registry / @kraki/tentacle / 0.29.5

@kraki/tentacle@0.29.5

⚠ Under review

Kraki agent bridge — the arm that connects your coding agent to the head

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 38 file(s), 632 KB of source, external domains: 127.0.0.1, api.github.com, app.kraki.chat, docs.anthropic.com, github.com, relay.kraki.chat, www.apple.com

Source & flagged code

7 flagged

dist/checks.jsView file

Lines 1-40javascript

1/**

2 * Environment checks for Kraki tentacle setup.

3 *

4 * Validates that required CLI tools are installed and authenticated.

5 * Provides a retry mechanism for interactive setup flows.

6 */

7import { execSync } from 'node:child_process';

8import { constants as fsConstants, promises as fsp, appendFileSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/checks.jsView on unpkg · L6

9import { homedir, platform } from 'node:os';

10import { join } from 'node:path';

11import { input } from '@inquirer/prompts';

12import chalk from 'chalk';

13/**

14 * On Windows, ensure essential system directories are present in

15 * `process.env.PATH`. Returns the list of directories that were

16 * prepended (empty if nothing was missing).

17 *

18 * Why: the daemon may be launched from a context with a minimal PATH

19 * (Startup folder shortcut, Task Scheduler, double-clicked SEA binary),

20 * where even `%SystemRoot%\System32` is absent. Tools that spawn

21 * `powershell.exe` / `pwsh.exe` / `where` / `cmd` by short name then

22 * fail with ENOENT — notably the GitHub Copilot SDK, whose PowerShell

High

Shell

Package source references shell execution.

dist/checks.jsView on unpkg · L20

23 * tool looks up `pwsh.exe` and `powershell.exe` via PATH and surfaces

24 * "PowerShell is not available" inside agent sessions.

25 *

26 * This helper is idempotent and merges (rather than wholesale-replaces)

27 * existing PATH entries so it can run alongside other PATH manipulation

28 * (e.g. the `node_modules/.bin` prepend in resolveDaemonLaunch).

29 *

30 * No-op on non-Windows platforms.

31 */

32export function ensureWindowsSystemPath() {

33 if (platform() !== 'win32')

34 return [];

35 const sysRoot = process.env.SystemRoot || process.env.windir || 'C:\\Windows';

36 const required = [

37 `${sysRoot}\\System32`,

38 `${sysRoot}\\System32\\WindowsPowerShell\\v1.0`,

39 `${sysRoot}\\System32\\Wbem`,

40 sysRoot,

dist/daemon.jsView file

Lines 1-27javascript

1/**

2 * Daemon process management for Kraki tentacle.

3 *

4 * The daemon runs as a background child process executing daemon-worker.js.

5 * Its PID is tracked under the current Kraki home.

6 *

7 * On macOS, downloaded SEA binaries carry com.apple.provenance which

8 * cannot be removed. macOS 26+ CSM 2 blocks direct fork()+execve() of

9 * such binaries from child processes. To bypass this, macOS SEA builds

10 * use launchctl to have launchd spawn the daemon in a completely

11 * independent context. If launchctl also fails, the caller falls back

dist/update.jsView file

Lines 1-29javascript

1/**

2 * Self-update for Kraki tentacle.

3 *

4 * Supports two install methods:

5 * - npm global: runs `npm i -g @kraki/tentacle@latest`

6 * - SEA binary: downloads latest release binary from GitHub

7 *

8 * Also provides a background update check that caches results for 24h.

9 */

10import { execSync } from 'node:child_process';

11import

dist/adapters/copilot.jsView file

Lines 247-287javascript

247 return 'hook';

248 }

249 if (isSea()) {

250 return null;

251 }

252 if (patchCopilotSdkSessionImport(currentUrl)) {

253 return 'patch';

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @kraki/tentacle@0.29.1 matchedIdentity = npm:QGtyYWtpL3RlbnRhY2xl:0.29.1 similarity = 0.865 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/checks.jsView file

6*/ L7: import { execSync } from 'node:child_process'; L8: import { constants as fsConstants, promises as fsp, appendFileSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/checks.jsView on unpkg · L6

20* where even `%SystemRoot%\System32` is absent. Tools that spawn L21: * `powershell.exe` / `pwsh.exe` / `where` / `cmd` by short name then L22: * fail with ENOENT — notably the GitHub Copilot SDK, whose PowerShell

High

Shell

Package source references shell execution.

dist/checks.jsView on unpkg · L20

dist/daemon.jsView file

7* On macOS, downloaded SEA binaries carry com.apple.provenance which L8: * cannot be removed. macOS 26+ CSM 2 blocks direct fork()+execve() of L9: * such binaries from child processes. To bypass this, macOS SEA builds L10: * use launchctl to have launchd spawn the daemon in a completely L11: * independent context. If launchctl also fails, the caller falls back ... L36: const home = getKrakiHome(); L37: const defaultHome = join(homedir(), '.kraki'); L38: if (resolve(home) === resolve(defaultHome)) ... L67: if (seaMode) { L68: const { COPILOT_SDK_AUTH_TOKEN: _, COPILOT_AGENT_SESSION_ID: _2, COPILOT_CLI: _3, GITHUB_TOKEN: seaInheritedGhToken, ...seaCleanEnv } = process.env; L69: if (seaInheritedGhToken && !seaInheritedGhToken.startsWith('gho_')) { ... L276: // context that isn't blocked by CSM provenance tracking.

