@ngockhoale/ukit@3.4.52
Install/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe source supports conditional forwarding of an existing Claude credential to a separately configurable decision endpoint without recipient binding. This warrants a warning, but the runtime feature must be enabled and the source does not establish malicious use.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A caller enables the decision plane and invokes task routing while no decision-specific API key is configured.
Impact
An endpoint configured for the decision lane can receive a credential intended for Claude or its gateway. Exposure is conditional on runtime activation and fallback credential use.
Mechanism
The client falls back to ANTHROPIC_* credentials, then attaches the credential as an authorization header for a POST to the decision endpoint. The endpoint can be overridden separately, without a check binding the credential to its intended service.
AI rationale
The source supports conditional forwarding of an existing Claude credential to a separately configurable decision endpoint without recipient binding. This warrants a warning, but the runtime feature must be enabled and the source does not establish malicious use.
Evidence
src/core/gatewayProbe.jssrc/decision/client.jssrc/index/taskRouting.js
Network endpoints1
openai.unicjsc.com
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- When the decision plane is enabled, task routing can call the decision service; it defaults to off when its stage is absent or malformed.
- If no decision-specific key is configured, the client falls back to credentials resolved from ANTHROPIC_* environment variables or Claude settings.
- The decision client sends its bearer or API key to the resolved decision endpoint, which may be configured independently of the credential’s intended service.
Evidence against
- The manifest declares no npm lifecycle hooks; the decision-plane request requires runtime activation.
- The package describes the default endpoint as its UNIC decision provider, and sensitive state values are filtered before requests.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell
HighEntropyStringsUrlStrings
Source & flagged code
12 flagged · loading sourcesrc/core/runtimeConfig.jsView file
9L10: const require = createRequire(import.meta.url);
L11: const { version: PACKAGE_VERSION } = require('../../package.json');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
src/core/runtimeConfig.jsView on unpkg · L9scripts/release/verify-release.mjsView file
•matchType = normalized_sha256
matchedPackage = @ngockhoale/ukit@3.4.51
matchedPath = scripts/release/verify-release.mjs
matchedIdentity = npm:QG5nb2NraG9hbGUvdWtpdA:3.4.51
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/release/verify-release.mjsView on unpkg1import { spawn } from 'node:child_process';
L2: import { readFileSync, writeFileSync, unlinkSync, existsSync } from 'node:fs';
...
L6:
L7: const rootDir = process.cwd();
L8: const npmCacheDir = path.join(os.tmpdir(), 'ukit-npm-cache');
...
L14: // UKIT_VERIFY_STEP_TIMEOUT_MS overrides the step budget for tests.
L15: const STEP_TIMEOUT_MS = Number(process.env.UKIT_VERIFY_STEP_TIMEOUT_MS) || 10 * 60 * 1000; // 10 min
L16: const REGISTRY_TIMEOUT_MS = Number(process.env.UKIT_VERIFY_REGISTRY_TIMEOUT_MS) || 60 * 1000; // 1 min
...
L18: // Opt-in post-publish registry-parity check (Release Policy invariant: npm and git always hold
L19: // the same latest version). Only meaningful AFTER `npm publish` — before publish the registry is
L20: // behind by definition — so it is gated behind --post-
Findings
9 High4 Medium5 Low
HighPayload In Excluded Dirtemplate_project/.claude/hooks/task-watchdog.sh
HighSemantic Analysis Limitedsrc/core/agentRuntime/artifacts.js
HighKnown Malware Source Similarityscripts/dev/capture-omp-stall.mjs
HighKnown Malware Source Similarityscripts/measure-decision-gateway.mjs
HighKnown Malware Source Similarityscripts/release/verify-release.mjs
HighKnown Malware Source Similaritysrc/core/agentRuntime/adapters.js
HighKnown Malware Source Similaritytemplate_project/.claude/ukit/runtime/handoff-intent.mjs
HighKnown Malware Source Similaritysrc/core/agentRuntime/supervisor.js
HighKnown Malware Source Fingerprint Signaturescripts/dev/capture-omp-stall.mjs
MediumDynamic Require
Affected versions and remediation
This report applies to @ngockhoale/ukit@3.4.52.
See all versions of @ngockhoale/ukit for other recorded verdicts.
- Review the evidence and your use of @ngockhoale/ukit@3.4.52 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.