karajan-code@4.36.0: AI-agent control-surface risk

Loading npm security reports…

karajan-code@4.36.0: AI-agent control-surface risk | LPM Firewall

Source & flagged code

24 flagged

package.jsonView file

Lines 56-96json

56 "vendor/tree-sitter-grammars/",

57 "packages/hu-board/src/",

58 "packages/hu-board/public/",

59 "packages/hu-board/package.json",

60 "packages/ai-trash/src/",

61 "packages/ai-trash/bin/",

62 "packages/ai-trash/package.json",

63 "docs/karajan-code-logo-small.png",

64 "docs/README.es.md",

65 "LICENSE",

66 "README.md"

67 ],

68 "bin": {

69 "kj": "bin/kj.js",

70 "kj-tail": "bin/kj-tail",

71 "kj-trash": "packages/ai-trash/bin/kj-trash.js",

72 "karajan-mcp": "bin/karajan-mcp.js",

73 "kj-rag-mcp": "bin/kj-rag-mcp.js"

74 },

75 "scripts": {

76 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L76

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L76

77 "setup": "node scripts/install.js",

78 "test": "vitest run",

79 "test:watch": "vitest",

80 "test:coverage": "vitest run --coverage",

81 "lint": "eslint src/ packages/",

82 "lint:fix": "eslint src/ packages/ --fix",

83 "lint:syntax": "((command -v rg >/dev/null 2>&1 && rg --files src tests | rg '\\.js$') || find src tests -type f -name '*.js') | while IFS= read -r f; do node --check \"$f\"; done",

84 "format:check": "prettier --check .",

85 "format:fix": "prettier --write .",

86 "typecheck": "npx -p typescript@5 tsc --noEmit -p tsconfig.json",

87 "validate": "npm run lint && npm run lint:syntax && npm test",

88 "mcp": "node src/mcp/server.js",

89 "audit:test-diet": "node scripts/audit-test-diet.mjs",

90 "verify-pack": "node scripts/verify-pack.mjs",

91 "prepublishOnly": "node scripts/verify-pack.mjs",

92 "verify-quickstart": "node scripts/quickstart-gate.mjs"

93 },

94 "simple-git-hooks": {

95 "pre-commit": "npx lint-staged"

96 },

scripts/dual-publish.mjsView file

Lines 1-37javascript

1#!/usr/bin/env node

2/**

3 * dual-publish (MIG-A, KJC-TSK-0751, épica KJC-PCS-0077, ADR 0004) — el

4 * MISMO contenido sale bajo dos nombres npm durante la migración al scope:

5 * karajan-code (legacy, publish normal) y @karajan-family/code (scoped).

6 *

7 * Uso:

8 * node scripts/dual-publish.mjs --pack-only # genera+verifica el tarball scoped

9 * node scripts/dual-publish.mjs --publish --otp=XXX # publica el scoped (tras publicar el legacy)

10 *

src/review/card-verify.jsView file

Lines 1-37javascript

1/**

2 * card-verify — KJC-TSK-0732 (issue #1371). With a declared tracker,

3 * card-first upgrades "the branch names a card" to "the tracker says that

4 * card is ALIVE". Transport-agnostic: `board.verify_cmd` is the USER'S

5 * adapter (their CLI/MCP wrapper — credentials never enter kj) printing

6 * {exists, live, status?} JSON on stdout. Unverifiable NEVER blocks: it

7 * degrades to branch-ref level SAYING SO — a gate must not claim a check

8 * it didn't make, in either direction. Definitive verdicts are cached

9 * briefly; degradations never are, so recovery is immediate.

scripts/verify-pack.mjsView file

Lines 94-134javascript

95 const binPath = path.join(tmpDir, "node_modules", ".bin", "kj");

96 if (!fs.existsSync(binPath)) fail(`kj binary missing after install: ${binPath

src/sonar/project-key.jsView file

Lines 63-103javascript

63 * sonar-project.properties es la que el servidor conoce, porque es con la que

64 * el scanner sube el analisis. Sin leerla aqui, kj escaneaba un proyecto y

65 * preguntaba por otro (una clave derivada del remote), y el audit acababa

66 * listando issues de repos ajenos del mismo SonarQube.