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/daemon.jsView on unpkg · L7

dist/update.jsView file

9*/ L10: import { execSync } from 'node:child_process'; L11: import { existsSync, readFileSync, writeFileSync, mkdirSync, createWriteStream, unlinkSync, chmodSync, renameSync, copyFileSync, realpathSync, rmSync, symlinkSync } from 'node:fs'; ... L13: import { tmpdir, platform } from 'node:os'; L14: import { request as httpRequest } from 'node:http'; L15: import { request as httpsRequest } from 'node:https'; ... L44: } L45: export function shouldBypassProxy(hostname, noProxyRaw = process.env.NO_PROXY ?? process.env.no_proxy ?? '') { L46: if (!noProxyRaw) ... L85: const pass = decodeURIComponent(proxyUrl.password); L86: return `Basic ${Buffer.from(`${user}:${pass}`).toString('base64')}`; L87: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/update.jsView on unpkg · L9

4* Supports two install methods: L5: * - npm global: runs `npm i -g @kraki/tentacle@latest` L6: * - SEA binary: downloads latest release binary from GitHub ... L9: */ L10: import { execSync } from 'node:child_process'; L11: import { existsSync, readFileSync, writeFileSync, mkdirSync, createWriteStream, unlinkSync, chmodSync, renameSync, copyFileSync, realpathSync, rmSync, symlinkSync } from 'node:fs';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/update.jsView on unpkg · L4

dist/adapters/copilot.jsView file

267package = @kraki/tentacle; repositoryIdentity = kraki; dependency = @github/copilot-sdk L267: try { L268: return await import('@github/copilot-sdk'); L269: }

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/adapters/copilot.jsView on unpkg · L267

dist/cli.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Findings

1 Critical5 High4 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/cli.js

HighChild Processdist/checks.js

HighShelldist/checks.js

HighSandbox Evasion Gated Capabilitydist/update.js

HighCopied Package Dependency Bridgedist/adapters/copilot.js

HighRuntime Package Installdist/update.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/daemon.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

7 flagged

dist/checks.jsView file

Lines 1-40javascript

1/**

2 * Environment checks for Kraki tentacle setup.

3 *

4 * Validates that required CLI tools are installed and authenticated.

5 * Provides a retry mechanism for interactive setup flows.

6 */

7import { execSync } from 'node:child_process';

8import { constants as fsConstants, promises as fsp, appendFileSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/checks.jsView on unpkg · L6

9import { homedir, platform } from 'node:os';

10import { join } from 'node:path';

11import { input } from '@inquirer/prompts';

12import chalk from 'chalk';

13/**

14 * On Windows, ensure essential system directories are present in

15 * `process.env.PATH`. Returns the list of directories that were

16 * prepended (empty if nothing was missing).

17 *

18 * Why: the daemon may be launched from a context with a minimal PATH

19 * (Startup folder shortcut, Task Scheduler, double-clicked SEA binary),

20 * where even `%SystemRoot%\System32` is absent. Tools that spawn

21 * `powershell.exe` / `pwsh.exe` / `where` / `cmd` by short name then

22 * fail with ENOENT — notably the GitHub Copilot SDK, whose PowerShell

High

Shell

Package source references shell execution.

dist/checks.jsView on unpkg · L20

23 * tool looks up `pwsh.exe` and `powershell.exe` via PATH and surfaces

24 * "PowerShell is not available" inside agent sessions.

25 *

26 * This helper is idempotent and merges (rather than wholesale-replaces)

27 * existing PATH entries so it can run alongside other PATH manipulation

28 * (e.g. the `node_modules/.bin` prepend in resolveDaemonLaunch).

29 *

30 * No-op on non-Windows platforms.

31 */

32export function ensureWindowsSystemPath() {

33 if (platform() !== 'win32')

34 return [];

35 const sysRoot = process.env.SystemRoot || process.env.windir || 'C:\\Windows';

36 const required = [

37 `${sysRoot}\\System32`,

38 `${sysRoot}\\System32\\WindowsPowerShell\\v1.0`,

39 `${sysRoot}\\System32\\Wbem`,

40 sysRoot,

dist/daemon.jsView file

Lines 1-27javascript

1/**

2 * Daemon process management for Kraki tentacle.

3 *

4 * The daemon runs as a background child process executing daemon-worker.js.

5 * Its PID is tracked under the current Kraki home.

6 *

7 * On macOS, downloaded SEA binaries carry com.apple.provenance which

8 * cannot be removed. macOS 26+ CSM 2 blocks direct fork()+execve() of

9 * such binaries from child processes. To bypass this, macOS SEA builds

10 * use launchctl to have launchd spawn the daemon in a completely

11 * independent context. If launchctl also fails, the caller falls back

dist/update.jsView file

Lines 1-29javascript

1/**

2 * Self-update for Kraki tentacle.

3 *

4 * Supports two install methods:

5 * - npm global: runs `npm i -g @kraki/tentacle@latest`

6 * - SEA binary: downloads latest release binary from GitHub

7 *

8 * Also provides a background update check that caches results for 24h.

9 */

10import { execSync } from 'node:child_process';

11import

dist/adapters/copilot.jsView file

Lines 247-287javascript

247 return 'hook';

248 }

249 if (isSea()) {

250 return null;

251 }

252 if (patchCopilotSdkSessionImport(currentUrl)) {

253 return 'patch';

dist/cli.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg