@netnodeag/kraftwerk@0.47.0
Open-source agentic workspace for teams — where people and AI agents get work done together: agents (Claude Code, Codex, Pi), skills, shared knowledge, repeatable workflows, and deterministic verification
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package is not source-grounded as malware, but it exposes high-impact shell and agent capabilities. Because scanner coverage is incomplete and those capabilities can act on a workspace, warn rather than mark clean.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
An inspector user starts a configured vibeable development server or Codex workflow.
Impact
A trusted user can cause commands or an agent to modify the selected workspace; no automatic install-time execution or data exfiltration was found.
Mechanism
Shell execution of configured development commands and workspace-writing agent invocation.
AI rationale
The package is not source-grounded as malware, but it exposes high-impact shell and agent capabilities. Because scanner coverage is incomplete and those capabilities can act on a workspace, warn rather than mark clean.
Evidence
dist/inspector/vibeables.jsdist/harnesses/codex.jsvibeable.ymlvibeables/<slug>/
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The inspector executes a configured vibeable development command through a shell and passes its environment to that process.
- The Codex workflow harness grants workspace-write access and uses automatic approval when MCP servers are configured.
Evidence against
- The manifest has no preinstall, install, or postinstall hook; its only lifecycle script is prepublishOnly.
- The observed command execution is part of explicit inspector, workflow, and development-server features, not installation-time behavior.
- No source inspected shows credential harvesting, secret exfiltration, stealth persistence, or a remote payload chain.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
8 flaggeddist/remote.jsView file
1import { spawnSync } from "node:child_process";
L2: import { mkdir, stat } from "node:fs/promises";
High
dist/inspector/vibeables.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @netnodeag/kraftwerk@0.2.0
matchedIdentity = npm:QG5ldG5vZGVhZy9rcmFmdHdlcms:0.2.0
similarity = 0.458
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/inspector/vibeables.jsView on unpkg546cwd: r.dir,
L547: shell: true,
L548: detached: process.platform !== "win32",
High
Findings
2 Critical4 High4 Medium6 Low
CriticalTrojan Source Unicodeinspector/dist/assets/editor-DJbeG376.js
CriticalPrevious Version Dangerous Deltadist/inspector/vibeables.js
HighChild Processdist/remote.js
HighShelldist/inspector/vibeables.js
HighRuntime Package Installdist/inspector/runner.js
HighSemantic Analysis Limiteddist/cli/tunnel.js#virtual:normalized:round1
MediumDynamic Requirebin/kraftwerk.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/inspector/instances.js
Affected versions and remediation
This report applies to @netnodeag/kraftwerk@0.47.0.
See all versions of @netnodeag/kraftwerk for other recorded verdicts.
- Review the evidence and your use of @netnodeag/kraftwerk@0.47.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.