registry / AI-agent capability abuse / @ngockhoale/ukit / 2.7.8

@ngockhoale/ukit@2.7.8

Install/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).

AI Security Review

scanned 15d ago · by lpm-firewall-ai

The package exposes an explicit CLI without an install hook, while its shipped agent hook can influence Stop handling. This supports a warning for package-owned agent capability, not a confirmed attack.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

An installed agent runs the watchdog for a Stop event.

Impact

The coordinator can influence whether the agent continues; no separate malicious action was established from the inspected excerpts.

Mechanism

The hook starts the coordinator with staged input and passes through its decision.

AI rationale

Evidence

templates/.claude/hooks/task-watchdog.sh

Decision evidence

public snapshot

AI called this Suspicious at 76.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest exposes UKit through an explicit CLI and has no install lifecycle hook.
The bundled task watchdog delegates a Stop event to a coordinator that can affect continuation decisions.
The watchdog starts the coordinator as a child process when the coordinator file exists.

Evidence against

The watchdog is part of a package-owned agent workspace template, and its Stop behavior is activated through the agent hook system.
The inspected sources show project settings preservation and project-scoped indexing behavior; no credential collection or external endpoint was identified.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 120 file(s), 1.14 MB of source

Source & flagged code

7 flagged

scripts/bench/runGold.mjsView file

Lines 90-130javascript

90 failures.push(`budget: used ${packet.budget.used} > maxTokens ${maxTokens}`);

91 }

93 return {

94 id: testCase.id ?? '(unnamed)',

95 mode: packet.task_type,

96 expectedMode,

97 anchors: [...anchorPaths],

98 expectedAnchors,

99 anchorHits,

100 anchorMisses,

101 budgetUsed: packet.budget?.used ?? 0,

102 maxTokens,

103 routedMode: routed.mode,

104 pass: failures.length === 0,

105 failures,

106 };

107}

108

109export async function runGold({ projectRoot, corpusPath } = {}) {

110 const rootDir = projectRoot ?? REPO_ROOT;

111 const { compileContext } = await import(path.join(REPO_ROOT, 'src/core/codeintel/compiler.js'));

112 const { routeTask } = await import(path.join(REPO_ROOT, 'src/core/codeintel/router.js'));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/bench/runGold.mjsView on unpkg · L110

113 const { buildCodeIndex } = await import(path.join(REPO_ROOT, 'src/index/buildIndex.js'));

114 const { INDEX_ARTIFACTS, getArtifactPath } = await import(path.join(REPO_ROOT, 'src/index/paths.js'));

115

116 // The bench needs an index to score anchors; build once when missing.

117 try {

118 await fs.stat(getArtifactPath(rootDir, INDEX_ARTIFACTS.files));

119 } catch {

120 console.log('[bench] index missing — building code index first');

121 await buildCodeIndex({ rootDir });

122 }

123

124 const cases = await loadCorpus(corpusPath ?? DEFAULT_CORPUS);

125 const results = [];

126 for (const testCase of cases) {

127 results.push(await runGoldCase(rootDir, testCase, { compileContext, routeTask }));

128 }

129 return { results, pass: results.every((r) => r.pass) };

130}

src/core/memory/migrate.jsView file

Lines 1-21javascript

1// Memory v1 → v2 migration — SPEC §4.

2// Idempotent: marker v2/migrated-from-v1.json; re-run is a no-op.

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/core/memory/migrate.jsView on unpkg · L1

3// Backup-first: legacy memory dir copied to v1-backup-<ts>/ before writing.

4// Legacy files are never mutated.

6import crypto from 'node:crypto';

7import fs

templates/.claude/hooks/task-watchdog.shView file

•path = templates/.claude/hooks/task-watchdog.sh kind = payload_in_excluded_dir sizeBytes = 11622 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/.claude/hooks/task-watchdog.shView on unpkg

•path = templates/.claude/hooks/task-watchdog.sh kind = build_helper sizeBytes = 11622 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/.claude/hooks/task-watchdog.shView on unpkg

scripts/perf/audit-perf.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/perf/audit-perf.mjs#virtual:normalized:round1View on unpkg

scripts/bench/parallel-agents.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @ngockhoale/ukit@2.4.1 matchedIdentity = npm:QG5nb2NraG9hbGUvdWtpdA:2.4.1 similarity = 0.461 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/bench/parallel-agents.mjsView on unpkg

package.jsonView file

Lines 24-64json

24 },

25 "homepage": "https://github.com/lengockhoa/UKit#readme",

26 "bugs": {

27 "url": "https://github.com/lengockhoa/UKit/issues"

28 },

29 "files": [

30 "bin/",

Source & flagged code

7 flagged · loading source

scripts/bench/runGold.mjsView file

110const rootDir = projectRoot ?? REPO_ROOT; L111: const { compileContext } = await import(path.join(REPO_ROOT, 'src/core/codeintel/compiler.js')); L112: const { routeTask } = await import(path.join(REPO_ROOT, 'src/core/codeintel/router.js'));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/bench/runGold.mjsView on unpkg · L110

src/core/memory/migrate.jsView file

1// Memory v1 → v2 migration — SPEC §4. L2: // Idempotent: marker v2/migrated-from-v1.json; re-run is a no-op.

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/core/memory/migrate.jsView on unpkg · L1

templates/.claude/hooks/task-watchdog.shView file

Findings

3 High5 Medium4 Low

HighPayload In Excluded Dirtemplates/.claude/hooks/task-watchdog.sh

HighSemantic Analysis Limitedscripts/perf/audit-perf.mjs#virtual:normalized:round1

HighPrevious Version Dangerous Deltascripts/bench/parallel-agents.mjs

MediumDynamic Requirescripts/bench/runGold.mjs

MediumEnvironment Vars

MediumShips Build Helpertemplates/.claude/hooks/task-watchdog.sh

MediumStructural Risk Force Deep Review

MediumSuspicious Lifecycle Evidencepackage.json

LowScripts Present

LowWeak Cryptosrc/core/memory/migrate.js

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @ngockhoale/ukit@2.7.8.

See all versions of @ngockhoale/ukit for other recorded verdicts.

Review the evidence and your use of @ngockhoale/ukit@2.7.8 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-08 00:59:40.624Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code