registry / AI-agent capability abuse / @ngockhoale/ukit / 2.2.16

@ngockhoale/ukit@2.2.16

Install/update an index-first AI workspace for Claude Code, OpenAI Codex, OpenCode, and omp (Oh My Pi).

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is a user-invoked AI workspace installer with meaningful permission and hook side effects, so it warrants a warning. The absence of npm lifecycle hooks and of concrete exfiltration or remote execution prevents a malicious classification.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user runs the ukit CLI or its install command in a project.

Impact

A user-authorized install broadens the configured agent's ability to edit files and run allowlisted commands, and persists local hook execution within that project.

Mechanism

Project-local AI configuration and Git-hook installation.

AI rationale

Evidence

src/cli/index.jssrc/cli/commands/install.jssrc/core/runInstallPipeline.jssrc/index/gitHooks.jstemplates/.claude/settings.json.claude/settings.json.claude/hooks/vision-router.sh.claude/ukit/index/extract-image.mjs.git/hooks/post-commit.git/hooks/post-merge.git/hooks/post-checkout

Decision evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The package exposes a CLI entry point.
Running the CLI with no command defaults to installation.
The installed Claude configuration sets permission bypass mode and permits file edits and selected shell commands.
The installer adds executable Git hooks that invoke a project-local Node script after Git events.

Evidence against

package.json has no preinstall, install, postinstall, or prepare lifecycle hook.
The reviewed hook router invokes a local Node extractor with fixed arguments; no secret collection or package-controlled network endpoint was found.
No runtime dependency on this package name or remote payload-loading path was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 72 file(s), 545 KB of source

Source & flagged code

7 flagged

templates/.claude/hooks/vision-router.shView file

•path = templates/.claude/hooks/vision-router.sh kind = payload_in_excluded_dir sizeBytes = 7727 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/.claude/hooks/vision-router.shView on unpkg

•path = templates/.claude/hooks/vision-router.sh kind = build_helper sizeBytes = 7727 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/.claude/hooks/vision-router.shView on unpkg

package.jsonView file

Lines 26-66json

26 "homepage": "https://github.com/lengockhoa/UKit#readme",

27 "bugs": {

28 "url": "https://github.com/lengockhoa/UKit/issues"

29 },

30 "files": [

31 "bin/",

32 "src/",

33 "scripts/",

34 "templates/",

35 "CHANGELOG.md",

36 "LICENSE",

37 "templates/CLAUDE.md",

38 "templates/AGENTS.md",

39 "templates/.gitignore",

40 "manifests/",

41 "templates/adapter-presets/opencode/opencode.template.json"

42 ],

43 "publishConfig": {

44 "access": "public"

45 },

46 "bin": {

47 "ukit": "bin/ukit"

48 },

49 "scripts": {

50 "start": "node ./bin/ukit",

51 "doctor": "node ./bin/ukit doctor",

52 "diff": "node ./bin/ukit diff",

53 "index:build": "node ./scripts/index/build-index.mjs",

54 "index:refresh": "node ./scripts/index/refresh-index.mjs",

55 "index:query": "node ./scripts/index/query-index.mjs",

Medium

Ai Review Evidence

The package exposes a CLI entry point.

package.jsonView on unpkg · L46

56 "bug:triage": "node ./scripts/bug/triage.mjs",

57 "skill:audit": "node ./scripts/skill/audit-skill.mjs",

58 "test:artifact": "vitest run tests/integration/packageArtifact.test.js",

59 "test:release-core": "vitest run --exclude tests/integration/packageArtifact.test.js",

60 "release:verify": "node ./scripts/release/verify-release.mjs",

61 "test": "vitest run",

62 "test:watch": "vitest"

63 },

64 "engines": {

65 "node": ">=20"

66 },

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

scripts/release/verify-release.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @ngockhoale/ukit@2.3.22 matchedIdentity = npm:QG5nb2NraG9hbGUvdWtpdA:2.3.22 similarity = 0.707 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/release/verify-release.mjsView on unpkg

src/cli/index.jsView file

Lines 1-36javascript

1import { runInstall } from './commands/install.js';

2import { runDiff } from './commands/diff.js';

3import { runDoctor, printDoctorHelp, DOCTOR_HELP_FLAGS } from './commands/doctor.js';

4import { runUninstall } from './commands/uninstall.js'

templates/.claude/settings.jsonView file

16"permissions": { "defaultMode": "bypassPermissions", "allow": [ "Read", "Glob", "Grep", "Edit", "Write", "TodoWrite", "TaskOutput",

Medium

Ai Review Evidence

The installed Claude configuration sets permission bypass mode and permits file edits and selected shell commands.

templates/.claude/settings.jsonView on unpkg · L16

Source & flagged code

7 flagged · loading source

templates/.claude/hooks/vision-router.shView file

•path = templates/.claude/hooks/vision-router.sh kind = payload_in_excluded_dir sizeBytes = 7727 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/.claude/hooks/vision-router.shView on unpkg

•path = templates/.claude/hooks/vision-router.sh kind = build_helper sizeBytes = 7727 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/.claude/hooks/vision-router.shView on unpkg

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

Findings

3 High6 Medium3 Low

HighPayload In Excluded Dirtemplates/.claude/hooks/vision-router.sh

HighSemantic Analysis Limitedpackage.json

HighPrevious Version Dangerous Deltascripts/release/verify-release.mjs

MediumEnvironment Vars

MediumShips Build Helpertemplates/.claude/hooks/vision-router.sh

MediumStructural Risk Force Deep Review

MediumAi Review Evidencepackage.json

MediumAi Review Evidencesrc/cli/index.js

MediumAi Review Evidencetemplates/.claude/settings.json

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @ngockhoale/ukit@2.2.16.

See all versions of @ngockhoale/ukit for other recorded verdicts.

Review the evidence and your use of @ngockhoale/ukit@2.2.16 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-13 23:23:31.019Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code