registry / @netnodeag/kraftwerk / 0.71.1
@netnodeag/kraftwerk@0.71.1
Open-source agentic workspace for teams — where people and AI agents get work done together: agents (Claude Code, Codex, Pi), skills, shared knowledge, repeatable workflows, and deterministic verification
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe manifest has no npm install lifecycle hook, and inspected source ties flagged process execution and daemon persistence to user-invoked application functions. The scanner alerts did not establish malicious behavior in the inspected excerpts.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user invokes workflow execution or the daemon install command.
Impact
No unauthorized data transfer, destructive action, or unconsented install-time mutation was established.
Mechanism
Workflow execution launches the requested Kraftwerk workflow; daemon installation checks the platform and configures a macOS login item.
AI rationale
The manifest has no npm install lifecycle hook, and inspected source ties flagged process execution and daemon persistence to user-invoked application functions. The scanner alerts did not establish malicious behavior in the inspected excerpts.
Decision evidence
public snapshotAI called this Clean at 79.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- package.json defines only a prepublishOnly build hook; its bin entry loads the CLI.
- The flagged skills location reads agent skills from workspace and user directories; the excerpt shows skill listing, not an install-time configuration mutation.
- The live client constructs event URLs through the configured client for chat and vibeable streams.
- The flagged runs location lists local run records.
- The flagged web bundles begin with Vite chunk mappings or editor-library code, not an observed attack operation.
- Remote Git resolution and workflow triggering are implemented as application features; workflow execution uses the requested workflow and request.
- Daemon installation is an explicit exported CLI operation that checks for macOS before setting up a login item.
Evidence against
- No npm preinstall, install, or postinstall hook is declared.
- The scanner's dynamic execution, persistence, and Unicode alerts do not by themselves establish harmful behavior; inspected excerpts show user-triggered workflow and daemon operations.
Behavioral surface
Source & flagged code
8 flaggeddist/remote.jsView file
1import { spawnSync } from "node:child_process";
L2: import { mkdir, stat } from "node:fs/promises";
High
dist/core/vibeables.jsView file
352cwd: r.dir,
L353: shell: true,
L354: detached: process.platform !== "win32",
High
bin/kraftwerk.jsView file
15if (existsSync(src) && process.env.KRAFTWERK_DIST !== "1") {
L16: const { register } = await import("tsx/esm/api");
L17: register();
Findings
1 Critical4 High5 Medium7 Low
CriticalTrojan Source Unicodeweb/dist/assets/editor-B3am-j9U.js
HighChild Processdist/remote.js
HighShelldist/core/vibeables.js
HighRuntime Package Installdist/core/runner.js
HighSemantic Analysis Limiteddist/cli/daemon-login.js
MediumDynamic Requirebin/kraftwerk.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli/daemon-login.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowWeak Cryptodist/core/instances.js
Affected versions and remediation
This report applies to @netnodeag/kraftwerk@0.71.1.
See all versions of @netnodeag/kraftwerk for other recorded verdicts.
- Review the evidence and your use of @netnodeag/kraftwerk@0.71.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.