karajan-code@4.56.0

Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline

AI Security Review

scanned 5d ago · by lpm-firewall-ai

Source confirms an automatic postinstall registration of this first-party MCP server in global agent configuration, which warrants a warning for lifecycle-based agent setup. The inspected behavior does not show unconsented broad control-surface abuse, credential disclosure, or another concrete attack.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package through npm, which runs its postinstall hook.

Impact

The agents can load this package's MCP server after installation without a separate setup confirmation.

Mechanism

The hook reads and updates the user's Claude and Codex configuration to add a karajan-mcp entry pointing to this package's server.

AI rationale

Evidence

scripts/postinstall.jspackage.json

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest runs scripts/postinstall.js automatically after npm install.
The postinstall flow registers the package's karajan-mcp server in the user's Claude Code and Codex configuration without a consent prompt.
The setup writes a named, package-owned MCP server entry and preserves unrelated configuration; the residual risk is automatic agent integration, not a confirmed attack.
Other inspected agent-related code checks or sets up product configuration, fixture files, or project context; it does not establish broader control-surface abuse.

Evidence against

The registered MCP entry points to this package's own server and supplies its Karajan home setting.
The inspected excerpts show no credential transfer or unrelated network recipient in this setup flow.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

Source & flagged code

24 flagged

package.jsonView file

Lines 55-95json

55 "scripts/",

56 "vendor/tree-sitter-grammars/",

57 "packages/hu-board/src/",

58 "packages/hu-board/public/",

59 "packages/hu-board/package.json",

60 "packages/ai-trash/src/",

61 "packages/ai-trash/bin/",

62 "packages/ai-trash/package.json",

63 "docs/README.es.md",

64 "LICENSE",

65 "README.md"

66 ],

67 "bin": {

68 "kj": "bin/kj.js",

69 "kj-tail": "bin/kj-tail",

70 "kj-trash": "packages/ai-trash/bin/kj-trash.js",

71 "karajan-mcp": "bin/karajan-mcp.js",

72 "kj-rag-mcp": "bin/kj-rag-mcp.js"

73 },

74 "scripts": {

75 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L75

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L75

76 "setup": "node scripts/install.js",

77 "test": "vitest run",

78 "test:scenarios": "vitest run --config tests/scenarios/vitest.config.js --root .",

79 "contract:claude": "node scripts/contract-claude.mjs",

80 "test:watch": "vitest",

81 "test:coverage": "vitest run --coverage",

82 "lint": "eslint src/ packages/",

83 "lint:fix": "eslint src/ packages/ --fix",

84 "lint:syntax": "((command -v rg >/dev/null 2>&1 && rg --files src tests | rg '\\.js$') || find src tests -type f -name '*.js') | while IFS= read -r f; do node --check \"$f\"; done",

85 "format:check": "prettier --check .",

86 "format:fix": "prettier --write .",

87 "typecheck": "npx -p typescript@5 tsc --noEmit -p tsconfig.json",

88 "validate": "npm run lint && npm run lint:syntax && npm test",

89 "mcp": "node src/mcp/server.js",

90 "audit:test-diet": "node scripts/audit-test-diet.mjs",

91 "verify-pack": "node scripts/verify-pack.mjs",

92 "prepublishOnly": "node scripts/verify-pack.mjs",

93 "verify-quickstart": "node scripts/quickstart-gate.mjs"

94 },

95 "simple-git-hooks": {

scripts/dual-publish.mjsView file

Lines 1-37javascript

1#!/usr/bin/env node

2/**

3 * dual-publish (MIG-A, KJC-TSK-0751, épica KJC-PCS-0077, ADR 0004) — el

4 * MISMO contenido sale bajo dos nombres npm durante la migración al scope:

5 * karajan-code (legacy, publish normal) y @karajan-family/code (scoped).

6 *

7 * Uso:

8 * node scripts/dual-publish.mjs --pack-only # genera+verifica el tarball scoped

9 * node scripts/dual-publish.mjs --publish --otp=XXX # publica el scoped (tras publicar el legacy)

10 *

src/review/card-verify.jsView file

Lines 1-37javascript

1/**

2 * card-verify — KJC-TSK-0732 (issue #1371). With a declared tracker,

3 * card-first upgrades "the branch names a card" to "the tracker says that

4 * card is ALIVE". Transport-agnostic: `board.verify_cmd` is the USER'S

5 * adapter (their CLI/MCP wrapper — credentials never enter kj) printing

6 * {exists, live, status?} JSON on stdout. Unverifiable NEVER blocks: it

7 * degrades to branch-ref level SAYING SO — a gate must not claim a check

8 * it didn't make, in either direction. Definitive verdicts are cached

9 * briefly; degradations never are, so recovery is immediate.

scripts/verify-pack.mjsView file

Lines 94-134javascript

95 const binPath = path.join(tmpDir, "node_modules", ".bin", "kj");

96 if (!fs.existsSync(binPath)) fail(`kj binary missing after install: ${binPath

src/sonar/project-key.jsView file

Lines 63-103javascript

63 * sonar-project.properties es la que el servidor conoce, porque es con la que

64 * el scanner sube el analisis. Sin leerla aqui, kj escaneaba un proyecto y

65 * preguntaba por otro (una clave derivada del remote), y el audit acababa

66 * listando issues de repos ajenos del mismo SonarQube.

67 *

scripts/install.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import fs from "node:fs/promises";

3import os from "node:os";

4import path from "node:path";

5import { spawn } from

scripts/postinstall.jsView file

Lines 6-46javascript

6 * - Non-interactive, silent on success.

7 * - Idempotent: safe to run many times.

8 * - Never fails hard (exits 0 even on error) so `npm install` is not blocked.

src/audit/basal-cost.jsView file

76return new Promise((resolve) => { L77: execFile("npx", ["depcheck", "--json"], { cwd: projectDir, timeout: 30000 }, (err, stdout) => { L78: if (err && !stdout) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/audit/basal-cost.jsView on unpkg · L76

vendor/tree-sitter-grammars/python.wasmView file

•path = vendor/tree-sitter-grammars/python.wasm kind = wasm_module sizeBytes = 457883 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

vendor/tree-sitter-grammars/python.wasmView on unpkg

scripts/install-binary.shView file

•path = scripts/install-binary.sh kind = build_helper sizeBytes = 7790 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-binary.shView on unpkg

bin/kj-tailView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 24

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/kj-tailView on unpkg

src/commands/board.jsView file

•matchType = normalized_sha256 matchedPackage = karajan-code@4.49.3 matchedPath = src/commands/board.js matchedIdentity = npm:a2FyYWphbi1jb2Rl:4.49.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High