registry / Credential exfiltration / @ngockhoale/ukit / 3.4.61

@ngockhoale/ukit@3.4.61

Install/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).

AI Security Review

scanned 18h ago · by lpm-firewall-ai

The default runtime path forwards credentials resolved from Claude settings or environment variables to a separately selected gateway without recipient-specific consent. This is concrete credential disclosure, so the package should be blocked.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Normal task routing in a project using the shipped default decision-plane configuration.

Impact

The gateway receives credentials intended for the user's configured Claude service, exposing them to a different recipient.

Mechanism

The client selects openai.unicjsc.com by default, falls back to Claude API credentials when no decision-specific key is set, and sends them in request headers.

Attack narrative

The shipped project configuration enables decision routing by default. When routing invokes the decision client, it uses openai.unicjsc.com unless overridden and can authenticate with the user's ordinary Claude API key or auth token. The inspected path does not require recipient-specific consent before sending that credential to the default gateway.

AI rationale

Evidence

template_project/ukit/storage/config.jsonsrc/core/gatewayProbe.jssrc/decision/client.jssrc/index/taskRouting.js

Network endpoints1

openai.unicjsc.com

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The shipped project configuration enables the decision plane by default, and task routing invokes it when its stage is enabled.
The decision client defaults to openai.unicjsc.com independently of the user's configured host gateway.
When no decision-specific key is set, the client falls back to credentials resolved from the user's Claude environment or settings, including ANTHROPIC_API_KEY and ANTHROPIC_AUTH_TOKEN.
The client sends those credentials in authorization headers with a POST carrying decision state and questions.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 248 file(s), 2.83 MB of source, external domains: openai.unicjsc.com

Source & flagged code

11 flagged

src/core/runtimeConfig.jsView file

Lines 1-29javascript

1import fs from 'node:fs/promises';

2import path from 'node:path';

3import { createRequire } from 'node:module';

4import { buildRuntimePaths } from './runtimePaths.js';

5import { buildUserPaths } from './userPaths.js';

6import { loadShippedCompactBudget } from './compact/contextBudget.js';

7import { buildConfigContracts } from './executionContracts.js';

8import { mergeTunedOverlay } from '../learning/tunedOverlay.js';

10const require = createRequire(import.meta.url);

11const { version: PACKAGE_VERSION } = require('../../package.json');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/core/runtimeConfig.jsView on unpkg · L9

13// legacy: 'antigravity' stays valid — Antigravity adapter removed in v2.2.0, but an existing

14// config.json naming it must not become invalid. 'opencode' is NOT kept valid here: the

15// OpenCode lane was removed this cycle, so stale 'opencode' values are normalized away

16// (strip + console.warn) in normalizeLegacyOpencodeEntries instead of hard-failing.

17const VALID_AGENTS = new Set(['claude-code', 'codex', 'antigravity', 'omp']);

19// Reserved permission modes for orchestration.permissionMode (single source of truth).

20// 'unattended' is the only mode implemented this cycle; interactive/safe-auto are reserved.

21export const VALID_PERMISSION_MODES = new Set(['interactive', 'safe-auto', 'unattended']);

23// --- modelRoles (SPEC-model-roles, v3 mechanic #4) -------------------------------------

24// Role labels name WHAT the model is for, not which tier it is. Values are cost-tier

25// names ('lite'|'code'|'smart'|'vision') or 'inherit-parent' — never raw provider model

26// IDs; the host adapter resolves tier→actual model. Arrays = panels (one agent per

27// entry; list length sets the panel count). omp's .omp/config.yml modelRoles resolves

28// @smol/@default/@slow to the same tiers (smol↔lite, default↔code, slow↔smart).

29export const MODEL_ROLE_TIERS = new Set(['lite', 'code', 'smart', 'vision']);

scripts/release/verify-release.mjsView file

Lines 1-21javascript

1import { spawn } from 'node:child_process';

2import { readFileSync, writeFileSync, unlinkSync, existsSync } from 'node:fs';

3import crypto from 'node:crypto';