67 *

scripts/install.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import fs from "node:fs/promises";

3import os from "node:os";

4import path from "node:path";

5import { spawn } from

scripts/postinstall.jsView file

Lines 6-46javascript

6 * - Non-interactive, silent on success.

7 * - Idempotent: safe to run many times.

8 * - Never fails hard (exits 0 even on error) so `npm install` is not blocked.

src/audit/basal-cost.jsView file

76return new Promise((resolve) => { L77: execFile("npx", ["depcheck", "--json"], { cwd: projectDir, timeout: 30000 }, (err, stdout) => { L78: if (err && !stdout) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/audit/basal-cost.jsView on unpkg · L76

vendor/tree-sitter-grammars/python.wasmView file

•path = vendor/tree-sitter-grammars/python.wasm kind = wasm_module sizeBytes = 457883 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

vendor/tree-sitter-grammars/python.wasmView on unpkg

scripts/install-binary.shView file

•path = scripts/install-binary.sh kind = build_helper sizeBytes = 7790 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-binary.shView on unpkg

bin/kj-tailView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 23

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/kj-tailView on unpkg

src/utils/update-check.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.31.1 matchedPath = src/utils/update-check.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.31.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/update-check.jsView on unpkg

packages/ai-trash/src/git-snapshot.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.31.1 matchedPath = packages/ai-trash/src/git-snapshot.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.31.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/ai-trash/src/git-snapshot.jsView on unpkg

src/commands/audit.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.31.1 matchedPath = src/commands/audit.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.31.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/audit.jsView on unpkg

src/commands/go.jsView file

•matchType = normalized_sha256 matchedPackage = @karajan-family/code@4.35.1 matchedPath = src/commands/go.js matchedIdentity = npm:QGthcmFqYW4tZmFtaWx5L2NvZGU:4.35.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/go.jsView on unpkg

src/commands/install-tools.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.31.1 matchedPath = src/commands/install-tools.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.31.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/install-tools.jsView on unpkg

src/harden/supervisor-commit.jsView file

•matchType = normalized_sha256 matchedPackage = @karajan-family/code@4.35.1 matchedPath = src/harden/supervisor-commit.js matchedIdentity = npm:QGthcmFqYW4tZmFtaWx5L2NvZGU:4.35.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/harden/supervisor-commit.jsView on unpkg

src/hu/store.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.31.1 matchedPath = src/hu/store.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.31.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/hu/store.jsView on unpkg

src/sonar/scanner.jsView file

•matchType = normalized_sha256 matchedPackage = @karajan-family/code@4.35.1 matchedPath = src/sonar/scanner.js matchedIdentity = npm:QGthcmFqYW4tZmFtaWx5L2NvZGU:4.35.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sonar/scanner.jsView on unpkg

src/utils/tool-installer.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.31.1 matchedPath = src/utils/tool-installer.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.31.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/tool-installer.jsView on unpkg

packages/hu-board/src/db.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.31.1 matchedPath = packages/hu-board/src/db.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.31.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/hu-board/src/db.jsView on unpkg

src/checks/mcp-health.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.31.1 matchedPath = src/checks/mcp-health.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.31.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/checks/mcp-health.jsView on unpkg

Source & flagged code

24 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/dual-publish.mjsView file

17import { readFileSync, writeFileSync } from "node:fs"; L18: import { execFileSync } from "node:child_process"; L19: import { join, dirname, resolve } from "node:path";

High

Child Process

Package source references child process execution.

scripts/dual-publish.mjsView on unpkg · L17

src/review/card-verify.jsView file

17L18: const execAsync = promisify(exec); L19: export const VERIFY_TIMEOUT_MS = 4000;

High

Shell

Package source references shell execution.

src/review/card-verify.jsView on unpkg · L17

scripts/verify-pack.mjsView file

114// pattern lookalikes). L115: const { scanPaths, loadPrivacyList } = await import( L116: path.join(repoRoot, "src", "privacy", "scan.js")

