karajan-code@4.43.0
Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe package's npm postinstall hook silently writes its MCP server into global Claude and Codex configuration. This is unconsented postinstall mutation of agent control surfaces and meets the blocking policy.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Installing the package through npm.
Impact
The registered server can be started by the agent through its MCP configuration after installation.
Mechanism
The hook reads existing configuration, adds or replaces the karajan MCP entry, and writes the configuration without prompting for consent.
Policy narrative
Installing the package automatically runs a hook that registers its MCP server in the user's Claude and Codex configuration. This changes agent control configuration without a consent prompt, making the server available to those agents.
AI rationale
The package's npm postinstall hook silently writes its MCP server into global Claude and Codex configuration. This is unconsented postinstall mutation of agent control surfaces and meets the blocking policy.
Evidence
package.jsonscripts/postinstall.js~/.claude.json~/.codex/config.toml
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs scripts/postinstall.js automatically after npm install.
- The postinstall hook writes a karajan MCP server entry into the user's Claude configuration.
- The same hook writes a karajan MCP server entry into the user's Codex configuration and invokes both setup operations without a consent check.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
CopyleftLicense
Source & flagged code
24 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/dual-publish.mjsView file
17import { readFileSync, writeFileSync } from "node:fs";
L18: import { execFileSync } from "node:child_process";
L19: import { join, dirname, resolve } from "node:path";
High
Child Process
Package source references child process execution.
scripts/dual-publish.mjsView on unpkg · L17Findings
1 Critical17 High8 Medium7 Low
CriticalAi Agent Control Hijackscripts/postinstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processscripts/dual-publish.mjs
HighShellsrc/review/card-verify.js
HighRuntime Package Installsrc/audit/basal-cost.js
HighSemantic Analysis Limitedbin/kj-tail
HighKnown Malware Source Similaritysrc/cli/register-meta.js
HighKnown Malware Source Similaritysrc/commands/board.js
HighKnown Malware Source Similaritysrc/utils/update-check.js
HighKnown Malware Source Similaritypackages/ai-trash/src/git-snapshot.js
HighKnown Malware Source Similaritysrc/commands/audit.js
Affected versions and remediation
This report applies to karajan-code@4.43.0.
See all versions of karajan-code for other recorded verdicts.
- Avoid installing karajan-code@4.43.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.