@ngockhoale/ukit@3.4.41
Install/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe shipped runtime default activates a request that can disclose Anthropic credentials to a package-selected, unrelated endpoint without recipient-specific consent. This concrete credential transfer warrants blocking publication.
Static reason
No blocking static signals were detected.
Trigger
A task-routing call runs with the shipped default decision stage and no dedicated UKIT decision key configured.
Impact
The decision service receives a credential intended for Claude authentication, which could enable unauthorized use if the credential is accepted there.
Mechanism
The runtime falls back to an Anthropic credential from the environment or Claude settings, then attaches it to a POST sent to the default decision endpoint.
Attack narrative
When task routing runs with the shipped decision-plane default, UKit resolves the decision service independently of the host LLM endpoint. If no dedicated decision key is set, it reuses an Anthropic API key or auth token from the environment or Claude settings and sends it in the request header to the default UNIC endpoint. This is an unguarded disclosure to a separate service.
AI rationale
The shipped runtime default activates a request that can disclose Anthropic credentials to a package-selected, unrelated endpoint without recipient-specific consent. This concrete credential transfer warrants blocking publication.
Evidence
package.jsonsrc/core/runtimeConfig.jssrc/core/gatewayProbe.jssrc/decision/client.jssrc/index/taskRouting.jssrc/decision/shadow.js
Network endpoints1
openai.unicjsc.com
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json exposes the ukit CLI; inspection found no npm lifecycle hook that triggers the behavior.
- The decision plane ships enabled at the default stage, and task routing invokes it unless disabled.
- The decision client uses a separate endpoint from the host LLM gateway; its fallback is https://openai.unicjsc.com.
- When no dedicated decision key is configured, key resolution falls back to Claude's ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN from the environment or settings.
- The client places that key in an Authorization or x-api-key header and sends a POST request to the resolved endpoint.
- The surfaced agent-integration locations concern fixtures, probes, and scoped project or hook maintenance; they do not add consent around this runtime credential transfer.
Evidence against
- The decision state packet is limited to whitelisted, bounded fields; this limits request data but does not protect the credential sent in its header.
- The package provides a dedicated decision-key configuration path, but the runtime still falls back to Anthropic credentials when that key is absent.
Behavioral surface
Source & flagged code
6 flagged · loading sourcescripts/bench/runGold.mjsView file
121const rootDir = projectRoot ?? REPO_ROOT;
L122: const { compileContext } = await import(path.join(REPO_ROOT, 'src/core/codeintel/compiler.js'));
L123: const { routeTask } = await import(path.join(REPO_ROOT, 'src/core/codeintel/router.js'));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
scripts/bench/runGold.mjsView on unpkg · L121scripts/release/verify-release.mjsView file
1import { spawn } from 'node:child_process';
L2: import { readFileSync, writeFileSync, unlinkSync, existsSync } from 'node:fs';
...
L6:
L7: const rootDir = process.cwd();
L8: const npmCacheDir = path.join(os.tmpdir(), 'ukit-npm-cache');
...
L14: // UKIT_VERIFY_STEP_TIMEOUT_MS overrides the step budget for tests.
L15: const STEP_TIMEOUT_MS = Number(process.env.UKIT_VERIFY_STEP_TIMEOUT_MS) || 10 * 60 * 1000; // 10 min
L16: const REGISTRY_TIMEOUT_MS = Number(process.env.UKIT_VERIFY_REGISTRY_TIMEOUT_MS) || 60 * 1000; // 1 min
...
L18: // Opt-in post-publish registry-parity check (Release Policy invariant: npm and git always hold
L19: // the same latest version). Only meaningful AFTER `npm publish` — before publish the registry is
L20: // behind by definition — so it is gated behind --post-
Low
Weak Crypto
Package source references weak cryptographic algorithms.
Findings
3 High4 Medium5 Low
HighPayload In Excluded Dirtemplate_project/.claude/hooks/task-watchdog.sh
HighSemantic Analysis Limitedscripts/audit/decision-coverage.mjs#virtual:normalized:round1
HighSuspicious Lifecycle Evidencepackage.json
MediumDynamic Requirescripts/bench/runGold.mjs
MediumEnvironment Vars
MediumShips Build Helpertemplate_project/.claude/hooks/task-watchdog.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptoscripts/release/verify-release.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @ngockhoale/ukit@3.4.41.
See all versions of @ngockhoale/ukit for other recorded verdicts.
- Avoid installing @ngockhoale/ukit@3.4.41. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.