registry / @netnodeag/kraftwerk / 0.57.0
@netnodeag/kraftwerk@0.57.0
Open-source agentic workspace for teams — where people and AI agents get work done together: agents (Claude Code, Codex, Pi), skills, shared knowledge, repeatable workflows, and deterministic verification
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe package has no install-time hook; its publish hook builds distribution assets. The flagged runtime behavior is tied to user-selected features, and the editor bundle’s invisible character serves as a text-separator fallback.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Explicit CLI commands, inspector requests, or project configuration activate these features.
Impact
No unconsented credential transfer, hidden install-time action, or other attack impact was established.
Mechanism
The inspected code reads local skill and run data, writes scoped agent skills or local instance records, and launches configured workflows or preview commands.
AI rationale
The package has no install-time hook; its publish hook builds distribution assets. The flagged runtime behavior is tied to user-selected features, and the editor bundle’s invisible character serves as a text-separator fallback.
Decision evidence
public snapshotAI called this Clean at 98.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no install hook; its publish hook builds assets, and the binary shim selects the checkout source or compiled CLI.
- Skill discovery reads workspace and user skill files; writes target an agent’s own skills through an agent-scoped endpoint.
- The inspected run-listing code reads local output directories and analyzes workflow traces.
- Workflow execution is entered through a POST for a selected workflow and launches it with the supplied request.
- Remote cloning, tunnel setup, and configured vibeable commands are user-selected features; instance registration writes a local record.
- The editor bundle uses an invisible character as a text-separator fallback; the other flagged assets are client-side bundles.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
8 flaggeddist/remote.jsView file
1import { spawnSync } from "node:child_process";
L2: import { mkdir, stat } from "node:fs/promises";
High
dist/inspector/vibeables.jsView file
546cwd: r.dir,
L547: shell: true,
L548: detached: process.platform !== "win32",
High
bin/kraftwerk.jsView file
15if (existsSync(src) && process.env.KRAFTWERK_DIST !== "1") {
L16: const { register } = await import("tsx/esm/api");
L17: register();
Findings
2 Critical4 High4 Medium7 Low
CriticalTrojan Source Unicodeinspector/dist/assets/editor-CHv_lIkP.js
CriticalPrevious Version Dangerous Deltadist/inspector/instances.js
HighChild Processdist/remote.js
HighShelldist/inspector/vibeables.js
HighRuntime Package Installdist/inspector/runner.js
HighSemantic Analysis Limiteddist/cli/tunnel.js#virtual:normalized:round1
MediumDynamic Requirebin/kraftwerk.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
Low
Affected versions and remediation
This report applies to @netnodeag/kraftwerk@0.57.0.
See all versions of @netnodeag/kraftwerk for other recorded verdicts.
- Review the evidence and your use of @netnodeag/kraftwerk@0.57.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.