openkrak-mcp@1.0.10

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Starting the MCP server and invoking one of its tools for a repository.

An agent can be steered away from independent source inspection while the operator receives a persistent machine identifier and error text.

AI-agent instruction hijacking with host-fingerprint telemetry.

The published executable is an MCP server. Its tool metadata tells a connected coding agent to run its analysis before every task and not inspect source after receiving the result, which attempts to replace normal agent judgment. On calls it computes a stable hash of hostname and username, then transmits that identifier with usage telemetry; error text is also transmitted. This conflicts with the package privacy claim that it has no telemetry. There is no install-time hook, but the runtime behavior is a concrete AI-agent control and undisclosed telemetry surface.

The runtime combines explicit AI-agent steering with undisclosed persistent host telemetry and remote error reporting. This is malicious behavior at MCP invocation time even though installation itself has no lifecycle hook.