karajan-code@3.15.3: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

karajan-code@3.15.3: AI-agent control-surface risk | LPM Firewall

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/diet-baseline.mjsView file

25L26: import { execFileSync, spawnSync } from "node:child_process"; L27: import { mkdirSync, readFileSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

scripts/diet-baseline.mjsView on unpkg · L25

src/agents/resolve-bin.jsView file

65L66: // 3. Fallback: return name as-is (let execa try PATH) L67: cache.set(name, name);

High

Shell

Package source references shell execution.

src/agents/resolve-bin.jsView on unpkg · L65

packages/hu-board/src/boot-info.jsView file

12L13: const require = createRequire(import.meta.url); L14: export const PKG_VERSION = (() => {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

packages/hu-board/src/boot-info.jsView on unpkg · L12

src/sonar/project-key.jsView file

59const explicit = String( L60: options.projectKey || process.env.KJ_SONAR_PROJECT_KEY || config?.sonarqube?.project_key || "" L61: ).trim(); ... L66: const remote = await runCommand("git", ["config", "--get", "remote.origin.url"]); L67: const remoteUrl = String(remote.stdout || "").trim(); L68: if (remote.exitCode !== 0 || !remoteUrl) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/sonar/project-key.jsView on unpkg · L59

scripts/install.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@3.12.2 matchedPath = scripts/install.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:3.12.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/install.jsView on unpkg

4import path from "node:path"; L5: import { spawn } from "node:child_process"; L6: import readline from "node:readline/promises"; L7: import { stdin as input, stdout as output } from "node:process"; L8: L9: const rl = readline.createInterface({ input, output }); L10: const REGISTRY_PATH = path.join(os.homedir(), ".karajan", "instances.json"); L11: const INSTALL_STATE_PATH = path.join(os.homedir(), ".karajan", "install-state.json"); L12: const AGENT_META = { L13: codex: { bin: "codex", installUrl: "https://developers.openai.com/codex/cli" }, L14: claude: { bin: "claude", installUrl: "https://docs.anthropic.com/en/docs/claude-code" }, ... L119: if (cliValue !== undefined) return cliValue;

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/install.jsView on unpkg · L4

src/utils/update-check.jsView file

10L11: const RAW_BASE = "https://raw.githubusercontent.com/manufosela/karajan-code/main/scripts"; L12: export const INSTALL_SH_URL = `${RAW_BASE}/install-binary.sh`; ... L19: */ L20: export function updateInstruction({ channel, platform = process.platform }) { L21: if (channel === "sea") { ... L56: const raw = await fs.readFile(cachePath, "utf8"); L57: const cache = JSON.parse(raw); L58: if (cache.checkedAt && Date.now() - cache.checkedAt < CACHE_TTL_MS) { ... L124: * @param {string} opts.currentVersion - version of the running kj L125: * @param {(cmd: string, args: string[]) => Promise<{stdout: string, stderr: string}>} [opts.exec] - injectable runner (defaults to execa) L126: * @param {Console} [opts.logger]

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/utils/update-check.jsView on unpkg · L10

scripts/postinstall.jsView file

3Install-time AI-agent control hijack evidence: L25: await fs.mkdir(path.dirname(file), { recursive: true }); L26: await fs.writeFile(file, `${JSON.stringify(obj, null, 2)}\n`, "utf8"); L27: } ... L48: async function setupClaudeMcp(kjHome) { L49: const claudeJsonPath = path.join(os.homedir(), ".claude.json"); L50: let config = {}; ... L56: L57: config.mcpServers = config.mcpServers || {}; L58: config.mcpServers["karajan-mcp"] = { L59: type: "stdio", ... L83: async function setupCodexMcp(kjHome) { L84: const configPath = path.join(os.homedir(), ".codex", "config.toml"); Payload evidence from src/agents/resolve-bin.js: L3: import os from "node:os"; L4: import { execFileSync } from "node:child_process"; L5: ... L7: L8: const isWin = process.platform === "win32"; L9: ... L11: ? [ L12: path.

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/postinstall.jsView on unpkg · L3

src/audit/basal-cost.jsView file

76return new Promise((resolve) => { L77: execFile("npx", ["depcheck", "--json"], { cwd: projectDir, timeout: 30000 }, (err, stdout) => { L78: if (err && !stdout) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/audit/basal-cost.jsView on unpkg · L76

vendor/tree-sitter-grammars/python.wasmView file

•path = vendor/tree-sitter-grammars/python.wasm kind = wasm_module sizeBytes = 457883 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

vendor/tree-sitter-grammars/python.wasmView on unpkg

scripts/install-binary.shView file

•path = scripts/install-binary.sh kind = build_helper sizeBytes = 4198 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-binary.shView on unpkg

packages/hu-board/src/server.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@3.12.2 matchedPath = packages/hu-board/src/server.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:3.12.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/hu-board/src/server.jsView on unpkg

packages/ai-trash/src/git-snapshot.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@3.12.2 matchedPath = packages/ai-trash/src/git-snapshot.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:3.12.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/ai-trash/src/git-snapshot.jsView on unpkg

packages/hu-board/src/command-runner.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@3.12.2 matchedPath = packages/hu-board/src/command-runner.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:3.12.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/hu-board/src/command-runner.jsView on unpkg

packages/hu-board/src/plan-mutations.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@3.12.2 matchedPath = packages/hu-board/src/plan-mutations.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:3.12.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/hu-board/src/plan-mutations.jsView on unpkg