@netnodeag/kraftwerk@0.34.2
Open-source agentic workspace for teams — where people and AI agents get work done together: agents (Claude Code, Codex, Pi), skills, shared knowledge, repeatable workflows, and deterministic verification
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo malicious install hook or covert payload was found. The unattended auto-approval path and optional credential-bearing runner are dangerous dual-use capabilities that warrant a warning rather than a block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A user enables a team routine or starts a sandboxed workflow with the relevant options.
Impact
An unsafe or compromised routine prompt could perform agent-authorized actions without an interactive approval step.
Mechanism
Unattended agent permission auto-approval and optional credential forwarding.
AI rationale
No malicious install hook or covert payload was found. The unattended auto-approval path and optional credential-bearing runner are dangerous dual-use capabilities that warrant a warning rather than a block.
Evidence
dist/inspector/chat/sessions.jsdist/runner/docker.jsrunner.envoutput/runs/<run-id>/runner.json
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Unattended scheduled team sessions automatically select an allow permission option.
- The optional Docker runner forwards API keys and can mount SSH-agent access.
- The inspector starts a detached workflow process only after a run is triggered.
- Remote project resolution runs Git commands for a supplied remote specification.
Evidence against
- package.json has only a prepublishOnly hook, not an install-time lifecycle hook.
- There is no dependency on this package's own name.
- Observed routine networking targets the local inspector, not an external collection service.
- The flagged SQL and VBScript assets are bundled syntax highlighters.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationTelemetry
Source & flagged code
9 flaggeddist/remote.jsView file
1import { spawnSync } from "node:child_process";
L2: import { mkdir, stat } from "node:fs/promises";
High
inspector/dist/assets/editor-CXrDJOv_.jsView file
114`&&(n="");else{let r=n.indexOf(`
L115: `);r>-1&&(n=n.slice(0,r))}return e+n.length<=this.to?n:n.slice(0,this.to-e)}nextLine(){let e=this.parsedPos,n=this.lineAfter(e),r=e+n.length;for(let i=this.rangeIndex;;){let o=this...
L116: `:r=="r"?"\r":r=="t"?" ":"\\")}eq(e){return this.search==e.search&&this.replace==e.replace&&this.caseSensitive==e.caseSensitive&&this.regexp==e.regexp&&this.wholeWord==e.wholeWord&...
High
Shell
Package source references shell execution.
inspector/dist/assets/editor-CXrDJOv_.jsView on unpkg · L114bin/kraftwerk.jsView file
Findings
1 Critical6 High4 Medium7 Low
CriticalPrevious Version Dangerous Deltadist/runner/docker.js
HighChild Processdist/remote.js
HighShellinspector/dist/assets/editor-CXrDJOv_.js
HighRuntime Package Installdist/inspector/runner.js
HighSemantic Analysis Limiteddist/inspector/chat/sessions.js
HighKnown Malware Source Similarityinspector/dist/assets/sql-D0XecflT.js
HighKnown Malware Source Similarityinspector/dist/assets/vbscript-BuJXcnF6.js
MediumDynamic Requirebin/kraftwerk.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to @netnodeag/kraftwerk@0.34.2.
See all versions of @netnodeag/kraftwerk for other recorded verdicts.
- Review the evidence and your use of @netnodeag/kraftwerk@0.34.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.