registry / @netnodeag/kraftwerk / 0.77.0
@netnodeag/kraftwerk@0.77.0
Open-source agentic workspace for teams — where people and AI agents get work done together: agents (Claude Code, Codex, Pi), skills, shared knowledge, repeatable workflows, and deterministic verification
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe manifest has no automatic installation hook, and the inspected findings resolve to normal editor, skill-management, local workflow, and configured project-development behavior. The scanner indicators alone do not establish malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user starts the daemon or a workflow, or enables a project vibeable with a configured development command.
Impact
No confirmed malicious impact or attack surface was established.
Mechanism
The package launches the specified local command in the relevant project directory; no install-time launch or unrelated control-surface mutation was established.
AI rationale
The manifest has no automatic installation hook, and the inspected findings resolve to normal editor, skill-management, local workflow, and configured project-development behavior. The scanner indicators alone do not establish malicious behavior.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines only a prepublishOnly build script; it has no preinstall, install, or postinstall hook.
- dist/core/skills.js scans project and user Claude skill directories; its separate saveAgentSkill operation writes caller-provided content to an agent-specific skills directory through an API route.
- dist/client/live.js builds event-stream URLs through the supplied client; dist/core/runs.js lists local run directories.
- The inspected web bundle excerpts show editor clipboard handling, URL parameter construction, and editor-node initialization.
- dist/remote.js clones or refreshes a caller-specified repository; dist/core/vibeables.js starts a configured development command in its project directory.
- dist/cli/daemon-control.js starts the daemon when requested; dist/core/runner.js launches a workflow with its supplied name and request.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystem
Source & flagged code
10 flaggeddist/remote.jsView file
1import { spawnSync } from "node:child_process";
L2: import { mkdir, stat } from "node:fs/promises";
High
dist/core/vibeables.jsView file
352cwd: r.dir,
L353: shell: true,
L354: detached: process.platform !== "win32",
High
bin/kraftwerk.jsView file
15if (existsSync(src) && process.env.KRAFTWERK_DIST !== "1") {
L16: const { register } = await import("tsx/esm/api");
L17: register();
Findings
1 Critical6 High5 Medium7 Low
CriticalTrojan Source Unicodeweb/dist/assets/editor-CyWapLQr.js
HighChild Processdist/remote.js
HighShelldist/core/vibeables.js
HighSame File Env Network Executiondist/cli/daemon-control.js
HighCommand Output Exfiltrationdist/cli/daemon-control.js
HighRuntime Package Installdist/core/runner.js
HighSemantic Analysis Limiteddist/cli/daemon-control.js
MediumDynamic Requirebin/kraftwerk.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli/daemon-login.js
MediumStructural Risk Force Deep Review
Low
Affected versions and remediation
This report applies to @netnodeag/kraftwerk@0.77.0.
See all versions of @netnodeag/kraftwerk for other recorded verdicts.
- Review the evidence and your use of @netnodeag/kraftwerk@0.77.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.