registry / AI-agent control-surface risk / @karajan-family/code / 4.45.0

@karajan-family/code@4.45.0

Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline

AI Security Review

scanned 12d ago · by lpm-firewall-ai

The automatic install hook mutates global AI-agent configuration to register this package's MCP server without a consent guard. This is concrete unconsented postinstall modification of an AI-agent control surface and supports blocking publication.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package through npm triggers its postinstall script.

Impact

Future agent sessions may load the package's server automatically, adding its tools to the agents' capabilities.

Mechanism

The script reads existing agent configuration, adds or replaces the package's MCP server entry, and writes the updated configuration under the user's home directory.

Policy narrative

The npm postinstall hook silently registers the package's MCP server in global Claude and Codex configuration. This gives the package's server an automatic place in later agent sessions without requesting consent during installation. The inspected source establishes configuration mutation, but does not show credential theft or a remote payload.

AI rationale

Evidence

package.jsonscripts/postinstall.js~/.claude.json~/.codex/config.toml

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs scripts/postinstall.js automatically during installation.
The postinstall routine invokes both Claude and Codex MCP setup without a consent check.
The Claude setup writes a package-owned server configuration to the user's global Claude settings.
The Codex setup writes a package-owned server configuration to the user's global Codex settings.
The script suppresses setup errors so installation continues.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 721 file(s), 3.89 MB of source, external domains: aider.chat, aistudio.google.com, antigravity.google, api.github.com, cli.github.com, console.anthropic.com, developers.openai.com, docs.anthropic.com, docs.docker.com, docs.github.com, docs.sonarsource.com, firestore.googleapis.com, fonts.googleapis.com, fonts.gstatic.com, get.docker.com, git-scm.com, github.com, google.github.io, karajan-code.web.app, karajancode.com, nodejs.org, ollama.com, opencode.ai, platform.openai.com, raw.githubusercontent.com, registry.npmjs.org, semgrep.dev, sonarcloud.io, www.docker.com, www.w3.org

Source & flagged code

25 flagged

package.jsonView file

Lines 56-96json

56 "vendor/tree-sitter-grammars/",

57 "packages/hu-board/src/",

58 "packages/hu-board/public/",

59 "packages/hu-board/package.json",

60 "packages/ai-trash/src/",

61 "packages/ai-trash/bin/",

62 "packages/ai-trash/package.json",

63 "docs/karajan-code-logo-small.png",

64 "docs/README.es.md",

65 "LICENSE",

66 "README.md"

67 ],

68 "bin": {

69 "kj": "bin/kj.js",

70 "kj-tail": "bin/kj-tail",

71 "kj-trash": "packages/ai-trash/bin/kj-trash.js",

72 "karajan-mcp": "bin/karajan-mcp.js",

73 "kj-rag-mcp": "bin/kj-rag-mcp.js"

74 },

75 "scripts": {

76 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L76

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L76

77 "setup": "node scripts/install.js",

78 "test": "vitest run",

79 "test:watch": "vitest",

80 "test:coverage": "vitest run --coverage",

81 "lint": "eslint src/ packages/",

82 "lint:fix": "eslint src/ packages/ --fix",

83 "lint:syntax": "((command -v rg >/dev/null 2>&1 && rg --files src tests | rg '\\.js$') || find src tests -type f -name '*.js') | while IFS= read -r f; do node --check \"$f\"; done",

84 "format:check": "prettier --check .",

85 "format:fix": "prettier --write .",

86 "typecheck": "npx -p typescript@5 tsc --noEmit -p tsconfig.json",

87 "validate": "npm run lint && npm run lint:syntax && npm test",

88 "mcp": "node src/mcp/server.js",

89 "audit:test-diet": "node scripts/audit-test-diet.mjs",

90 "verify-pack": "node scripts/verify-pack.mjs",

91 "prepublishOnly": "node scripts/verify-pack.mjs",

92 "verify-quickstart": "node scripts/quickstart-gate.mjs"

93 },

94 "simple-git-hooks": {

95 "pre-commit": "npx lint-staged"

96 },

scripts/dual-publish.mjsView file

Lines 1-37javascript

1#!/usr/bin/env node

2/**

3 * dual-publish (MIG-A, KJC-TSK-0751, épica KJC-PCS-0077, ADR 0004) — el

4 * MISMO contenido sale bajo dos nombres npm durante la migración al scope:

5 * karajan-code (legacy, publish normal) y @karajan-family/code (scoped).