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/verify-pack.mjsView on unpkg · L114

src/sonar/project-key.jsView file

•matchType = normalized_sha256 matchedPackage = @karajan-family/code@4.35.1 matchedPath = src/sonar/project-key.js matchedIdentity = npm:QGthcmFqYW4tZmFtaWx5L2NvZGU:4.35.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sonar/project-key.jsView on unpkg

83const explicit = String( L84: options.projectKey || process.env.KJ_SONAR_PROJECT_KEY || config?.sonarqube?.project_key || "" L85: ).trim(); ... L99: const remote = await runCommand("git", ["config", "--get", "remote.origin.url"]); L100: const remoteUrl = String(remote.stdout || "").trim(); L101: if (remote.exitCode !== 0 || !remoteUrl) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/sonar/project-key.jsView on unpkg · L83

scripts/install.jsView file

4import path from "node:path"; L5: import { spawn } from "node:child_process"; L6: import readline from "node:readline/promises"; L7: import { stdin as input, stdout as output } from "node:process"; L8: import { tomlPath } from "./toml-value.js"; ... L10: const rl = readline.createInterface({ input, output }); L11: const REGISTRY_PATH = path.join(os.homedir(), ".karajan", "instances.json"); L12: const INSTALL_STATE_PATH = path.join(os.homedir(), ".karajan", "install-state.json"); L13: const AGENT_META = { L14: codex: { bin: "codex", installUrl: "https://developers.openai.com/codex/cli" }, L15: claude: { bin: "claude", installUrl: "https://docs.anthropic.com/en/docs/claude-code" }, ... L120: if (cliValue !== undefined) return cliValue;

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/install.jsView on unpkg · L4

scripts/postinstall.jsView file

26await fs.mkdir(path.dirname(file), { recursive: true }); L27: await fs.writeFile(file, `${JSON.stringify(obj, null, 2)}\n`, "utf8"); L28: } L29: L30: const CLAUDE_JSON_PATH = path.join(os.homedir(), ".claude.json"); L31: ... L77: async function setupClaudeMcp(config, kjHome) { L78: config.mcpServers = config.mcpServers || {}; L79: // Keep every env key the user added to the entry; only the home is ours, L80: // and it is written under the current name (KJ_HOME is deprecated). L81: const { KJ_HOME: _stale, ...userEnv } = config.mcpServers["karajan-mcp"]?.env || {}; L82: config.mcpServers["karajan-mcp"] = {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L26

src/audit/basal-cost.jsView file

76return new Promise((resolve) => { L77: execFile("npx", ["depcheck", "--json"], { cwd: projectDir, timeout: 30000 }, (err, stdout) => { L78: if (err && !stdout) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/audit/basal-cost.jsView on unpkg · L76

vendor/tree-sitter-grammars/python.wasmView file

•path = vendor/tree-sitter-grammars/python.wasm kind = wasm_module sizeBytes = 457883 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

vendor/tree-sitter-grammars/python.wasmView on unpkg

scripts/install-binary.shView file

•path = scripts/install-binary.sh kind = build_helper sizeBytes = 7790 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-binary.shView on unpkg

bin/kj-tailView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 23

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/kj-tailView on unpkg

src/utils/update-check.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/update-check.jsView on unpkg

packages/ai-trash/src/git-snapshot.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/ai-trash/src/git-snapshot.jsView on unpkg

src/commands/audit.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/audit.jsView on unpkg

src/commands/go.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/go.jsView on unpkg

src/commands/install-tools.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/install-tools.jsView on unpkg

src/harden/supervisor-commit.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/harden/supervisor-commit.jsView on unpkg

src/hu/store.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/hu/store.jsView on unpkg

src/sonar/scanner.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sonar/scanner.jsView on unpkg

src/utils/tool-installer.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/tool-installer.jsView on unpkg

packages/hu-board/src/db.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/hu-board/src/db.jsView on unpkg

src/checks/mcp-health.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/checks/mcp-health.jsView on unpkg