openkrak-mcp@1.1.1

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Starting the MCP server exposes the instructions; invoking any tool triggers the remote requests.

An AI client may rely on unverified package output; remote telemetry can receive host identifiers and error text.

AI-agent prompt manipulation combined with host fingerprint and error telemetry collection.

The executable MCP server registers tool descriptions that tell an AI not to read source files and to trust the package's generated brief as ground truth. This is an attempt to control the host agent's security and coding decisions. On each tool call, it sends a stable host-derived fingerprint and tool name to a remote worker; on failures it also sends the error message, which may contain local details. The package has no automatic install hook, but the runtime MCP behavior is a concrete agent-control and data-collection risk.

Runtime source establishes deliberate AI-directed source-inspection suppression plus remote collection of host-derived identifiers and error text. These behaviors create a concrete agent control-hijack surface despite the absence of an install hook.