registry / @netnodeag/kraftwerk / 0.62.0
@netnodeag/kraftwerk@0.62.0
Open-source agentic workspace for teams — where people and AI agents get work done together: agents (Claude Code, Codex, Pi), skills, shared knowledge, repeatable workflows, and deterministic verification
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe manifest has no install-time lifecycle hook, and inspected runtime behavior is consistent with the package’s CLI and inspector features. Scanner flags for bundled assets and execution primitives did not establish concrete attack behavior.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user invokes a CLI or inspector feature, or configures a workflow, development command, repository, or tunnel.
Impact
No malicious effect was established from these behaviors.
Mechanism
The package reads workspace and run data, launches configured processes, resolves supplied repository specs, and lets an API request save an agent skill.
AI rationale
The manifest has no install-time lifecycle hook, and inspected runtime behavior is consistent with the package’s CLI and inspector features. Scanner flags for bundled assets and execution primitives did not establish concrete attack behavior.
Decision evidence
public snapshotAI called this Clean at 78.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines prepublishOnly build steps but no preinstall, install, or postinstall hook.
- The inspector discovers skills in workspace, project, user, and agent directories; saving an agent skill is handled through an explicit API request and writes the supplied content under that agent’s skills directory.
- Run listing reads run directories; the bundled editor and UI excerpts show cursor handling and a request to the local workspace API.
- Remote repository resolution clones or refreshes the supplied repository spec into a Kraftwerk cache.
- Inspector process launches use configured development commands or a requested workflow run; tunnel startup requires project tunnel configuration or TUNNEL_TOKEN.
- Git sync uses configured repositories and roots; inspected code limits staging and excludes credential files.
Evidence against
- The CLI and inspector include process execution, network access, and agent skill configuration, but the inspected paths tie these capabilities to configured or user-requested product operations.
Behavioral surface
Source & flagged code
8 flaggeddist/remote.jsView file
1import { spawnSync } from "node:child_process";
L2: import { mkdir, stat } from "node:fs/promises";
High
dist/inspector/vibeables.jsView file
547cwd: r.dir,
L548: shell: true,
L549: detached: process.platform !== "win32",
High
bin/kraftwerk.jsView file
15if (existsSync(src) && process.env.KRAFTWERK_DIST !== "1") {
L16: const { register } = await import("tsx/esm/api");
L17: register();
Findings
2 Critical4 High4 Medium7 Low
CriticalTrojan Source Unicodeinspector/dist/assets/editor-Cmri6xKM.js
CriticalPrevious Version Dangerous Deltadist/inspector/git.js
HighChild Processdist/remote.js
HighShelldist/inspector/vibeables.js
HighRuntime Package Installdist/inspector/runner.js
HighSemantic Analysis Limiteddist/cli/tunnel.js#virtual:normalized:round1
MediumDynamic Requirebin/kraftwerk.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowWeak Crypto
Affected versions and remediation
This report applies to @netnodeag/kraftwerk@0.62.0.
See all versions of @netnodeag/kraftwerk for other recorded verdicts.
- Review the evidence and your use of @netnodeag/kraftwerk@0.62.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.