registry / @ngockhoale/ukit / 3.1.8
@ngockhoale/ukit@3.1.8
⚠ Under reviewInstall/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).
AI Security Review
scanned 15d ago · by lpm-firewall-aiSource inspection did not establish malicious behavior. The required clean citation coverage exceeds the eight-citation limit, so this is manual review rather than a clean verdict.
Static reason
No blocking static signals were detected.
Trigger
The CLI is run explicitly by a user; no npm install lifecycle hook is declared.
Impact
No supported evidence of credential theft, covert network activity, or unconsented install-time control-surface mutation was established.
Mechanism
Reviewed configuration code concerns managed workspace defaults, hook repair, and package-owned routing data.
AI rationale
Source inspection did not establish malicious behavior. The required clean citation coverage exceeds the eight-citation limit, so this is manual review rather than a clean verdict.
Decision evidence
public snapshotAI called this Manual Review at 56.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest exposes an explicit CLI and no preinstall, install, or postinstall hook.
- The package provides project tooling and hook templates; reviewed hook code loads package-owned routing data from the project configuration.
- The inspected configuration code preserves existing user settings or removes broken hook registrations.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcescripts/bench/runGold.mjsView file
121const rootDir = projectRoot ?? REPO_ROOT;
L122: const { compileContext } = await import(path.join(REPO_ROOT, 'src/core/codeintel/compiler.js'));
L123: const { routeTask } = await import(path.join(REPO_ROOT, 'src/core/codeintel/router.js'));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
scripts/bench/runGold.mjsView on unpkg · L121src/core/memory/learningCandidates.jsView file
1// learningCandidates.js — M04.2 learning candidates (SPEC §5 FR-016, FR-018; C11).
L2: //
Low
Weak Crypto
Package source references weak cryptographic algorithms.
src/core/memory/learningCandidates.jsView on unpkg · L1template_project/.claude/hooks/task-watchdog.shView file
Findings
2 High4 Medium6 Low
HighPayload In Excluded Dirtemplate_project/.claude/hooks/task-watchdog.sh
HighSemantic Analysis Limitedscripts/audit/decision-coverage.mjs#virtual:normalized:round1
MediumDynamic Requirescripts/bench/runGold.mjs
MediumEnvironment Vars
MediumShips Build Helpertemplate_project/.claude/hooks/task-watchdog.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptosrc/core/memory/learningCandidates.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @ngockhoale/ukit@3.1.8.
See all versions of @ngockhoale/ukit for other recorded verdicts.
- Review the evidence and your use of @ngockhoale/ukit@3.1.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.