@netnodeag/kraftwerk@0.50.0
Open-source agentic workspace for teams — where people and AI agents get work done together: agents (Claude Code, Codex, Pi), skills, shared knowledge, repeatable workflows, and deterministic verification
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo concrete malicious install hook, secret exfiltration, persistence, or self-dependent lifecycle chain was found. The package nevertheless exposes shell execution and remote-code workflow capabilities, so it warrants a warning rather than a clean mark.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user or a party able to access the inspector starts a vibeable development server, or invokes a remote workflow source.
Impact
Configured commands run with the inspector process privileges; remote content can be fetched into the local cache.
Mechanism
Shell execution of project configuration and git-based remote refresh.
AI rationale
No concrete malicious install hook, secret exfiltration, persistence, or self-dependent lifecycle chain was found. The package nevertheless exposes shell execution and remote-code workflow capabilities, so it warrants a warning rather than a clean mark.
Evidence
dist/inspector/vibeables.jsdist/remote.jsvibeable.yml.cache/kraftwerk/remotes
Network endpoints1
github.com
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- A locally served API can execute the project-controlled vibeable dev command through a shell.
- Remote project refreshes use a hard reset after fetching, which can overwrite the package cache state.
- The published inspector exposes workflow launch, repository sync, file deletion, and shell-based development-server controls; these are high-impact capabilities.
Evidence against
- The manifest has only a prepublish hook, not an install-time lifecycle hook.
- No self-dependency or confirmed credential collection and exfiltration was found.
- The inspector binds to loopback by default and includes host and optional access-token checks.
- Git commands use argument arrays and restrict staging to approved workspace paths.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinified
Source & flagged code
8 flaggeddist/remote.jsView file
1import { spawnSync } from "node:child_process";
L2: import { mkdir, stat } from "node:fs/promises";
High
dist/inspector/vibeables.jsView file
546cwd: r.dir,
L547: shell: true,
L548: detached: process.platform !== "win32",
High
bin/kraftwerk.jsView file
15if (existsSync(src) && process.env.KRAFTWERK_DIST !== "1") {
L16: const { register } = await import("tsx/esm/api");
L17: register();
Findings
2 Critical4 High4 Medium6 Low
CriticalTrojan Source Unicodeinspector/dist/assets/editor-B5WUiag9.js
CriticalPrevious Version Dangerous Deltadist/inspector/git.js
HighChild Processdist/remote.js
HighShelldist/inspector/vibeables.js
HighRuntime Package Installdist/inspector/runner.js
HighSemantic Analysis Limiteddist/cli/tunnel.js#virtual:normalized:round1
MediumDynamic Requirebin/kraftwerk.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/inspector/instances.js
Affected versions and remediation
This report applies to @netnodeag/kraftwerk@0.50.0.
See all versions of @netnodeag/kraftwerk for other recorded verdicts.
- Review the evidence and your use of @netnodeag/kraftwerk@0.50.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.