@ngockhoale/ukit@3.4.25
Install/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe active runtime path sends credentials belonging to the Anthropic service to a package-selected third-party default endpoint without recipient-specific consent. This is concrete credential disclosure and warrants blocking publication.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A task-routing operation runs the decision preflight with the default configuration and no lane-specific credential or endpoint override.
Impact
An existing service credential is disclosed to that default recipient without recipient-specific consent.
Mechanism
The key resolver falls back to credentials from the Anthropic environment or Claude settings. The client sends the resolved value in an authorization header to the configured decision endpoint, whose default is the publisher-selected host.
Attack narrative
With the shipped defaults, task routing can invoke the enabled decision preflight. When no dedicated decision key is configured, the resolver uses an Anthropic API key or token and sends it to the default gateway in an authorization header.
AI rationale
The active runtime path sends credentials belonging to the Anthropic service to a package-selected third-party default endpoint without recipient-specific consent. This is concrete credential disclosure and warrants blocking publication.
Evidence
src/core/runtimeConfig.jssrc/index/taskRouting.jssrc/decision/shadow.jssrc/core/gatewayProbe.jssrc/decision/client.jstemplate_user/storage/gatewayDecision.json
Network endpoints1
openai.unicjsc.com
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The decision plane is enabled by default, and task routing runs its preflight unless disabled.
- The shipped lane configuration leaves the endpoint and key blank; URL resolution then uses the fixed default host.
- When no lane-specific key is configured, the resolver falls back to shared gateway credentials, including Anthropic keys read from the environment or Claude settings.
- The client places the resolved credential in an authorization header and sends it in a POST to the resolved endpoint.
- This exposes an existing service credential to the publisher-selected default recipient without recipient-specific consent.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell
HighEntropyStringsUrlStrings
Source & flagged code
17 flagged · loading sourcescripts/bench/runGold.mjsView file
121const rootDir = projectRoot ?? REPO_ROOT;
L122: const { compileContext } = await import(path.join(REPO_ROOT, 'src/core/codeintel/compiler.js'));
L123: const { routeTask } = await import(path.join(REPO_ROOT, 'src/core/codeintel/router.js'));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
scripts/bench/runGold.mjsView on unpkg · L121scripts/release/verify-release.mjsView file
•matchType = normalized_sha256
matchedPackage = @ngockhoale/ukit@3.4.40
matchedPath = scripts/release/verify-release.mjs
matchedIdentity = npm:QG5nb2NraG9hbGUvdWtpdA:3.4.40
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/release/verify-release.mjsView on unpkg1import { spawn } from 'node:child_process';
L2: import { readFileSync, writeFileSync, unlinkSync, existsSync } from 'node:fs';
...
L6:
L7: const rootDir = process.cwd();
L8: const npmCacheDir = path.join(os.tmpdir(), 'ukit-npm-cache');
...
L14: // UKIT_VERIFY_STEP_TIMEOUT_MS overrides the step budget for tests.
L15: const STEP_TIMEOUT_MS = Number(process.env.UKIT_VERIFY_STEP_TIMEOUT_MS) || 10 * 60 * 1000; // 10 min
L16: const REGISTRY_TIMEOUT_MS = Number(process.env.UKIT_VERIFY_REGISTRY_TIMEOUT_MS) || 60 * 1000; // 1 min
...
L18: // Opt-in post-publish registry-parity check (Release Policy invariant: npm and git always hold
L19: // the same latest version). Only meaningful AFTER `npm publish` — before publish the registry is
L20: // behind by definition — so it is gated behind --post-
Findings
14 High4 Medium5 Low
HighPayload In Excluded Dirtemplate_project/.claude/hooks/task-watchdog.sh
HighSemantic Analysis Limitedscripts/audit/decision-coverage.mjs#virtual:normalized:round1
HighKnown Malware Source Similarityscripts/bench/decision-runtime-baseline.mjs
HighKnown Malware Source Similarityscripts/bench/decision-runtime-variant.mjs
HighKnown Malware Source Similarityscripts/bench/memory-baseline.mjs
HighKnown Malware Source Similarityscripts/measure-decision-gateway.mjs
HighKnown Malware Source Similarityscripts/bench/memory-bench.mjs
HighKnown Malware Source Similarityscripts/bench/parallel-agents.mjs
HighKnown Malware Source Similarityscripts/bench/recorder-overhead.mjs
HighKnown Malware Source Similarity
Affected versions and remediation
This report applies to @ngockhoale/ukit@3.4.25.
See all versions of @ngockhoale/ukit for other recorded verdicts.
- Avoid installing @ngockhoale/ukit@3.4.25. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.