@netnodeag/kraftwerk@0.35.0
Open-source agentic workspace for teams — where people and AI agents get work done together: agents (Claude Code, Codex, Pi), skills, shared knowledge, repeatable workflows, and deterministic verification
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package exposes powerful, user-invoked agent execution and credential-forwarding features, including a registry-latest fallback. Static inspection found no automatic install-time attack or confirmed data exfiltration, so this is a warning rather than a block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A user runs a workflow, enables sandbox or SSH mode, supplies a remote workflow source, or uses the UI to create an agent skill.
Impact
A malicious or untrusted workflow selected by the user could execute commands and use credentials or SSH-agent access made available to its Docker container.
Mechanism
Explicit workflow execution with optional credential and SSH-agent forwarding.
AI rationale
The package exposes powerful, user-invoked agent execution and credential-forwarding features, including a registry-latest fallback. Static inspection found no automatic install-time attack or confirmed data exfiltration, so this is a warning rather than a block.
Evidence
dist/run.jsdist/runner/docker.jsdist/remote.jsdist/inspector/self-command.jsdist/inspector/skills.js.cache/kraftwerk/remotesrunner.envoutput/runs/<run-id>/runner.jsonagents/<slug>/skills/<name>/SKILL.md
Network endpoints2
github.comregistry.npmjs.org
Decision evidence
public snapshotAI called this Suspicious at 85.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- User-provided workflow scripts are executed with Bash.
- Sandboxed runs forward AI API keys and can mount the user's SSH agent.
- User-provided remote sources are cloned and refreshed with Git.
- If its bin path disappears, the UI supervisor falls back to the registry latest release.
- The UI can create agent skill instruction files in the consumer project.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The inspected execution paths are reached through explicit CLI or UI actions.
- No inspected code sends harvested files, credentials, or environment values to an attacker-controlled endpoint.
- The registry request is an explicit update check and the UI binds to loopback by default.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
9 flaggeddist/remote.jsView file
1import { spawnSync } from "node:child_process";
L2: import { mkdir, stat } from "node:fs/promises";
High
inspector/dist/assets/editor-BABv2LmA.jsView file
114`&&(n="");else{let r=n.indexOf(`
L115: `);r>-1&&(n=n.slice(0,r))}return e+n.length<=this.to?n:n.slice(0,this.to-e)}nextLine(){let e=this.parsedPos,n=this.lineAfter(e),r=e+n.length;for(let i=this.rangeIndex;;){let o=this...
L116: `:r=="r"?"\r":r=="t"?" ":"\\")}eq(e){return this.search==e.search&&this.replace==e.replace&&this.caseSensitive==e.caseSensitive&&this.regexp==e.regexp&&this.wholeWord==e.wholeWord&...
High
Shell
Package source references shell execution.
inspector/dist/assets/editor-BABv2LmA.jsView on unpkg · L114bin/kraftwerk.jsView file
Findings
1 Critical6 High4 Medium7 Low
CriticalPrevious Version Dangerous Deltadist/runner/docker.js
HighChild Processdist/remote.js
HighShellinspector/dist/assets/editor-BABv2LmA.js
HighRuntime Package Installdist/inspector/runner.js
HighSemantic Analysis Limiteddist/inspector/chat/sessions.js
HighKnown Malware Source Similarityinspector/dist/assets/sql-D0XecflT.js
HighKnown Malware Source Similarityinspector/dist/assets/vbscript-BuJXcnF6.js
MediumDynamic Requirebin/kraftwerk.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to @netnodeag/kraftwerk@0.35.0.
See all versions of @netnodeag/kraftwerk for other recorded verdicts.
- Review the evidence and your use of @netnodeag/kraftwerk@0.35.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.