registry / @karajan-family/code / 4.55.0

@karajan-family/code@4.55.0

Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The automatic global agent registration warrants a warning for lifecycle extension risk. The inspected code shows package-owned setup and no unrelated payload or credential transfer.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the npm package runs its postinstall hook.

Impact

Subsequent agent sessions may load the package's MCP capabilities.

Mechanism

The hook writes a karajan-mcp entry that launches this package's local MCP server.

AI rationale

The automatic global agent registration warrants a warning for lifecycle extension risk. The inspected code shows package-owned setup and no unrelated payload or credential transfer.

Evidence

package.jsonscripts/postinstall.js~/.claude.json~/.codex/config.toml

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json runs scripts/postinstall.js automatically during installation.
The postinstall main function calls both agent configuration writers without a consent check.
The hook registers this package's local MCP server in global Claude Code configuration.
It also adds a karajan-mcp entry to global Codex configuration and writes the file.
Other flagged locations include a temporary fixture hook, configuration checks, project-file reading, and a separate CLI hook installer requiring an explicit flag.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 750 file(s), 4.06 MB of source, external domains: aider.chat, aistudio.google.com, antigravity.google, api.github.com, cli.github.com, console.anthropic.com, developers.openai.com, docs.anthropic.com, docs.docker.com, docs.github.com, docs.sonarsource.com, firestore.googleapis.com, fonts.googleapis.com, fonts.gstatic.com, get.docker.com, git-scm.com, github.com, google.github.io, karajan-code.web.app, karajancode.com, nodejs.org, ollama.com, opencode.ai, platform.openai.com, raw.githubusercontent.com, registry.npmjs.org, semgrep.dev, sonarcloud.io, www.docker.com, www.w3.org

Source & flagged code

24 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/dual-publish.mjsView file

17import { readFileSync, writeFileSync } from "node:fs"; L18: import { execFileSync } from "node:child_process"; L19: import { join, dirname, resolve } from "node:path";

High

Child Process

Package source references child process execution.

scripts/dual-publish.mjsView on unpkg · L17

src/review/card-verify.jsView file

17L18: const execAsync = promisify(exec); L19: export const VERIFY_TIMEOUT_MS = 4000;

High

Shell

Package source references shell execution.

src/review/card-verify.jsView on unpkg · L17

scripts/verify-pack.mjsView file

114// pattern lookalikes). L115: const { scanPaths, loadPrivacyList } = await import( L116: path.join(repoRoot, "src", "privacy", "scan.js")

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/verify-pack.mjsView on unpkg · L114

src/sonar/project-key.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.49.3 matchedPath = src/sonar/project-key.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.49.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sonar/project-key.jsView on unpkg

83const explicit = String( L84: options.projectKey || process.env.KJ_SONAR_PROJECT_KEY || config?.sonarqube?.project_key || "" L85: ).trim(); ... L99: const remote = await runCommand("git", ["config", "--get", "remote.origin.url"]); L100: const remoteUrl = String(remote.stdout || "").trim(); L101: if (remote.exitCode !== 0 || !remoteUrl) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/sonar/project-key.jsView on unpkg · L83

scripts/install.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import fs from "node:fs/promises";

3import os from "node:os";

4import path from "node:path";

5import { spawn } from

scripts/postinstall.jsView file

26await fs.mkdir(path.dirname(file), { recursive: true }); L27: await fs.writeFile(file, `${JSON.stringify(obj, null, 2)}\n`, "utf8"); L28: } L29: L30: const CLAUDE_JSON_PATH = path.join(os.homedir(), ".claude.json"); L31: ... L77: async function setupClaudeMcp(config, kjHome) { L78: config.mcpServers = config.mcpServers || {}; L79: // Keep every env key the user added to the entry; only the home is ours, L80: // and it is written under the current name (KJ_HOME is deprecated). L81: const { KJ_HOME: _stale, ...userEnv } = config.mcpServers["karajan-mcp"]?.env || {}; L82: config.mcpServers["karajan-mcp"] = {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L26

src/audit/basal-cost.jsView file

76return new Promise((resolve) => { L77: execFile("npx", ["depcheck", "--json"], { cwd: projectDir, timeout: 30000 }, (err, stdout) => { L78: if (err && !stdout) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/audit/basal-cost.jsView on unpkg · L76

vendor/tree-sitter-grammars/python.wasmView file

•path = vendor/tree-sitter-grammars/python.wasm kind = wasm_module sizeBytes = 457883 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

vendor/tree-sitter-grammars/python.wasmView on unpkg

scripts/install-binary.shView file

•path = scripts/install-binary.sh kind = build_helper sizeBytes = 7790 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-binary.shView on unpkg

bin/kj-tailView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 24

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/kj-tailView on unpkg

src/commands/board.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.49.3 matchedPath = src/commands/board.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.49.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/board.jsView on unpkg

src/utils/update-check.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.49.3 matchedPath = src/utils/update-check.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.49.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/update-check.jsView on unpkg

packages/ai-trash/src/git-snapshot.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.49.3 matchedPath = packages/ai-trash/src/git-snapshot.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.49.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/ai-trash/src/git-snapshot.jsView on unpkg

src/commands/audit.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.49.3 matchedPath = src/commands/audit.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.49.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/audit.jsView on unpkg

src/commands/go.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.49.3 matchedPath = src/commands/go.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.49.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/go.jsView on unpkg

src/commands/install-tools.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.49.3 matchedPath = src/commands/install-tools.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.49.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/install-tools.jsView on unpkg

src/utils/tool-installer.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.49.3 matchedPath = src/utils/tool-installer.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.49.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/tool-installer.jsView on unpkg

src/checks/mcp-health.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.49.3 matchedPath = src/checks/mcp-health.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.49.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/checks/mcp-health.jsView on unpkg

src/commands/standby.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.49.3 matchedPath = src/commands/standby.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.49.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/standby.jsView on unpkg

src/commands/watch.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.49.3 matchedPath = src/commands/watch.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.49.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/watch.jsView on unpkg

src/harden/sentinel-hooks.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.49.3 matchedPath = src/harden/sentinel-hooks.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.49.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/harden/sentinel-hooks.jsView on unpkg

Source & flagged code

24 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/dual-publish.mjsView file

17import { readFileSync, writeFileSync } from "node:fs"; L18: import { execFileSync } from "node:child_process"; L19: import { join, dirname, resolve } from "node:path";

High

Child Process

Package source references child process execution.

scripts/dual-publish.mjsView on unpkg · L17

Findings

1 Critical17 High8 Medium7 Low

CriticalAi Agent Control Hijackscripts/postinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processscripts/dual-publish.mjs

HighShellsrc/review/card-verify.js

HighRuntime Package Installsrc/audit/basal-cost.js

HighSemantic Analysis Limitedbin/kj-tail

HighKnown Malware Source Similaritysrc/commands/board.js

HighKnown Malware Source Similaritysrc/utils/update-check.js

HighKnown Malware Source Similaritypackages/ai-trash/src/git-snapshot.js

HighKnown Malware Source Similaritysrc/commands/audit.js

HighKnown Malware Source Similaritysrc/commands/go.js

Affected versions and remediation

This report applies to @karajan-family/code@4.55.0.

See all versions of @karajan-family/code for other recorded verdicts.

Review the evidence and your use of @karajan-family/code@4.55.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-17 18:17:37.526Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code