXX # publica el scoped (tras publicar el legacy)

10 *

11 * El swap del name es EN SITIO con restauración en finally: un crash a mitad

12 * no deja el manifest renombrado. La verificación es el MISMO verify-pack

13 * (name-agnóstico desde la parte 1): empaqueta, instala aislado y corre kj.

14 * El PRIMER publish del scoped lo hace el usuario (cuenta karajan-family,

15 * security key); los siguientes van con la sesión normal.

16 */

17import { readFileSync, writeFileSync } from "node:fs";

18import { execFileSync } from "node:child_process";

19import { join, dirname, resolve } from "node:path";

High

Child Process

Package source references child process execution.

scripts/dual-publish.mjsView on unpkg · L17

20import { fileURLToPath } from "node:url";

22export const LEGACY_NAME = "karajan-code";

23export const SCOPED_NAME = "@karajan-family/code";

25/**

26 * Ejecuta `fn` con el manifest renombrado al scoped (+ publishConfig public,

27 * obligatorio para scoped) y lo RESTAURA byte a byte pase lo que pase.

28 */

29export async function withScopedName(repoRoot, fn) {

30 const pkgPath = join(repoRoot, "package.json");

31 const original = readFileSync(pkgPath, "utf8");

32 const pkg = JSON.parse(original);

33 if (pkg.name !== LEGACY_NAME) {

34 throw new Error(`dual-publish: el manifest dice "${pkg.name}" y solo se renombra desde ${LEGACY_NAME} — jamás a ciegas`);

35 }

36 // publishConfig se MERGEA, no se pisa (catch de codex): un registry/tag

37 // preexistente debe sobrevivir al publish scoped.

src/review/card-verify.jsView file

17L18: const execAsync = promisify(exec); L19: export const VERIFY_TIMEOUT_MS = 4000;

High

Shell

Package source references shell execution.

src/review/card-verify.jsView on unpkg · L17

scripts/verify-pack.mjsView file

Lines 94-134javascript

95 const binPath = path.join(tmpDir, "node_modules", ".bin", "kj");

96 if (!fs.existsSync(binPath)) fail(`kj binary missing after install: ${

src/sonar/project-key.jsView file

Lines 63-103javascript

63 * sonar-project.properties es la que el servidor conoce, porque es con la que

64 * el scanner sube el analisis. Sin leerla aqui, kj escaneaba un proyecto y

65 * preguntaba por otro (una clave derivada del remote), y el audit acababa

66 * listando issues de repos ajenos del mismo SonarQube.

67 *

scripts/install.jsView file

4import path from "node:path"; L5: import { spawn } from "node:child_process"; L6: import readline from "node:readline/promises"; L7: import { stdin as input, stdout as output } from "node:process"; L8: import { tomlPath } from "./toml-value.js"; ... L10: const rl = readline.createInterface({ input, output }); L11: const REGISTRY_PATH = path.join(os.homedir(), ".karajan", "instances.json"); L12: const INSTALL_STATE_PATH = path.join(os.homedir(), ".karajan", "install-state.json"); L13: const AGENT_META = { L14: codex: { bin: "codex", installUrl: "https://developers.openai.com/codex/cli" }, L15: claude: { bin: "claude", installUrl: "https://docs.anthropic.com/en/docs/claude-code" }, ... L120: if (cliValue !== undefined) return cliValue;

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/install.jsView on unpkg · L4

src/audit/circular-deps.jsView file

75package = @karajan-family/code; repositoryIdentity = karajan-code; dependency = madge L75: try { L76: ({ default: madge } = await import("madge")); L77: } catch (err) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/audit/circular-deps.jsView on unpkg · L75

scripts/postinstall.jsView file

26await fs.mkdir(path.dirname(file), { recursive: true }); L27: await fs.writeFile(file, `${JSON.stringify(obj, null, 2)}\n`, "utf8"); L28: } L29: L30: const CLAUDE_JSON_PATH = path.join(os.homedir(), ".claude.json"); L31: ... L77: async function setupClaudeMcp(config, kjHome) { L78: config.mcpServers = config.mcpServers || {}; L79: // Keep every env key the user added to the entry; only the home is ours, L80: // and it is written under the current name (KJ_HOME is deprecated). L81: const { KJ_HOME: _stale, ...userEnv } = config.mcpServers["karajan-mcp"]?.env || {}; L82: config.mcpServers["karajan-mcp"] = {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L26

src/audit/basal-cost.jsView file

76return new Promise((resolve) => { L77: execFile("npx", ["depcheck", "--json"], { cwd: projectDir, timeout: 30000 }, (err, stdout) => { L78: if (err && !stdout) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/audit/basal-cost.jsView on unpkg · L76

vendor/tree-sitter-grammars/python.wasmView file

•path = vendor/tree-sitter-grammars/python.wasm kind = wasm_module sizeBytes = 457883 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

vendor/tree-sitter-grammars/python.wasmView on unpkg

scripts/install-binary.shView file

•path = scripts/install-binary.sh kind = build_helper sizeBytes = 7790 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-binary.shView on unpkg

bin/kj-tailView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 23

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/kj-tailView on unpkg

src/cli/register-meta.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.43.0 matchedPath = src/cli/register-meta.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.43.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High