registry / @netnodeag/kraftwerk / 0.48.0
@netnodeag/kraftwerk@0.48.0
Open-source agentic workspace for teams — where people and AI agents get work done together: agents (Claude Code, Codex, Pi), skills, shared knowledge, repeatable workflows, and deterministic verification
AI Security Review
scanned 17d ago · by lpm-firewall-aiSource inspection found no install hook or concrete attack behavior. The scanner hints correspond to product operations, bundled editor assets, and an explicit agent-skill route, so the package is clean.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User invocation of product commands or project-configured inspector actions.
Impact
No confirmed attack impact was established.
Mechanism
The inspected code performs bounded skill discovery and configured git, workflow, tunnel, and development-server operations; it showed no covert collection or unauthorized account action.
AI rationale
Source inspection found no install hook or concrete attack behavior. The scanner hints correspond to product operations, bundled editor assets, and an explicit agent-skill route, so the package is clean.
Decision evidence
public snapshotAI called this Clean at 89.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines only a prepublishOnly lifecycle script; it has no preinstall, install, or postinstall hook.
- The skill code reads skills from workspace and Claude skill directories; its agent skill writer is exposed through an explicit HTTP POST route.
- The flagged run operation lists run directories and filters their names; it does not execute code or alter accounts.
- The flagged browser assets are bundled editor modules; their scanner finding alone does not establish harmful behavior.
- Remote cloning, workflow launches, tunnel startup, and configured vibeable commands are tied to explicit product operations or project configuration.
- The git integration limits staging to configured roots and excludes credential-like files.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
8 flaggeddist/remote.jsView file
1import { spawnSync } from "node:child_process";
L2: import { mkdir, stat } from "node:fs/promises";
High
dist/inspector/vibeables.jsView file
546cwd: r.dir,
L547: shell: true,
L548: detached: process.platform !== "win32",
High
bin/kraftwerk.jsView file
15if (existsSync(src) && process.env.KRAFTWERK_DIST !== "1") {
L16: const { register } = await import("tsx/esm/api");
L17: register();
Findings
2 Critical4 High4 Medium6 Low
CriticalTrojan Source Unicodeinspector/dist/assets/editor-toVFopCO.js
CriticalPrevious Version Dangerous Deltadist/inspector/git.js
HighChild Processdist/remote.js
HighShelldist/inspector/vibeables.js
HighRuntime Package Installdist/inspector/runner.js
HighSemantic Analysis Limiteddist/cli/tunnel.js#virtual:normalized:round1
MediumDynamic Requirebin/kraftwerk.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/inspector/instances.js
Affected versions and remediation
This report applies to @netnodeag/kraftwerk@0.48.0.
See all versions of @netnodeag/kraftwerk for other recorded verdicts.
- Review the evidence and your use of @netnodeag/kraftwerk@0.48.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.