registry / @ngockhoale/ukit / 2.6.9
@ngockhoale/ukit@2.6.9
⚠ Under reviewInstall/update an index-first AI workspace for Claude Code, OpenAI Codex, OpenCode, and omp (Oh My Pi).
AI Security Review
scanned 15d ago · by lpm-firewall-aiInspection found no npm lifecycle scripts or concrete attack behavior. Required clean-result citation coverage exceeds the eight-citation limit, so the result remains unresolved.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
No malicious trigger was established; the package provides an explicit CLI.
Impact
No confirmed security impact was established.
Mechanism
Inspected behavior relates to project configuration and indexing, but the available citation limit prevents complete clean-result coverage.
AI rationale
Inspection found no npm lifecycle scripts or concrete attack behavior. Required clean-result citation coverage exceeds the eight-citation limit, so the result remains unresolved.
Decision evidence
public snapshotAI called this Manual Review at 72.0% confidence as Unknown with low false-positive risk.
AI review observations
- The package manifest exposes a CLI and declares no npm lifecycle scripts.
- The inspected integration code concerns project ignore rules, gateway resilience settings, hook repair, indexing, image extraction, and worktree provisioning; no concrete attack behavior was established.
- The required clean citation coverage exceeds the eight-citation limit.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell
HighEntropyStrings
Source & flagged code
7 flagged · loading sourcescripts/bench/runGold.mjsView file
110const rootDir = projectRoot ?? REPO_ROOT;
L111: const { compileContext } = await import(path.join(REPO_ROOT, 'src/core/codeintel/compiler.js'));
L112: const { routeTask } = await import(path.join(REPO_ROOT, 'src/core/codeintel/router.js'));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
scripts/bench/runGold.mjsView on unpkg · L110src/core/memory/migrate.jsView file
1// Memory v1 → v2 migration — SPEC §4.
L2: // Idempotent: marker v2/migrated-from-v1.json; re-run is a no-op.
Low
Weak Crypto
Package source references weak cryptographic algorithms.
src/core/memory/migrate.jsView on unpkg · L1templates/.claude/hooks/task-watchdog.shView file
Findings
2 High4 Medium6 Low
HighPayload In Excluded Dirtemplates/.claude/hooks/task-watchdog.sh
HighPrevious Version Dangerous Deltascripts/bench/parallel-agents.mjs
MediumDynamic Requirescripts/bench/runGold.mjs
MediumEnvironment Vars
MediumShips Build Helpertemplates/.claude/hooks/task-watchdog.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptosrc/core/memory/migrate.js
LowFilesystem
LowHigh Entropy Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencesrc/core/applyPlan.js
Affected versions and remediation
This report applies to @ngockhoale/ukit@2.6.9.
See all versions of @ngockhoale/ukit for other recorded verdicts.
- Review the evidence and your use of @ngockhoale/ukit@2.6.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.