@netnodeag/kraftwerk@0.34.1
Open-source agentic workspace for teams — where people and AI agents get work done together: agents (Claude Code, Codex, Pi), skills, shared knowledge, repeatable workflows, and deterministic verification
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo concrete malicious install-time or covert exfiltration chain was found, but the package exposes high-impact agent and workflow execution paths with automatic approval and credential forwarding. Treat it as a dangerous capability that warrants a warning rather than a publish block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A user or configured agent starts a workflow through the CLI or inspector, optionally using a remote source, sandbox, or SSH mode.
Impact
A malicious workflow configuration or agent instruction could execute commands and use credentials exposed to that workflow or sandbox.
Mechanism
Workflow-driven shell, npx, Git, and Docker execution with environment forwarding.
AI rationale
No concrete malicious install-time or covert exfiltration chain was found, but the package exposes high-impact agent and workflow execution paths with automatic approval and credential forwarding. Treat it as a dangerous capability that warrants a warning rather than a publish block.
Evidence
dist/inspector/runner.jsdist/runner/docker.jsdist/run.jsdist/remote.jsdist/inspector/chat/sessions.jsrunner.envoutput/runs/<run-id>/runner.json
Decision evidence
public snapshotAI called this Suspicious at 79.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The inspector starts a detached npx workflow command with automatic approval.
- Sandbox runs pass configured environment variables and available API keys into a container.
- Workflow script phases execute configured Bash text.
- Remote workflow sources are cloned and later hard-reset from their configured Git source.
- The agent-session context directs agents to run workflows with automatic approval.
Evidence against
- The manifest has no preinstall, install, postinstall, or prepare hook; its only publish hook builds artifacts.
- No self-dependency is declared.
- The flagged SQL, VBScript, and editor assets are inspectable frontend syntax/editor bundles.
- No fixed secret-exfiltration endpoint or hidden payload downloader was found.
- The risky operations are reachable through workflow, UI, sandbox, or remote-source features rather than package installation.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem
Source & flagged code
9 flaggeddist/remote.jsView file
1import { spawnSync } from "node:child_process";
L2: import { mkdir, stat } from "node:fs/promises";
High
inspector/dist/assets/editor-CXrDJOv_.jsView file
114`&&(n="");else{let r=n.indexOf(`
L115: `);r>-1&&(n=n.slice(0,r))}return e+n.length<=this.to?n:n.slice(0,this.to-e)}nextLine(){let e=this.parsedPos,n=this.lineAfter(e),r=e+n.length;for(let i=this.rangeIndex;;){let o=this...
L116: `:r=="r"?"\r":r=="t"?" ":"\\")}eq(e){return this.search==e.search&&this.replace==e.replace&&this.caseSensitive==e.caseSensitive&&this.regexp==e.regexp&&this.wholeWord==e.wholeWord&...
High
Shell
Package source references shell execution.
inspector/dist/assets/editor-CXrDJOv_.jsView on unpkg · L114bin/kraftwerk.jsView file
Findings
1 Critical6 High4 Medium7 Low
CriticalPrevious Version Dangerous Deltadist/runner/docker.js
HighChild Processdist/remote.js
HighShellinspector/dist/assets/editor-CXrDJOv_.js
HighRuntime Package Installdist/inspector/runner.js
HighSemantic Analysis Limiteddist/inspector/chat/sessions.js
HighKnown Malware Source Similarityinspector/dist/assets/sql-D0XecflT.js
HighKnown Malware Source Similarityinspector/dist/assets/vbscript-BuJXcnF6.js
MediumDynamic Requirebin/kraftwerk.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to @netnodeag/kraftwerk@0.34.1.
See all versions of @netnodeag/kraftwerk for other recorded verdicts.
- Review the evidence and your use of @netnodeag/kraftwerk@0.34.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.