@ngockhoale/ukit@3.4.51
Install/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).
AI Security Review
scanned 1d ago · by lpm-firewall-aiSource inspection confirms that ordinary decision-plane requests can send Claude credentials to a separate package-selected default endpoint. This is concrete credential disclosure, so the package warrants a block.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A task-routing decision-plane call when the decision plane is enabled and no decision-specific key overrides the shared Claude credential.
Impact
A credential intended for Claude authentication may be disclosed to a separate service without recipient-specific consent.
Mechanism
The client resolves the default decision endpoint and uses the resolved Claude API key or authentication token as the request authorization header.
Attack narrative
When decision-plane routing is active, the client can select the default UNIC endpoint independently of the user's language-model endpoint. If no decision-specific key is configured, its resolver falls back to Claude API credentials; the client then sends that credential in the authorization header. The checked state-data redaction does not gate this separate credential transfer.
AI rationale
Source inspection confirms that ordinary decision-plane requests can send Claude credentials to a separate package-selected default endpoint. This is concrete credential disclosure, so the package warrants a block.
Evidence
src/core/gatewayProbe.jssrc/decision/client.jssrc/index/taskRouting.js
Network endpoints1
openai.unicjsc.com
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The decision client defaults to a separate UNIC endpoint, independent of the user's configured language-model endpoint.
- When no decision-specific key is set, the resolver can fall back to the shared token from Claude credentials.
- The client sends the resolved credential in an authorization header with its request.
- Task routing can activate the decision plane when its stage is enabled and it is not explicitly disabled.
Evidence against
- The decision client has a sensitive-value gate for serialized request state; this does not gate credential forwarding.
- The decision-specific endpoint and key can be explicitly configured by the user.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell
HighEntropyStringsUrlStrings
Source & flagged code
11 flagged · loading sourcesrc/core/runtimeConfig.jsView file
9L10: const require = createRequire(import.meta.url);
L11: const { version: PACKAGE_VERSION } = require('../../package.json');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
src/core/runtimeConfig.jsView on unpkg · L9scripts/release/verify-release.mjsView file
•matchType = normalized_sha256
matchedPackage = @ngockhoale/ukit@3.4.47
matchedPath = scripts/release/verify-release.mjs
matchedIdentity = npm:QG5nb2NraG9hbGUvdWtpdA:3.4.47
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/release/verify-release.mjsView on unpkg1import { spawn } from 'node:child_process';
L2: import { readFileSync, writeFileSync, unlinkSync, existsSync } from 'node:fs';
...
L6:
L7: const rootDir = process.cwd();
L8: const npmCacheDir = path.join(os.tmpdir(), 'ukit-npm-cache');
...
L14: // UKIT_VERIFY_STEP_TIMEOUT_MS overrides the step budget for tests.
L15: const STEP_TIMEOUT_MS = Number(process.env.UKIT_VERIFY_STEP_TIMEOUT_MS) || 10 * 60 * 1000; // 10 min
L16: const REGISTRY_TIMEOUT_MS = Number(process.env.UKIT_VERIFY_REGISTRY_TIMEOUT_MS) || 60 * 1000; // 1 min
...
L18: // Opt-in post-publish registry-parity check (Release Policy invariant: npm and git always hold
L19: // the same latest version). Only meaningful AFTER `npm publish` — before publish the registry is
L20: // behind by definition — so it is gated behind --post-
Findings
8 High4 Medium5 Low
HighPayload In Excluded Dirtemplate_project/.claude/hooks/task-watchdog.sh
HighSemantic Analysis Limitedsrc/core/agentRuntime/artifacts.js
HighKnown Malware Source Similarityscripts/dev/capture-omp-stall.mjs
HighKnown Malware Source Similarityscripts/measure-decision-gateway.mjs
HighKnown Malware Source Similarityscripts/release/verify-release.mjs
HighKnown Malware Source Similaritysrc/core/agentRuntime/adapters.js
HighKnown Malware Source Similaritytemplate_project/.claude/ukit/runtime/handoff-intent.mjs
HighKnown Malware Source Similaritysrc/core/agentRuntime/supervisor.js
MediumDynamic Requiresrc/core/runtimeConfig.js
MediumEnvironment Vars
Medium
Affected versions and remediation
This report applies to @ngockhoale/ukit@3.4.51.
See all versions of @ngockhoale/ukit for other recorded verdicts.
- Avoid installing @ngockhoale/ukit@3.4.51. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.