karajan-code@4.47.0
Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe package runs a postinstall hook that alters global Claude Code and Codex MCP configuration without an explicit consent check. This is an active agent control-surface mutation, so the package should be blocked under the install-time policy.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Installing the package through npm when lifecycle scripts run.
Impact
The agents gain a configured package-owned MCP server that can run in later sessions.
Mechanism
The hook reads the existing Claude configuration, adds or replaces the karajan-mcp entry, and writes the Codex MCP block.
Policy narrative
On npm installation, the package's postinstall hook silently registers its MCP server in Claude Code and Codex user configuration. This is an unconsented lifecycle change to AI-agent control configuration. The inspected excerpts show a package-owned server registration, without evidence of credential theft or remote payload execution.
AI rationale
The package runs a postinstall hook that alters global Claude Code and Codex MCP configuration without an explicit consent check. This is an active agent control-surface mutation, so the package should be blocked under the install-time policy.
Evidence
package.jsonscripts/postinstall.js~/.claude.json~/.codex/config.toml
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 92.0% confidence with low false-positive risk.
Evidence for policy risk
- The npm postinstall hook automatically runs scripts/postinstall.js.
- That hook registers the package MCP server in Claude Code and Codex configuration files without a consent check.
- The registration writes a server entry that launches this package's MCP server.
Evidence against
- The configuration entry launches the package's own MCP server and sets its home directory; the inspected code does not show unrelated credential forwarding or a remote payload.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
CopyleftLicense
Source & flagged code
24 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/dual-publish.mjsView file
17import { readFileSync, writeFileSync } from "node:fs";
L18: import { execFileSync } from "node:child_process";
L19: import { join, dirname, resolve } from "node:path";
High
Child Process
Package source references child process execution.
scripts/dual-publish.mjsView on unpkg · L17Findings
1 Critical17 High8 Medium7 Low
CriticalAi Agent Control Hijackscripts/postinstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processscripts/dual-publish.mjs
HighShellsrc/review/card-verify.js
HighRuntime Package Installsrc/audit/basal-cost.js
HighSemantic Analysis Limitedbin/kj-tail
HighKnown Malware Source Similaritysrc/commands/board.js
HighKnown Malware Source Similaritypackages/ai-trash/src/git-snapshot.js
HighKnown Malware Source Similaritysrc/commands/audit.js
HighKnown Malware Source Similaritysrc/commands/go.js
HighKnown Malware Source Similaritysrc/commands/install-tools.js
Affected versions and remediation
This report applies to karajan-code@4.47.0.
See all versions of karajan-code for other recorded verdicts.
- Avoid installing karajan-code@4.47.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.