registry / @ngockhoale/ukit / 2.3.17
@ngockhoale/ukit@2.3.17
Install/update an index-first AI workspace for Claude Code, OpenAI Codex, OpenCode, and omp (Oh My Pi).
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package is not concretely malicious by static inspection, but its explicit installer deploys and overwrites active AI-agent hooks. This is a guarded agent-extension lifecycle risk that warrants a warning rather than publication blocking.
Static reason
No blocking static signals were detected.
Trigger
The user runs ukit install, including the default CLI command, in a project.
Impact
The installed hooks can intercept or block Claude tool and prompt events in the selected project; no network endpoint or secret export was found.
Mechanism
Installs managed AI-agent hook templates and loads project-local hook runtime code.
AI rationale
The package is not concretely malicious by static inspection, but its explicit installer deploys and overwrites active AI-agent hooks. This is a guarded agent-extension lifecycle risk that warrants a warning rather than publication blocking.
Evidence
manifests/platform.full.yamltemplates/.claude/hooks/task-watchdog.shtemplates/.claude/hooks/sensitive-data-guard.sh.claude/hooks/task-watchdog.sh.claude/hooks/sensitive-data-guard.sh.claude/ukit/runtime/task-watchdog.mjs.ukit/storage/config.json
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- No npm install lifecycle is declared, but the package exposes an explicit CLI installer.
- The manifest installs first-party Claude hook templates into the consumer project by default.
- A hook dynamically imports project-local runtime code during Claude hook events.
- The sensitive-data hook reads project configuration and intercepts AI tool and prompt inputs.
Evidence against
- No preinstall, install, or postinstall script is present.
- No package-controlled network endpoint or credential exfiltration was found.
- The observed hooks are installed only after a user invokes the CLI.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemShell
HighEntropyStrings
Source & flagged code
7 flagged · loading sourcetemplates/.claude/hooks/task-watchdog.shView file
•path = templates/.claude/hooks/task-watchdog.sh
kind = payload_in_excluded_dir
sizeBytes = 8598
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
templates/.claude/hooks/task-watchdog.shView on unpkg•path = templates/.claude/hooks/task-watchdog.sh
kind = build_helper
sizeBytes = 8598
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
templates/.claude/hooks/task-watchdog.shView on unpkg63const hookEvent = typeof payload.hook_event_name === 'string' ? payload.hook_event_name : '';
const toolName = typeof payload.tool_name === 'string' ? payload.tool_name : '';
const projectRoot = process.env.PROJECT_ROOT || process.cwd();
// Silent degrade for non-relevant events — same posture as every other
// UKit advisory hook: only do work when the event type is ours.
if (hookEvent !== 'Stop' && hookEvent !== 'PostToolUse') {
process.exit(0);
}
const runtimePath = path.join(projectRoot, '.claude', 'ukit', 'runtime', 'task-watchdog.mjs');
// Async existence check —
Findings
2 High7 Medium3 Low
HighPayload In Excluded Dirtemplates/.claude/hooks/task-watchdog.sh
HighSemantic Analysis Limitedpackage.json
MediumEnvironment Vars
MediumShips Build Helpertemplates/.claude/hooks/task-watchdog.sh
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencemanifests/platform.full.yaml
MediumAi Review Evidencetemplates/.claude/hooks/task-watchdog.sh
MediumAi Review Evidencetemplates/.claude/hooks/sensitive-data-guard.sh
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @ngockhoale/ukit@2.3.17.
See all versions of @ngockhoale/ukit for other recorded verdicts.
- Review the evidence and your use of @ngockhoale/ukit@2.3.17 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.