registry / @netnodeag/kraftwerk / 0.73.0
@netnodeag/kraftwerk@0.73.0
Open-source agentic workspace for teams — where people and AI agents get work done together: agents (Claude Code, Codex, Pi), skills, shared knowledge, repeatable workflows, and deterministic verification
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe manifest has no install hook, and inspected runtime behavior is consistent with the package’s workspace, workflow, and agent-skill features. The scanner’s Unicode hint resolves to an editor text-processing character class, not a Trojan Source control sequence.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Product CLI, API, or UI operations.
Impact
No malicious impact was established.
Mechanism
Those operations use configured commands, local run data, or client-built event URLs; no unconsented install-time behavior was found.
AI rationale
The manifest has no install hook, and inspected runtime behavior is consistent with the package’s workspace, workflow, and agent-skill features. The scanner’s Unicode hint resolves to an editor text-processing character class, not a Trojan Source control sequence.
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines prepublishOnly as build work; it has no install lifecycle hook.
- Skills are discovered from workspace and Claude skill folders; writing an agent skill is exposed through a POST route.
- The live client builds event URLs through its configured client, and listRuns reads local run directories.
- The flagged web assets are bundled frontend modules; the editor’s U+200E occurrence is inside a character class used for text segmentation.
- Remote cloning, configured vibeable dev commands, workflow runs, and daemon startup are tied to explicit product operations.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
10 flaggeddist/remote.jsView file
1import { spawnSync } from "node:child_process";
L2: import { mkdir, stat } from "node:fs/promises";
High
dist/core/vibeables.jsView file
352cwd: r.dir,
L353: shell: true,
L354: detached: process.platform !== "win32",
High
bin/kraftwerk.jsView file
15if (existsSync(src) && process.env.KRAFTWERK_DIST !== "1") {
L16: const { register } = await import("tsx/esm/api");
L17: register();
Findings
1 Critical6 High5 Medium7 Low
CriticalTrojan Source Unicodeweb/dist/assets/editor-6D-WNjZY.js
HighChild Processdist/remote.js
HighShelldist/core/vibeables.js
HighSame File Env Network Executiondist/cli/daemon-control.js
HighCommand Output Exfiltrationdist/cli/daemon-control.js
HighRuntime Package Installdist/core/runner.js
HighSemantic Analysis Limiteddist/cli/daemon-control.js
MediumDynamic Requirebin/kraftwerk.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli/daemon-login.js
MediumStructural Risk Force Deep Review
Low
Affected versions and remediation
This report applies to @netnodeag/kraftwerk@0.73.0.
See all versions of @netnodeag/kraftwerk for other recorded verdicts.
- Review the evidence and your use of @netnodeag/kraftwerk@0.73.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.