registry / @ngockhoale/ukit / 3.4.43
@ngockhoale/ukit@3.4.43
Install/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe source shows first-party agent setup that runs through an explicit CLI install command, so it merits a warning under the agent-extension policy. I found no source evidence supporting a publish block.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A user runs `ukit install` or the default CLI install command.
Impact
Installed instructions and hooks can affect subsequent agent behavior in the project, which warrants a warning for first-party agent setup.
Mechanism
The installer applies manifest-managed agent templates and configuration to project agent directories, using backup-on-overwrite for the cited reviewer agent.
AI rationale
The source shows first-party agent setup that runs through an explicit CLI install command, so it merits a warning under the agent-extension policy. I found no source evidence supporting a publish block.
Evidence
src/cli/commands/install.jssrc/core/runInstallPipeline.jsmanifests/platform.full.yaml.claude/agents/code-reviewer.md
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes a CLI that routes an explicit `ukit install` command to its installer; the manifest has no install lifecycle hook.
- The installer applies package-owned agent templates to project configuration. A reviewer agent is enabled by default and installed with backup-on-overwrite behavior.
- The flagged benchmark and probe targets perform fixture, measurement, or workspace-inventory work; the installer targets include protected writes, root-level ignore rules, guarded gateway defaults, hook repair, and bounded uninstall paths.
- Gateway resilience settings are applied only after a custom gateway is detected, and the source says existing non-default user values are preserved.
Evidence against
- No npm install hook automatically performs the agent setup; it is triggered by running the CLI installer.
- The inspected source does not establish credential theft, remote code execution, or unconsented broad agent-control takeover.
Behavioral surface
ChildProcessCryptoDynamicRequire
Source & flagged code
17 flagged · loading sourcescripts/bench/runGold.mjsView file
121const rootDir = projectRoot ?? REPO_ROOT;
L122: const { compileContext } = await import(path.join(REPO_ROOT, 'src/core/codeintel/compiler.js'));
L123: const { routeTask } = await import(path.join(REPO_ROOT, 'src/core/codeintel/router.js'));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
scripts/bench/runGold.mjsView on unpkg · L121scripts/release/verify-release.mjsView file
•matchType = normalized_sha256
matchedPackage = @ngockhoale/ukit@3.4.42
matchedPath = scripts/release/verify-release.mjs
matchedIdentity = npm:QG5nb2NraG9hbGUvdWtpdA:3.4.42
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/release/verify-release.mjsView on unpkg1import { spawn } from 'node:child_process';
L2: import { readFileSync, writeFileSync, unlinkSync, existsSync } from 'node:fs';
...
L6:
L7: const rootDir = process.cwd();
L8: const npmCacheDir = path.join(os.tmpdir(), 'ukit-npm-cache');
...
L14: // UKIT_VERIFY_STEP_TIMEOUT_MS overrides the step budget for tests.
L15: const STEP_TIMEOUT_MS = Number(process.env.UKIT_VERIFY_STEP_TIMEOUT_MS) || 10 * 60 * 1000; // 10 min
L16: const REGISTRY_TIMEOUT_MS = Number(process.env.UKIT_VERIFY_REGISTRY_TIMEOUT_MS) || 60 * 1000; // 1 min
...
L18: // Opt-in post-publish registry-parity check (Release Policy invariant: npm and git always hold
L19: // the same latest version). Only meaningful AFTER `npm publish` — before publish the registry is
L20: // behind by definition — so it is gated behind --post-
Findings
14 High4 Medium5 Low
HighPayload In Excluded Dirtemplate_project/.claude/hooks/task-watchdog.sh
HighSemantic Analysis Limitedscripts/audit/decision-coverage.mjs#virtual:normalized:round1
HighKnown Malware Source Similarityscripts/bench/decision-runtime-baseline.mjs
HighKnown Malware Source Similarityscripts/bench/decision-runtime-variant.mjs
HighKnown Malware Source Similarityscripts/bench/memory-baseline.mjs
HighKnown Malware Source Similarityscripts/measure-decision-gateway.mjs
HighKnown Malware Source Similarityscripts/bench/memory-bench.mjs
HighKnown Malware Source Similarityscripts/bench/parallel-agents.mjs
HighKnown Malware Source Similarityscripts/bench/recorder-overhead.mjs
HighKnown Malware Source Similarity
Affected versions and remediation
This report applies to @ngockhoale/ukit@3.4.43.
See all versions of @ngockhoale/ukit for other recorded verdicts.
- Review the evidence and your use of @ngockhoale/ukit@3.4.43 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.