registry / @netnodeag/kraftwerk / 0.65.0
@netnodeag/kraftwerk@0.65.0
Open-source agentic workspace for teams — where people and AI agents get work done together: agents (Claude Code, Codex, Pi), skills, shared knowledge, repeatable workflows, and deterministic verification
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe manifest has no consumer install hook, and the reviewed source excerpts show product operations rather than a concrete attack. Scanner labels, including the bundle Unicode hint, did not establish malicious behavior in the inspected source.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
No package-install attack trigger was found; the manifest places build commands under prepublishOnly.
Impact
No unauthorized credential transfer, destructive action, or control-surface mutation was established.
Mechanism
Inspected code discovers skills, reads workspace data, starts requested runs, and resolves configured remote repositories.
AI rationale
The manifest has no consumer install hook, and the reviewed source excerpts show product operations rather than a concrete attack. Scanner labels, including the bundle Unicode hint, did not establish malicious behavior in the inspected source.
Decision evidence
public snapshotAI called this Clean at 76.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- package.json runs build steps from prepublishOnly, not an install lifecycle hook.
- The skills code reads project and user skill directories to discover skills.
- Runtime excerpts show event URLs derived from subscribed chat or vibeable topics and workspace run listing.
- The reviewed chat, state, project, and file excerpts handle messages, summaries, configuration, and file context.
- The browser bundle excerpts begin with Vite dependency maps and editor module code; they do not establish malicious behavior.
- Remote resolution, run triggering, and UI startup are tied to explicit product operations.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
8 flaggeddist/remote.jsView file
1import { spawnSync } from "node:child_process";
L2: import { mkdir, stat } from "node:fs/promises";
High
dist/core/vibeables.jsView file
351cwd: r.dir,
L352: shell: true,
L353: detached: process.platform !== "win32",
High
bin/kraftwerk.jsView file
15if (existsSync(src) && process.env.KRAFTWERK_DIST !== "1") {
L16: const { register } = await import("tsx/esm/api");
L17: register();
Findings
2 Critical4 High4 Medium7 Low
CriticalTrojan Source Unicodeweb/dist/assets/editor-C8yy8YS9.js
CriticalPrevious Version Dangerous Deltadist/cli/ui.js
HighChild Processdist/remote.js
HighShelldist/core/vibeables.js
HighRuntime Package Installdist/core/runner.js
HighSemantic Analysis Limiteddist/cli/doctor-legacy.js
MediumDynamic Requirebin/kraftwerk.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowWeak Cryptodist/core/instances.js
Affected versions and remediation
This report applies to @netnodeag/kraftwerk@0.65.0.
See all versions of @netnodeag/kraftwerk for other recorded verdicts.
- Review the evidence and your use of @netnodeag/kraftwerk@0.65.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.