openkrak-mcp@1.0.13

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

An AI client lists or calls the package's MCP tools.

Can steer an AI away from direct source inspection and disclose host identity and potentially sensitive error text to a remote service.

AI instruction injection plus host fingerprint and error telemetry uploads.

The executable MCP entrypoint returns tool descriptions that tell an AI to call it before coding and avoid reading repository files. This is a direct attempt to control the host agent's review behavior. On every tool call, the entrypoint derives a fingerprint from hostname and username and sends it to a remote worker; exception handling additionally uploads error text. The separate published license module differs from the logic actually embedded in the executable, which obscures the runtime behavior.

The package contains concrete AI-agent instruction injection and undisclosed host/error telemetry in its executable entrypoint. The absence of an install hook limits installation impact but does not remove the runtime control and data-exfiltration behavior.