@netnodeag/kraftwerk@0.39.1
Open-source agentic workspace for teams — where people and AI agents get work done together: agents (Claude Code, Codex, Pi), skills, shared knowledge, repeatable workflows, and deterministic verification
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo concrete malware behavior or install-time mutation was found. Downgrade to a warning because runtime shell execution and agent configuration writes are material capabilities, while complete analysis of the minified editor bundle is incomplete.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user or inspector client starts a configured vibeable, resolves a remote project, saves an agent, or triggers a workflow.
Impact
A caller able to control project configuration or inspector inputs can cause commands to run in that project context and alter its agent files.
Mechanism
Project-configured shell execution and project-local agent file writes.
AI rationale
No concrete malware behavior or install-time mutation was found. Downgrade to a warning because runtime shell execution and agent configuration writes are material capabilities, while complete analysis of the minified editor bundle is incomplete.
Evidence
dist/inspector/vibeables.jsdist/remote.jsdist/inspector/agents.jsdist/inspector/runner.jsvibeables/<slug>/vibeable.ymlagents/<slug>/agent.ymlagents/<slug>/system.md.cache/kraftwerk/remotesruns/<id>/trigger.log
Network endpoints1
github.com/
Decision evidence
public snapshotAI called this Suspicious at 74.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The inspector executes a configured development command through a shell.
- Remote project specifications are cloned from supplied Git or HTTPS URLs.
- The inspector can create project-local agent configuration and prompt files.
- A minified browser bundle is too large and structurally complex for complete static verification.
- The web inspector launches a detached workflow command through npx.
Evidence against
- The manifest has no install, preinstall, or postinstall hook; its only lifecycle hook is prepublishOnly.
- The inspected network path is an explicit remote-project clone, not secret exfiltration.
- No inspected code showed credential collection, hidden persistence, or unsolicited agent-control changes.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinified
Source & flagged code
8 flaggeddist/remote.jsView file
1import { spawnSync } from "node:child_process";
L2: import { mkdir, stat } from "node:fs/promises";
High
dist/inspector/vibeables.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @netnodeag/kraftwerk@0.2.0
matchedIdentity = npm:QG5ldG5vZGVhZy9rcmFmdHdlcms:0.2.0
similarity = 0.583
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/inspector/vibeables.jsView on unpkg546cwd: r.dir,
L547: shell: true,
L548: detached: process.platform !== "win32",
High
Findings
2 Critical4 High4 Medium6 Low
CriticalTrojan Source Unicodeinspector/dist/assets/editor-CVAfyi-9.js
CriticalPrevious Version Dangerous Deltadist/inspector/vibeables.js
HighChild Processdist/remote.js
HighShelldist/inspector/vibeables.js
HighRuntime Package Installdist/inspector/runner.js
HighSemantic Analysis Limiteddist/inspector/agents.js
MediumDynamic Requirebin/kraftwerk.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/inspector/instances.js
Affected versions and remediation
This report applies to @netnodeag/kraftwerk@0.39.1.
See all versions of @netnodeag/kraftwerk for other recorded verdicts.
- Review the evidence and your use of @netnodeag/kraftwerk@0.39.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.