@ngockhoale/ukit@3.4.54
Install/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).
AI Security Review
scanned 1d ago · by lpm-firewall-aiSource confirms an enabled runtime path that forwards the host gateway credential to a fixed package-selected recipient without a recipient-specific consent gate. This is concrete credential disclosure, so publication should be blocked.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A normal routed task runs while the default decision plane is enabled and a host gateway credential is available.
Impact
The remote endpoint receives a credential originally supplied for the host's configured gateway, creating a risk of account or service access beyond its intended recipient.
Mechanism
The client resolves a package-selected endpoint, falls back to the host gateway credential when no decision-specific key is configured, and sends it in an authenticated POST.
Attack narrative
The decision plane ships enabled at the default stage. When routing invokes it, the client selects a fixed endpoint and can reuse the existing host gateway credential if no decision-specific key is present. It then sends that credential in the request authentication headers. The source does not establish recipient-specific consent for this default transfer.
AI rationale
Source confirms an enabled runtime path that forwards the host gateway credential to a fixed package-selected recipient without a recipient-specific consent gate. This is concrete credential disclosure, so publication should be blocked.
Evidence
src/core/runtimeConfig.jssrc/core/gatewayProbe.jssrc/decision/client.jssrc/index/taskRouting.js
Network endpoints1
openai.unicjsc.com
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- Runtime defaults enable the decision plane at the default stage.
- Without a user gateway override, the package selects its fixed decision service endpoint.
- If no decision-specific key is set, the client reuses the host gateway credential from environment or Claude settings.
- The client attaches that credential to an authenticated POST to the selected decision endpoint.
- Normal task routing calls the decision client whenever the decision plane is not off.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell
HighEntropyStringsUrlStrings
Source & flagged code
11 flagged · loading sourcesrc/core/runtimeConfig.jsView file
9L10: const require = createRequire(import.meta.url);
L11: const { version: PACKAGE_VERSION } = require('../../package.json');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
src/core/runtimeConfig.jsView on unpkg · L9scripts/release/verify-release.mjsView file
•matchType = normalized_sha256
matchedPackage = @ngockhoale/ukit@3.4.51
matchedPath = scripts/release/verify-release.mjs
matchedIdentity = npm:QG5nb2NraG9hbGUvdWtpdA:3.4.51
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/release/verify-release.mjsView on unpkg1import { spawn } from 'node:child_process';
L2: import { readFileSync, writeFileSync, unlinkSync, existsSync } from 'node:fs';
...
L6:
L7: const rootDir = process.cwd();
L8: const npmCacheDir = path.join(os.tmpdir(), 'ukit-npm-cache');
...
L14: // UKIT_VERIFY_STEP_TIMEOUT_MS overrides the step budget for tests.
L15: const STEP_TIMEOUT_MS = Number(process.env.UKIT_VERIFY_STEP_TIMEOUT_MS) || 10 * 60 * 1000; // 10 min
L16: const REGISTRY_TIMEOUT_MS = Number(process.env.UKIT_VERIFY_REGISTRY_TIMEOUT_MS) || 60 * 1000; // 1 min
...
L18: // Opt-in post-publish registry-parity check (Release Policy invariant: npm and git always hold
L19: // the same latest version). Only meaningful AFTER `npm publish` — before publish the registry is
L20: // behind by definition — so it is gated behind --post-
Findings
8 High4 Medium5 Low
HighPayload In Excluded Dirtemplate_project/.claude/hooks/task-watchdog.sh
HighSemantic Analysis Limitedsrc/core/agentRuntime/artifacts.js
HighKnown Malware Source Similarityscripts/dev/capture-omp-stall.mjs
HighKnown Malware Source Similarityscripts/measure-decision-gateway.mjs
HighKnown Malware Source Similarityscripts/release/verify-release.mjs
HighKnown Malware Source Similaritysrc/core/agentRuntime/adapters.js
HighKnown Malware Source Similaritytemplate_project/.claude/ukit/runtime/handoff-intent.mjs
HighKnown Malware Source Similaritysrc/core/agentRuntime/supervisor.js
MediumDynamic Requiresrc/core/runtimeConfig.js
MediumEnvironment Vars
Medium
Affected versions and remediation
This report applies to @ngockhoale/ukit@3.4.54.
See all versions of @ngockhoale/ukit for other recorded verdicts.
- Avoid installing @ngockhoale/ukit@3.4.54. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.