registry / @netnodeag/kraftwerk / 0.51.0
@netnodeag/kraftwerk@0.51.0
⚠ Under reviewOpen-source agentic workspace for teams — where people and AI agents get work done together: agents (Claude Code, Codex, Pi), skills, shared knowledge, repeatable workflows, and deterministic verification
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe inspected source does not establish malicious behavior, but the large inspector bundles and runtime paths remain insufficiently resolved to support a clean verdict. Manual review is needed to assess those unresolved behaviors.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Use of the package CLI or inspector features; the relevant bundled behavior and full runtime paths remain unclear.
Impact
The available inspection does not determine whether unresolved bundled behavior creates an attack surface.
Mechanism
Inspected source shows agent-skill file writes, configured process launches, remote repository handling, and tunnel support, but does not establish malicious behavior in those operations.
AI rationale
The inspected source does not establish malicious behavior, but the large inspector bundles and runtime paths remain insufficiently resolved to support a clean verdict. Manual review is needed to assess those unresolved behaviors.
Decision evidence
public snapshotAI called this Manual Review at 79.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json exposes a CLI and library; its listed lifecycle scripts do not include preinstall, install, or postinstall.
- The agent-skill API validates the supplied skill name and rejects empty content before writing a skill file; the server passes request body values to that API.
- The runs API enumerates run folders under the configured output directory.
- The inspector includes large bundled JavaScript assets whose behavior is not established by the inspected dependency-map and module excerpts.
- Remote repository resolution invokes git using the supplied repository specification; the inspected excerpt does not establish what later executes from the checkout.
- Vibeable startup uses a configured development command, and the runner builds an explicit workflow invocation.
- The tunnel source describes a configured Cloudflare tunnel, but the inspected excerpt does not resolve all activation and configuration paths.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequire
Source & flagged code
8 flaggeddist/remote.jsView file
1import { spawnSync } from "node:child_process";
L2: import { mkdir, stat } from "node:fs/promises";
High
dist/inspector/vibeables.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @netnodeag/kraftwerk@0.50.0
matchedIdentity = npm:QG5ldG5vZGVhZy9rcmFmdHdlcms:0.50.0
similarity = 0.883
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/inspector/vibeables.jsView on unpkg546cwd: r.dir,
L547: shell: true,
L548: detached: process.platform !== "win32",
High
Findings
2 Critical4 High4 Medium6 Low
CriticalTrojan Source Unicodeinspector/dist/assets/editor-BGH3gz0m.js
CriticalPrevious Version Dangerous Deltadist/inspector/vibeables.js
HighChild Processdist/remote.js
HighShelldist/inspector/vibeables.js
HighRuntime Package Installdist/inspector/runner.js
HighSemantic Analysis Limiteddist/cli/tunnel.js#virtual:normalized:round1
MediumDynamic Requirebin/kraftwerk.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/inspector/instances.js
Affected versions and remediation
This report applies to @netnodeag/kraftwerk@0.51.0.
See all versions of @netnodeag/kraftwerk for other recorded verdicts.
- Review the evidence and your use of @netnodeag/kraftwerk@0.51.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.