kubeagent@0.1.52
AI-powered Kubernetes management CLI
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection found no concrete malicious chain, but the package exposes an AI-assisted Kubernetes auto-remediation capability with destructive operational effects. Its install path is inert and its network/telemetry behavior is package-aligned.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs kubeagent watch, kubeagent agent, or any kubeagent CLI command.
Impact
Authorized Kubernetes workloads may be restarted or modified; telemetry identifies a machine pseudonymously.
Mechanism
Kubernetes kubectl remediation plus package-aligned telemetry
AI rationale
Source inspection found no concrete malicious chain, but the package exposes an AI-assisted Kubernetes auto-remediation capability with destructive operational effects. Its install path is inert and its network/telemetry behavior is package-aligned.
Evidence
package.jsondist/agent.jsdist/orchestrator.jsdist/diagnoser/tools.jsdist/kubectl.jsdist/telemetry.js~/.kubeagent/.machine-id~/.kubeagent/.telemetry-sent~/.kubeagent/config.yaml~/.kubeagent/auth.json
Network endpoints2
api.kubeagent.net/telemetryapi.kubeagent.net
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- dist/agent.js enables auto-fix by default in headless agent mode.
- dist/diagnoser/tools.js can delete pods, restart deployments, scale deployments, and change resources.
- dist/orchestrator.js auto-approves configured safe actions; defaults include pod restart and rollout restart.
- dist/telemetry.js posts a persistent machine ID and platform metadata on CLI invocation.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- dist/kubectl.js uses execFile with argument arrays, not a shell.
- dist/diagnoser/tools.js validates Kubernetes names and resource quantities.
- dist/agent.js denies approval-gated actions in non-interactive mode.
- Network traffic targets the package's documented kubeagent service or user-configured notification endpoints.
- No eval, remote payload loading, credential harvesting, or AI-agent configuration mutation found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
2 flaggeddist/detector/sources.jsView file
•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/detector/sources.jsView on unpkgdist/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = kubeagent@0.1.51
matchedIdentity = npm:a3ViZWFnZW50:0.1.51
similarity = 0.932
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsView on unpkgFindings
2 High3 Medium5 Low
HighSemantic Analysis Limiteddist/detector/sources.js
HighPrevious Version Dangerous Deltadist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumWildcard Dependency
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to kubeagent@0.1.52.
See all versions of kubeagent for other recorded verdicts.
- Review the evidence and your use of kubeagent@0.1.52 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.