registry / AI-agent control-surface risk / dokkimi

dokkimi

CLI for isolated Docker environments for microservice testing

This report shows the evidence for dokkimi@0.5.10. 4 of 5 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is a concrete automatic postinstall chain that writes foreign global AI-agent settings and prompts. It meets the install-control-surface blocking policy.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation runs the postinstall lifecycle hook.

Impact

AI tools may load package-controlled instructions and launch the Dokkimi MCP command without an explicit setup action.

Mechanism

Automatic global AI-agent configuration and instruction injection.

Policy narrative

The postinstall hook invokes LLM-context registration automatically. That code alters global Claude Code, Cursor, and Copilot files and registers `dokkimi mcp` as an MCP server. This is unconsented install-time mutation of broad AI-agent control surfaces, so later agent sessions can be influenced to invoke package code.

AI rationale

This is a concrete automatic postinstall chain that writes foreign global AI-agent settings and prompts. It meets the install-control-surface blocking policy.

Evidence

package.jsonscripts/postinstall.jsapps/cli/dist/lib/llm-context-register.js~/.claude.json~/.cursor/mcp.json~/.claude/CLAUDE.md~/.cursor/rules/dokkimi.md~/.github/copilot-instructions.md

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.

Evidence for policy risk

The package automatically runs a postinstall script.
That script imports and invokes LLM-context registration during installation.
The registration code writes a Dokkimi MCP command into global Claude Code and Cursor configuration files.
It also writes instruction files into Claude Code, Cursor, and GitHub Copilot locations without a user command or consent.

Evidence against

No network endpoint or credential-exfiltration sink was established in the inspected installation path.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsPossibleObfuscationTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 224 file(s), 2.07 MB of source, external domains: 0.0.0.0, ct.internal, docs.docker.com, dokkimi.com, gcr.io, ghcr.io, host.docker.internal, index.docker.io, json-schema.org, nodejs.org, registry.example.com, registry.npmjs.org, www.docker.com

Source & flagged code

19 flagged

package.jsonView file

Lines 21-61json

21 "mock",

22 "docker",

23 "devops",

24 "api-testing",

25 "cli",

26 "test-automation"

27 ],

28 "license": "Elastic-2.0",

29 "overrides": {

30 "lodash": "4.18.1",

31 "glob": "^11.0.0",

32 "multer": "^2.2.0",

33 "@hono/node-server": "^1.19.13"

34 },

35 "os": [

36 "darwin",

37 "linux",

38 "win32"

39 ],

40 "scripts": {

41 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L41

42 },

43 "files": [

44 "apps/cli/dist/",

45 "apps/mcp/dist/",

46 "apps/mcp/package.json",

47 "services/control-tower/dist/",

48 "services/control-tower/package.json",

49 "shared/prisma/sqlite/schema.prisma",

50 "shared/prisma/prisma.config.ts",

51 "shared/prisma/migrations/",

52 "shared/docs/",

53 "config/config.yaml",

54 "scripts/postinstall.js",

55 "README.md",

56 "LICENSE",

57 "shared/config/dist/",

58 "shared/config/package.json",

59 "shared/definition-resolver/dist/",

60 "shared/definition-resolver/package.json",

61 "shared/definition-validator/dist/",

shared/platform/dist/platform-unix.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.unix = void 0;

4const child_process_1 =

shared/config/dist/index.jsView file

Lines 1-26javascript

1"use strict";

2var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {

apps/cli/dist/lib/llm-context-register.jsView file

Lines 10-50javascript

10 if (k2 === undefined) k2 = k;

11 o[k2] = m[k];

12}));

13var __setModuleDefault = (this && this.__setModuleDefault) ||

apps/mcp/dist/index.jsView file

21Cross-file remote execution chain: apps/mcp/dist/index.js spawns apps/cli/dist/lib/update-check.js; helper contains network access plus dynamic code execution. L21: ZodArray: () => ZodArray, L22: ZodBase64: () => ZodBase64, L23: ZodBase64URL: () => ZodBase64URL, ... L1482: error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config()))) L1483: } : { success: true, data: result.value }; L1484: }; ... L2566: try { L2567: new URL(`http://[${payload.value}]`); L2568: } catch { ... L14688: async ({ projectPath }) => { L14689: const startDir = projectPath || process.cwd(); L14690: const dokkimiDir = findDokkimiDir(startDir);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

apps/mcp/dist/index.jsView on unpkg · L21

apps/cli/dist/lib/inspect-step-detail.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

apps/cli/dist/lib/inspect-step-detail.js#virtual:normalized:round1View on unpkg

apps/cli/dist/lib/registry-credentials.spec.jsView file

•matchType = normalized_sha256 matchedPackage = dokkimi@0.5.4 matchedPath = apps/cli/dist/lib/registry-credentials.spec.js matchedIdentity = npm:ZG9ra2ltaQ:0.5.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High