registry / @netnodeag/kraftwerk / 0.52.0
@netnodeag/kraftwerk@0.52.0
Open-source agentic workspace for teams — where people and AI agents get work done together: agents (Claude Code, Codex, Pi), skills, shared knowledge, repeatable workflows, and deterministic verification
AI Security Review
scanned 17d ago · by lpm-firewall-aiSource inspection found no concrete malicious behavior. The scanner’s install, shell, network, and Unicode indicators correspond to build-only publish scripts, configured product features, and ordinary bundled text handling.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
No malicious trigger identified; relevant operations require a workflow request, a vibeable start request, or configured tunnel use.
Impact
No malicious impact was established.
Mechanism
The inspected code runs configured commands and accesses local run or skill files; it does not establish covert collection, credential transfer, or unconsented control-surface changes.
AI rationale
Source inspection found no concrete malicious behavior. The scanner’s install, shell, network, and Unicode indicators correspond to build-only publish scripts, configured product features, and ordinary bundled text handling.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- `package.json` has no install lifecycle hook; its only publish lifecycle runs build commands.
- The skill listing reads project and user skill folders; per-agent skill creation is exposed through a POST API and a UI save action.
- Run discovery scans local output folders, and workflow runs are launched through a request handler with logs stored in the run directory.
- Remote repository resolution uses a supplied spec; vibeable commands come from app configuration and are started through a POST endpoint.
- Tunnel startup requires project tunnel configuration or a token; the inspected UI bundle’s Unicode matches are text-handling patterns.
Evidence against
- The flagged shell and process calls are tied to configured application commands, workflow requests, or tunnel configuration.
- The inspected Unicode matches are a zero-width character fallback and control-character handling in bundled UI code, not concealed control flow.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVars
Source & flagged code
8 flaggeddist/remote.jsView file
1import { spawnSync } from "node:child_process";
L2: import { mkdir, stat } from "node:fs/promises";
High
dist/inspector/vibeables.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @netnodeag/kraftwerk@0.50.0
matchedIdentity = npm:QG5ldG5vZGVhZy9rcmFmdHdlcms:0.50.0
similarity = 0.883
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/inspector/vibeables.jsView on unpkg546cwd: r.dir,
L547: shell: true,
L548: detached: process.platform !== "win32",
High
Findings
2 Critical4 High4 Medium6 Low
CriticalTrojan Source Unicodeinspector/dist/assets/editor-CejzV7Jx.js
CriticalPrevious Version Dangerous Deltadist/inspector/vibeables.js
HighChild Processdist/remote.js
HighShelldist/inspector/vibeables.js
HighRuntime Package Installdist/inspector/runner.js
HighSemantic Analysis Limiteddist/cli/tunnel.js#virtual:normalized:round1
MediumDynamic Requirebin/kraftwerk.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/inspector/instances.js
Affected versions and remediation
This report applies to @netnodeag/kraftwerk@0.52.0.
See all versions of @netnodeag/kraftwerk for other recorded verdicts.
- Review the evidence and your use of @netnodeag/kraftwerk@0.52.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.