kubeagent@0.1.78
AI-powered Kubernetes management CLI
AI Security Review
scanned 21d ago · by lpm-firewall-aiThe manifest has no install hook, and the reviewed runtime behavior is consistent with Kubernetes inventory, user-invoked authentication, and telemetry sent to the package's own API. The scanner's dangerous-source hint does not match an attack in the inspected auth code.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Telemetry runs after CLI command parsing; authentication runs when the user invokes login.
Impact
The inspected behavior supports the package's stated CLI function and does not establish a malicious attack surface.
Mechanism
Telemetry sends CLI version, operating system, architecture, Node version, and a machine identifier to the KubeAgent API. Login sends a device code to the configured server.
AI rationale
The manifest has no install hook, and the reviewed runtime behavior is consistent with Kubernetes inventory, user-invoked authentication, and telemetry sent to the package's own API. The scanner's dangerous-source hint does not match an attack in the inspected auth code.
Evidence
package.jsondist/cli.jsdist/auth.jsdist/telemetry.jsdist/detector/sources.js
Network endpoints1
api.kubeagent.net
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json identifies dist/cli.js as the executable and lists no install lifecycle hook.
- The detector reads Kubernetes workload container images and labels to build candidates.
- Login sends a device code to the configured server and is called from the CLI login command.
- Telemetry sends CLI and machine metadata to the KubeAgent API.
- The CLI invokes telemetry after command parsing.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicenseWildcardDependency
Source & flagged code
4 flaggeddist/detector/sources.jsView file
•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/detector/sources.jsView on unpkg13FromWorkload(kind, w) {
const out = [];
const ref = { kind, namespace: w.metadata.namespace, name: w.metadata.name };
const containers = [
...(w.spec?.template?.spec?.containers ?? []),
...(w.
Low
Ai Review Evidence
The detector reads Kubernetes workload container images and labels to build candidates.
dist/detector/sources.jsView on unpkg · L13dist/auth.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = kubeagent@0.1.70
matchedIdentity = npm:a3ViZWFnZW50:0.1.70
similarity = 0.838
summary = stored previous version shares package body but lacks this dangerous source file
Findings
2 High3 Medium7 Low
HighSemantic Analysis Limiteddist/detector/sources.js
HighPrevious Version Dangerous Deltadist/auth.js
MediumNetwork
MediumEnvironment Vars
MediumWildcard Dependency
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/detector/sources.js
Affected versions and remediation
This report applies to kubeagent@0.1.78.
See all versions of kubeagent for other recorded verdicts.
- Review the evidence and your use of kubeagent@0.1.78 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.