6 *

7 * Uso:

8 * node scripts/dual-publish.mjs --pack-only # genera+verifica el tarball scoped

9 * node scripts/dual-publish.mjs --publish --otp=XXX # publica el scoped (tras publicar el legacy)

10 *

src/review/card-verify.jsView file

Lines 1-37javascript

1/**

2 * card-verify — KJC-TSK-0732 (issue #1371). With a declared tracker,

3 * card-first upgrades "the branch names a card" to "the tracker says that

4 * card is ALIVE". Transport-agnostic: `board.verify_cmd` is the USER'S

5 * adapter (their CLI/MCP wrapper — credentials never enter kj) printing

6 * {exists, live, status?} JSON on stdout. Unverifiable NEVER blocks: it

7 * degrades to branch-ref level SAYING SO — a gate must not claim a check

8 * it didn't make, in either direction. Definitive verdicts are cached

9 * briefly; degradations never are, so recovery is immediate.

scripts/verify-pack.mjsView file

Lines 94-134javascript

95 const binPath = path.join(tmpDir, "node_modules", ".bin", "kj");

96 if (!fs.existsSync(binPath)) fail(`kj binary missing after install: ${

src/sonar/project-key.jsView file

Lines 63-103javascript

63 * sonar-project.properties es la que el servidor conoce, porque es con la que

64 * el scanner sube el analisis. Sin leerla aqui, kj escaneaba un proyecto y

65 * preguntaba por otro (una clave derivada del remote), y el audit acababa

66 * listando issues de repos ajenos del mismo SonarQube.

67 *

scripts/install.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import fs from "node:fs/promises";

3import os from "node:os";

4import path from "node:path";

5import { spawn } from

src/audit/circular-deps.jsView file

Lines 55-95javascript

55/**

56 * Collect circular-import findings for a project.

57 *

58 * @param {string} projectDir

59 * @param {object} stack - shape returned by detectProjectStack()

60 * @param {object}

scripts/postinstall.jsView file

26await fs.mkdir(path.dirname(file), { recursive: true }); L27: await fs.writeFile(file, `${JSON.stringify(obj, null, 2)}\n`, "utf8"); L28: } L29: L30: const CLAUDE_JSON_PATH = path.join(os.homedir(), ".claude.json"); L31: ... L77: async function setupClaudeMcp(config, kjHome) { L78: config.mcpServers = config.mcpServers || {}; L79: // Keep every env key the user added to the entry; only the home is ours, L80: // and it is written under the current name (KJ_HOME is deprecated). L81: const { KJ_HOME: _stale, ...userEnv } = config.mcpServers["karajan-mcp"]?.env || {}; L82: config.mcpServers["karajan-mcp"] = {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L26

src/audit/basal-cost.jsView file

76return new Promise((resolve) => { L77: execFile("npx", ["depcheck", "--json"], { cwd: projectDir, timeout: 30000 }, (err, stdout) => { L78: if (err && !stdout) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/audit/basal-cost.jsView on unpkg · L76

vendor/tree-sitter-grammars/python.wasmView file

•path = vendor/tree-sitter-grammars/python.wasm kind = wasm_module sizeBytes = 457883 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

vendor/tree-sitter-grammars/python.wasmView on unpkg

scripts/install-binary.shView file

•path = scripts/install-binary.sh kind = build_helper sizeBytes = 7790 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-binary.shView on unpkg

bin/kj-tailView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 23

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/kj-tailView on unpkg

src/cli/register-meta.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.46.0 matchedPath = src/cli/register-meta.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.46.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High