4import os from 'node:os'

template_project/.claude/hooks/task-watchdog.shView file

•path = template_project/.claude/hooks/task-watchdog.sh kind = payload_in_excluded_dir sizeBytes = 11622 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

template_project/.claude/hooks/task-watchdog.shView on unpkg

•path = template_project/.claude/hooks/task-watchdog.sh kind = build_helper sizeBytes = 11622 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

template_project/.claude/hooks/task-watchdog.shView on unpkg

src/core/agentRuntime/artifacts.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/core/agentRuntime/artifacts.jsView on unpkg

scripts/dev/capture-omp-stall.mjsView file

•matchType = normalized_sha256 matchedPackage = @ngockhoale/ukit@3.4.50 matchedPath = scripts/dev/capture-omp-stall.mjs matchedIdentity = npm:QG5nb2NraG9hbGUvdWtpdA:3.4.50 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/dev/capture-omp-stall.mjsView on unpkg

scripts/measure-decision-gateway.mjsView file

•matchType = normalized_sha256 matchedPackage = @ngockhoale/ukit@3.4.50 matchedPath = scripts/measure-decision-gateway.mjs matchedIdentity = npm:QG5nb2NraG9hbGUvdWtpdA:3.4.50 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/measure-decision-gateway.mjsView on unpkg

src/core/agentRuntime/adapters.jsView file

•matchType = normalized_sha256 matchedPackage = @ngockhoale/ukit@3.4.50 matchedPath = src/core/agentRuntime/adapters.js matchedIdentity = npm:QG5nb2NraG9hbGUvdWtpdA:3.4.50 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/agentRuntime/adapters.jsView on unpkg

template_project/.claude/ukit/runtime/handoff-intent.mjsView file

•matchType = normalized_sha256 matchedPackage = @ngockhoale/ukit@3.4.50 matchedPath = template_project/.claude/ukit/runtime/handoff-intent.mjs matchedIdentity = npm:QG5nb2NraG9hbGUvdWtpdA:3.4.50 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

template_project/.claude/ukit/runtime/handoff-intent.mjsView on unpkg

src/core/agentRuntime/supervisor.jsView file

•matchType = normalized_sha256 matchedPackage = @ngockhoale/ukit@3.4.50 matchedPath = [redacted].js matchedIdentity = npm:QG5nb2NraG9hbGUvdWtpdA:3.4.50 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/agentRuntime/supervisor.jsView on unpkg

Source & flagged code

11 flagged · loading source

src/core/runtimeConfig.jsView file

9L10: const require = createRequire(import.meta.url); L11: const { version: PACKAGE_VERSION } = require('../../package.json');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/core/runtimeConfig.jsView on unpkg · L9

scripts/release/verify-release.mjsView file

•matchType = normalized_sha256 matchedPackage = @ngockhoale/ukit@3.4.50 matchedPath = scripts/release/verify-release.mjs matchedIdentity = npm:QG5nb2NraG9hbGUvdWtpdA:3.4.50 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/release/verify-release.mjsView on unpkg

1import { spawn } from 'node:child_process'; L2: import { readFileSync, writeFileSync, unlinkSync, existsSync } from 'node:fs'; ... L6: L7: const rootDir = process.cwd(); L8: const npmCacheDir = path.join(os.tmpdir(), 'ukit-npm-cache'); ... L14: // UKIT_VERIFY_STEP_TIMEOUT_MS overrides the step budget for tests. L15: const STEP_TIMEOUT_MS = Number(process.env.UKIT_VERIFY_STEP_TIMEOUT_MS) || 10 * 60 * 1000; // 10 min L16: const REGISTRY_TIMEOUT_MS = Number(process.env.UKIT_VERIFY_REGISTRY_TIMEOUT_MS) || 60 * 1000; // 1 min ... L18: // Opt-in post-publish registry-parity check (Release Policy invariant: npm and git always hold L19: // the same latest version). Only meaningful AFTER `npm publish` — before publish the registry is L20: // behind by definition — so it is gated behind --post-

Findings

8 High4 Medium5 Low

HighPayload In Excluded Dirtemplate_project/.claude/hooks/task-watchdog.sh

HighSemantic Analysis Limitedsrc/core/agentRuntime/artifacts.js

HighKnown Malware Source Similarityscripts/dev/capture-omp-stall.mjs

HighKnown Malware Source Similarityscripts/measure-decision-gateway.mjs

HighKnown Malware Source Similarityscripts/release/verify-release.mjs

HighKnown Malware Source Similaritysrc/core/agentRuntime/adapters.js

HighKnown Malware Source Similaritytemplate_project/.claude/ukit/runtime/handoff-intent.mjs

HighKnown Malware Source Similaritysrc/core/agentRuntime/supervisor.js

MediumDynamic Requiresrc/core/runtimeConfig.js

MediumEnvironment Vars

Medium

Affected versions and remediation

This report applies to @ngockhoale/ukit@3.4.61.

See all versions of @ngockhoale/ukit for other recorded verdicts.

Avoid installing @ngockhoale/ukit@3.4.61. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-22 07:29:10.075Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other credential exfiltration packages

Behavioral surface

Source & flagged code

Related packages

Other credential exfiltration packages