registry / @netnodeag/kraftwerk / 0.39.0
@netnodeag/kraftwerk@0.39.0
Open-source agentic workspace for teams — where people and AI agents get work done together: agents (Claude Code, Codex, Pi), skills, shared knowledge, repeatable workflows, and deterministic verification
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has no registry-install lifecycle hook or runtime self-dependency. Its sensitive operations are explicit product features with project-scoped paths; static inspection found no credential exfiltration, stealth persistence, or automatic foreign control-surface mutation.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs the CLI or uses its local inspector UI.
Impact
Configured workflows can run commands and access project-selected resources, as expected for an agentic workspace tool.
Mechanism
Executes configured workflows and development commands.
AI rationale
The package has no registry-install lifecycle hook or runtime self-dependency. Its sensitive operations are explicit product features with project-scoped paths; static inspection found no credential exfiltration, stealth persistence, or automatic foreign control-surface mutation.
Evidence
runner.envoutput/runs/<run-id>agents/<slug>/agent.ymlagents/<slug>/system.md
Network endpoints2
registry.npmjs.orggithub.com
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The inspected high-risk paths implement explicit CLI and UI workspace operations, not automatic installation behavior.
Evidence against
- package.json has no preinstall, install, or postinstall hook and no self-dependency.
- Docker, shell, git, and npm actions are reached from user-invoked workflow, UI, sandbox, or remote-project features.
- Agent and development-command writes are scoped to the selected project and validated slug directories.
- The flagged editor asset is a bundled minified frontend file; no standalone payload behavior was established.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
8 flaggeddist/remote.jsView file
1import { spawnSync } from "node:child_process";
L2: import { mkdir, stat } from "node:fs/promises";
High
dist/inspector/vibeables.jsView file
437cwd: r.dir,
L438: shell: true,
L439: detached: process.platform !== "win32",
High
bin/kraftwerk.jsView file
15if (existsSync(src) && process.env.KRAFTWERK_DIST !== "1") {
L16: const { register } = await import("tsx/esm/api");
L17: register();
Findings
2 Critical4 High4 Medium6 Low
CriticalTrojan Source Unicodeinspector/dist/assets/editor-6yCJBeDg.js
CriticalPrevious Version Dangerous Deltadist/runner/docker.js
HighChild Processdist/remote.js
HighShelldist/inspector/vibeables.js
HighRuntime Package Installdist/inspector/runner.js
HighSemantic Analysis Limiteddist/inspector/agents.js
MediumDynamic Requirebin/kraftwerk.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/inspector/instances.js
Affected versions and remediation
This report applies to @netnodeag/kraftwerk@0.39.0.
See all versions of @netnodeag/kraftwerk for other recorded verdicts.
- Review the evidence and your use of @netnodeag/kraftwerk@0.39.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.