registry / @netnodeag/kraftwerk / 0.14.2
@netnodeag/kraftwerk@0.14.2
Deterministic workflow-as-code framework: agents (persona + model + tools + harness) run in bounded phases on headless CLI harnesses (claude -p, codex exec, pi); code owns the control flow, envelopes + gates judge the results
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe manifest has no install-time lifecycle hook, and the reviewed runtime behavior is consistent with the package’s workflow and inspector functions. The scanner’s execution and network signals correspond to user-triggered Git, agent, and Docker operations; no concrete attack surface was found.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user invokes the CLI, starts an inspector chat or run, or requests remote workflow resolution.
Impact
No credential theft, unconsented account action, persistence, or malicious install behavior was established.
Mechanism
The package starts selected agent backends, uses Git for requested remote sources, and runs workflows locally or in a Docker container.
AI rationale
The manifest has no install-time lifecycle hook, and the reviewed runtime behavior is consistent with the package’s workflow and inspector functions. The scanner’s execution and network signals correspond to user-triggered Git, agent, and Docker operations; no concrete attack surface was found.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest’s prepublish hook runs build steps; it defines no install-time hook.
- The inspector bundle’s chat creation request sends user-selected agent and scope to a same-origin API.
- Remote resolution uses Git to clone or refresh the requested repository into a local cache.
- The inspector runner launches a workflow with its name and request; sandbox and SSH options are conditional.
- Chat sessions start the selected agent backend for the project context.
- The Docker runner mounts the workflow read-only and writes run output to the run directory.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
5 flaggeddist/remote.jsView file
1import { spawnSync } from "node:child_process";
L2: import { mkdir, stat } from "node:fs/promises";
High
bin/kraftwerk.jsView file
15if (existsSync(src) && process.env.KRAFTWERK_DIST !== "1") {
L16: const { register } = await import("tsx/esm/api");
L17: register();
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/kraftwerk.jsView on unpkg · L15dist/inspector/runner.jsView file
1import { spawn, spawnSync } from "node:child_process";
L2: import { mkdirSync, openSync, closeSync } from "node:fs";
...
L8: * Workflow trigger for the web UI. The inspector stays decoupled from the
L9: * framework runtime: it shells out to `npx kraftwerk run` in the consumer
L10: * project, detached, with a pre-chosen --run-id so the browser can jump to
Findings
1 Critical4 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/runner/docker.js
HighChild Processdist/remote.js
HighShell
HighRuntime Package Installdist/inspector/runner.js
HighSemantic Analysis Limiteddist/inspector/chat/sessions.js
MediumDynamic Requirebin/kraftwerk.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @netnodeag/kraftwerk@0.14.2.
See all versions of @netnodeag/kraftwerk for other recorded verdicts.
- Review the evidence and your use of @netnodeag/kraftwerk@0.14.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.