@ngockhoale/ukit@3.4.49
Install/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe source shows a default-enabled runtime path that forwards a host authentication token to a configurable gateway, with no destination allowlist or recipient-specific consent gate. The intended-provider description and sensitive-state filtering reduce certainty about misuse, but do not prevent exposure of the authentication token.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Ordinary task routing when the decision plane is enabled, which it is by default.
Impact
The gateway receives the host token; the source does not establish recipient-specific consent or constrain configurable destinations.
Mechanism
The client resolves the gateway to a default URL or configurable endpoint, obtains a shared host token when no lane-specific key is set, and places it in the request authentication header.
AI rationale
The source shows a default-enabled runtime path that forwards a host authentication token to a configurable gateway, with no destination allowlist or recipient-specific consent gate. The intended-provider description and sensitive-state filtering reduce certainty about misuse, but do not prevent exposure of the authentication token.
Evidence
src/core/runtimeConfig.jssrc/core/gatewayProbe.jssrc/decision/client.jssrc/index/taskRouting.js
Network endpoints1
openai.unicjsc.com
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest exposes a CLI and defines no install lifecycle hook.
- The decision plane is enabled by default and task routing can invoke it during ordinary routing.
- Without a decision-specific key, the client falls back to a host UNIC token and sends it as authentication to the resolved gateway; the default gateway is openai.unicjsc.com, and the endpoint can be overridden without a destination allowlist.
- The request filters sensitive state content, but that filter does not gate the separate authentication header.
- The inspected agent integration locations concern project configuration, indexing, cleanup, or probes; they do not establish a separate agent-control attack.
Evidence against
- The source describes the gateway as the intended UNIC decision provider, and the decision feature can be disabled or configured with a different endpoint.
- The package has no install lifecycle hook, and the inspected state-packet path blocks content marked sensitive before transmission.
Behavioral surface
ChildProcessCrypto
Source & flagged code
11 flagged · loading sourcesrc/core/runtimeConfig.jsView file
9L10: const require = createRequire(import.meta.url);
L11: const { version: PACKAGE_VERSION } = require('../../package.json');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
src/core/runtimeConfig.jsView on unpkg · L9scripts/release/verify-release.mjsView file
•matchType = normalized_sha256
matchedPackage = @ngockhoale/ukit@3.4.47
matchedPath = scripts/release/verify-release.mjs
matchedIdentity = npm:QG5nb2NraG9hbGUvdWtpdA:3.4.47
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/release/verify-release.mjsView on unpkg1import { spawn } from 'node:child_process';
L2: import { readFileSync, writeFileSync, unlinkSync, existsSync } from 'node:fs';
...
L6:
L7: const rootDir = process.cwd();
L8: const npmCacheDir = path.join(os.tmpdir(), 'ukit-npm-cache');
...
L14: // UKIT_VERIFY_STEP_TIMEOUT_MS overrides the step budget for tests.
L15: const STEP_TIMEOUT_MS = Number(process.env.UKIT_VERIFY_STEP_TIMEOUT_MS) || 10 * 60 * 1000; // 10 min
L16: const REGISTRY_TIMEOUT_MS = Number(process.env.UKIT_VERIFY_REGISTRY_TIMEOUT_MS) || 60 * 1000; // 1 min
...
L18: // Opt-in post-publish registry-parity check (Release Policy invariant: npm and git always hold
L19: // the same latest version). Only meaningful AFTER `npm publish` — before publish the registry is
L20: // behind by definition — so it is gated behind --post-
Findings
8 High4 Medium5 Low
HighPayload In Excluded Dirtemplate_project/.claude/hooks/task-watchdog.sh
HighSemantic Analysis Limitedsrc/core/agentRuntime/artifacts.js
HighKnown Malware Source Similarityscripts/dev/capture-omp-stall.mjs
HighKnown Malware Source Similarityscripts/measure-decision-gateway.mjs
HighKnown Malware Source Similarityscripts/release/verify-release.mjs
HighKnown Malware Source Similaritysrc/core/agentRuntime/adapters.js
HighKnown Malware Source Similaritytemplate_project/.claude/ukit/runtime/handoff-intent.mjs
HighKnown Malware Source Similaritysrc/core/agentRuntime/supervisor.js
MediumDynamic Requiresrc/core/runtimeConfig.js
MediumEnvironment Vars
Medium
Affected versions and remediation
This report applies to @ngockhoale/ukit@3.4.49.
See all versions of @ngockhoale/ukit for other recorded verdicts.
- Review the evidence and your use of @ngockhoale/ukit@3.4.49 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.