registry / @netnodeag/kraftwerk / 0.54.0
@netnodeag/kraftwerk@0.54.0
Open-source agentic workspace for teams — where people and AI agents get work done together: agents (Claude Code, Codex, Pi), skills, shared knowledge, repeatable workflows, and deterministic verification
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe inspected source supports ordinary CLI and inspector functionality, including scoped agent-skill storage and feature-triggered process operations. The scanner hints do not establish a concrete attack in the reviewed source.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
An inspector request to list or save an agent skill; CLI or inspector actions to run workflows, start previews, resolve repositories, or start configured tunnels.
Impact
No concrete unauthorized credential transfer, persistence, destructive behavior, or agent control-surface abuse was established.
Mechanism
Skill content is written to an agent-specific SKILL.md path. Other inspected process and network operations are tied to the package’s repository, preview, workflow, and tunnel features.
AI rationale
The inspected source supports ordinary CLI and inspector functionality, including scoped agent-skill storage and feature-triggered process operations. The scanner hints do not establish a concrete attack in the reviewed source.
Decision evidence
public snapshotAI called this Clean at 82.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes the CLI and library entrypoints; its prepublishOnly script builds package artifacts.
- The skill listing reads agent, workspace, project and user skill directories; saving writes a named SKILL.md under that agent’s skills directory.
- The inspector handles an agent-skills POST by passing the submitted name and content to the save function.
- Run listing reads run directories and filters their names.
- The browser assets include Vite dependency maps and bundled library code; these excerpts do not establish malicious behavior.
- Remote repository handling invokes git; preview starts the configured development command; workflow runs and tunnels are feature-triggered.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
8 flaggeddist/remote.jsView file
1import { spawnSync } from "node:child_process";
L2: import { mkdir, stat } from "node:fs/promises";
High
dist/inspector/vibeables.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @netnodeag/kraftwerk@0.50.0
matchedIdentity = npm:QG5ldG5vZGVhZy9rcmFmdHdlcms:0.50.0
similarity = 0.867
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/inspector/vibeables.jsView on unpkg546cwd: r.dir,
L547: shell: true,
L548: detached: process.platform !== "win32",
High
Findings
2 Critical4 High4 Medium7 Low
CriticalTrojan Source Unicodeinspector/dist/assets/editor-CJj1y1g9.js
CriticalPrevious Version Dangerous Deltadist/inspector/vibeables.js
HighChild Processdist/remote.js
HighShelldist/inspector/vibeables.js
HighRuntime Package Installdist/inspector/runner.js
HighSemantic Analysis Limiteddist/cli/tunnel.js#virtual:normalized:round1
MediumDynamic Requirebin/kraftwerk.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
Low
Affected versions and remediation
This report applies to @netnodeag/kraftwerk@0.54.0.
See all versions of @netnodeag/kraftwerk for other recorded verdicts.
- Review the evidence and your use of @netnodeag/kraftwerk@0.54.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.