registry / @ngockhoale/ukit / 2.7.11
@ngockhoale/ukit@2.7.11
⚠ Under reviewInstall/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).
AI Security Review
scanned 15d ago · by lpm-firewall-aiInspected source did not establish a concrete attack, and no npm lifecycle hook was defined in the manifest. The required clean citation list exceeds the eight-citation limit, so the remaining coverage cannot be verified in this report.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
No automatic npm lifecycle trigger was present in the inspected manifest.
Impact
No confirmed harmful impact; full clean coverage remains unresolved.
Mechanism
Inspected snippets concern telemetry, path protection, local routing, and project configuration handling; they do not establish an attack mechanism.
AI rationale
Inspected source did not establish a concrete attack, and no npm lifecycle hook was defined in the manifest. The required clean citation list exceeds the eight-citation limit, so the remaining coverage cannot be verified in this report.
Decision evidence
public snapshotAI called this Manual Review at 72.0% confidence as Unknown with low false-positive risk.
AI review observations
- The manifest defines a CLI entry point and no lifecycle hook, so these source files do not run automatically during npm installation.
- The inspected apply-plan code protects Codex, Antigravity, and omp paths.
- The inspected files show bounded telemetry, project ignore handling, preservation of existing gateway settings, and targeted hook repair.
- The skill router loads a package-local route catalog; the image extractor scans project configuration paths.
- The required clean citation list has eleven paths, exceeding the eight-citation limit, so a fully covered clean decision cannot be supported here.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell
HighEntropyStrings
Source & flagged code
7 flagged · loading sourcescripts/bench/runGold.mjsView file
110const rootDir = projectRoot ?? REPO_ROOT;
L111: const { compileContext } = await import(path.join(REPO_ROOT, 'src/core/codeintel/compiler.js'));
L112: const { routeTask } = await import(path.join(REPO_ROOT, 'src/core/codeintel/router.js'));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
scripts/bench/runGold.mjsView on unpkg · L110src/core/memory/migrate.jsView file
1// Memory v1 → v2 migration — SPEC §4.
L2: // Idempotent: marker v2/migrated-from-v1.json; re-run is a no-op.
Low
Weak Crypto
Package source references weak cryptographic algorithms.
src/core/memory/migrate.jsView on unpkg · L1templates/.claude/hooks/task-watchdog.shView file
Findings
3 High4 Medium5 Low
HighPayload In Excluded Dirtemplates/.claude/hooks/task-watchdog.sh
HighSemantic Analysis Limitedscripts/perf/audit-perf.mjs#virtual:normalized:round1
HighPrevious Version Dangerous Deltascripts/bench/parallel-agents.mjs
MediumDynamic Requirescripts/bench/runGold.mjs
MediumEnvironment Vars
MediumShips Build Helpertemplates/.claude/hooks/task-watchdog.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptosrc/core/memory/migrate.js
LowFilesystem
LowHigh Entropy Strings
LowAi Review Evidencescripts/perf/audit-perf.mjs
Affected versions and remediation
This report applies to @ngockhoale/ukit@2.7.11.
See all versions of @ngockhoale/ukit for other recorded verdicts.
- Review the evidence and your use of @ngockhoale/ukit@2.7.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.