registry / AI-agent control-surface risk / karajan-code / 4.46.0

karajan-code@4.46.0

Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline

AI Security Review

scanned 12d ago · by lpm-firewall-ai

The postinstall lifecycle hook makes unconsented changes to global Claude and Codex agent configuration, which meets the blocking policy for lifecycle mutation of foreign AI-agent control surfaces. The configured server is package-owned, but that does not make the automatic global configuration change opt-in.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package through npm, which runs its postinstall hook.

Impact

Claude Code and Codex are configured to launch this package’s MCP server, changing global agent control configuration without a prompt.

Mechanism

The hook reads the global Claude configuration, assigns a package server entry, and writes it back; it also adds a package server block to the global Codex configuration.

Policy narrative

The manifest automatically runs scripts/postinstall.js. That hook writes a karajan-mcp launch entry into the user’s global Claude configuration and adds a corresponding block to the global Codex configuration without checking for consent. The configured server is package-owned, but silently changing these global agent control surfaces during npm installation is the concrete concern.

AI rationale

Evidence

package.jsonscripts/postinstall.js~/.claude.json~/.codex/config.toml

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.

Evidence for policy risk

The package manifest runs scripts/postinstall.js automatically after installation.
The postinstall script rewrites the user’s global Claude and Codex MCP configuration to register this package’s server, without a consent check.
The script’s catch handler keeps installation silent on failure; it does not make the configuration change opt-in.
Other cited locations concern explicit installer or project setup, MCP inventory, configuration checks, or reading project documentation; they do not remove the automatic postinstall behavior.

Evidence against

The configured MCP server points to this package’s own server, and the Claude setup preserves unrelated environment keys.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

24 flagged

package.jsonView file

Lines 56-96json

56 "vendor/tree-sitter-grammars/",

57 "packages/hu-board/src/",

58 "packages/hu-board/public/",

59 "packages/hu-board/package.json",

60 "packages/ai-trash/src/",

61 "packages/ai-trash/bin/",

62 "packages/ai-trash/package.json",

63 "docs/karajan-code-logo-small.png",

64 "docs/README.es.md",

65 "LICENSE",

66 "README.md"

67 ],

68 "bin": {

69 "kj": "bin/kj.js",

70 "kj-tail": "bin/kj-tail",

71 "kj-trash": "packages/ai-trash/bin/kj-trash.js",

72 "karajan-mcp": "bin/karajan-mcp.js",

73 "kj-rag-mcp": "bin/kj-rag-mcp.js"

74 },

75 "scripts": {

76 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L76

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L76

77 "setup": "node scripts/install.js",

78 "test": "vitest run",

79 "test:watch": "vitest",

80 "test:coverage": "vitest run --coverage",

81 "lint": "eslint src/ packages/",

82 "lint:fix": "eslint src/ packages/ --fix",

83 "lint:syntax": "((command -v rg >/dev/null 2>&1 && rg --files src tests | rg '\\.js$') || find src tests -type f -name '*.js') | while IFS= read -r f; do node --check \"$f\"; done",

84 "format:check": "prettier --check .",

85 "format:fix": "prettier --write .",

86 "typecheck": "npx -p typescript@5 tsc --noEmit -p tsconfig.json",

87 "validate": "npm run lint && npm run lint:syntax && npm test",

88 "mcp": "node src/mcp/server.js",

89 "audit:test-diet": "node scripts/audit-test-diet.mjs",

90 "verify-pack": "node scripts/verify-pack.mjs",

91 "prepublishOnly": "node scripts/verify-pack.mjs",

92 "verify-quickstart": "node scripts/quickstart-gate.mjs"

93 },

94 "simple-git-hooks": {

95 "pre-commit": "npx lint-staged"

96 },

scripts/dual-publish.mjsView file

Lines 1-37javascript

1#!/usr/bin/env node

2/**

3 * dual-publish (MIG-A, KJC-TSK-0751, épica KJC-PCS-0077, ADR 0004) — el

4 * MISMO contenido sale bajo dos nombres npm durante la migración al scope:

5 * karajan-code (legacy, publish normal) y @karajan-family/code (scoped).

6 *

7 * Uso:

8 * node scripts/dual-publish.mjs --pack-only # genera+verifica el tarball scoped

9 * node scripts/dual-publish.mjs --publish --otp=XXX # publica el scoped (tras publicar el legacy)

10 *

src/review/card-verify.jsView file

Lines 1-37javascript

1/**

2 * card-verify — KJC-TSK-0732 (issue #1371). With a declared tracker,

3 * card-first upgrades "the branch names a card" to "the tracker says that

4 * card is ALIVE". Transport-agnostic: `board.verify_cmd` is the USER'S

5 * adapter (their CLI/MCP wrapper — credentials never enter kj) printing

6 * {exists, live, status?} JSON on stdout. Unverifiable NEVER blocks: it

7 * degrades to branch-ref level SAYING SO — a gate must not claim a check

8 * it didn't make, in either direction. Definitive verdicts are cached

9 * briefly; degradations never are, so recovery is immediate.

scripts/verify-pack.mjsView file

Lines 94-134javascript

95 const binPath = path.join(tmpDir, "node_modules", ".bin", "kj");

96 if (!fs.existsSync(binPath)) fail(`kj binary missing after install: ${binPath

src/sonar/project-key.jsView file

Lines 63-103javascript

63 * sonar-project.properties es la que el servidor conoce, porque es con la que

64 * el scanner sube el analisis. Sin leerla aqui, kj escaneaba un proyecto y

65 * preguntaba por otro (una clave derivada del remote), y el audit acababa

66 * listando issues de repos ajenos del mismo SonarQube.

67 *

scripts/install.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import fs from "node:fs/promises";

3import os from "node:os";

4import path from "node:path";

5import { spawn } from

scripts/postinstall.jsView file

Lines 6-46javascript

6 * - Non-interactive, silent on success.

7 * - Idempotent: safe to run many times.

8 * - Never fails hard (exits 0 even on error) so `npm install` is not blocked.

src/audit/basal-cost.jsView file

76return new Promise((resolve) => { L77: execFile("npx", ["depcheck", "--json"], { cwd: projectDir, timeout: 30000 }, (err, stdout) => { L78: if (err && !stdout) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/audit/basal-cost.jsView on unpkg · L76

vendor/tree-sitter-grammars/python.wasmView file

•path = vendor/tree-sitter-grammars/python.wasm kind = wasm_module sizeBytes = 457883 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

vendor/tree-sitter-grammars/python.wasmView on unpkg

scripts/install-binary.shView file

•path = scripts/install-binary.sh kind = build_helper sizeBytes = 7790 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-binary.shView on unpkg

bin/kj-tailView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 24

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/kj-tailView on unpkg

src/cli/register-meta.jsView file

•matchType = normalized_sha256 matchedPackage = @karajan-family/code@4.44.1 matchedPath = src/cli/register-meta.js matchedIdentity = npm:QGthcmFqYW4tZmFtaWx5L2NvZGU:4.44.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High