kubeagent@0.1.51
AI-powered Kubernetes management CLI
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package has a real, privileged AI-agent capability and automatic telemetry, warranting a warning for users of a dependency firewall. Source inspection found no lifecycle hook, stealth persistence, credential exfiltration, remote payload execution, or unconsented mutation of a foreign AI-agent control surface.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs kubeagent commands; remediation occurs during its diagnose/watch workflow under the local configuration.
Impact
Can restart or alter Kubernetes workloads using the invoking user's kubectl permissions; first run sends limited telemetry.
Mechanism
AI-directed, schema-limited kubectl remediation with configured safe actions
AI rationale
The package has a real, privileged AI-agent capability and automatic telemetry, warranting a warning for users of a dependency firewall. Source inspection found no lifecycle hook, stealth persistence, credential exfiltration, remote payload execution, or unconsented mutation of a foreign AI-agent control surface.
Evidence
package.jsondist/telemetry.jsdist/kubectl.jsdist/diagnoser/index.jsdist/diagnoser/tools.jsdist/config.js~/.kubeagent/.machine-id~/.kubeagent/.telemetry-sent~/.kubeagent/config.yaml~/.kubeagent/auth.json
Network endpoints4
api.kubeagent.net/telemetryapi.kubeagent.net/v1/messagesapi.osv.dev/v1/queryendoflife.date/api/
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- dist/telemetry.js auto-posts a generated machine ID and platform/version data on first CLI run.
- dist/diagnoser/tools.js can restart pods, restart deployments, scale deployments, and change resources via kubectl.
- dist/config.js defaults auto_fix on and auto-approves restart_pod and rollout_restart.
Evidence against
- package.json has no preinstall, install, postinstall, or prepare hook.
- dist/kubectl.js uses execFile with structured arguments, not a shell, and tool inputs are schema-constrained.
- dist/diagnoser/index.js requires approval for actions outside configured safe actions and denies them without an approver.
- Network calls target KubeAgent service endpoints or explicit notification/CVE services; no credential/file harvesting or remote code loader was found.
- dist/auth.js stores user-created credentials under ~/.kubeagent/auth.json with mode 0600.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
2 flaggeddist/detector/sources.jsView file
•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/detector/sources.jsView on unpkgdist/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = kubeagent@0.1.50
matchedIdentity = npm:a3ViZWFnZW50:0.1.50
similarity = 0.977
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsView on unpkgFindings
2 High3 Medium5 Low
HighSemantic Analysis Limiteddist/detector/sources.js
HighPrevious Version Dangerous Deltadist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumWildcard Dependency
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to kubeagent@0.1.51.
See all versions of kubeagent for other recorded verdicts.
- Review the evidence and your use of kubeagent@0.1.51 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.