kxm@0.7.206

CAUTION

Publisher claims: "KXM local-first multi-agent orchestration and operator dashboard" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher kontextmind · joined 0 days agoInstalls 29,517Last detonated 1 h ago

Dispute verdict

Behavior trace

Honeypot run · 1 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.6sprocessdependency install exit 1

0.7sprocessexec /usr/bin/timeout

0.7sprocessexited 1: Node.js v22.23.4

0.7sclaimedno tools/list reply (exit 1)

0.7sprocessscript backend runs setup only

Static findings

CRITICAL

Prompting user to enter sensitive credentialsdocs/operations.md:155 · Prompting user to enter sensitive credentials — social engineering

AST03

CRITICAL

Prompting user to enter sensitive credentialsdocs/operations.md:259 · Prompting user to enter sensitive credentials — social engineering

AST03

CRITICAL

Privileged sudo commandscripts/ci-postgres-17.sh:82 · Privileged sudo command — agent may execute with elevated privileges

AST05

CRITICAL

Privileged sudo commandplugins/kxm/src/cli.ts:1390 · Privileged sudo command — agent may execute with elevated privileges

AST05

CRITICAL

Fake instruction boundary tagdocs/operations/deploy.md:305 · Fake instruction boundary tag

AST01

CRITICAL

Prompting user to enter sensitive credentialsdocs/operations.md:260 · Prompting user to enter sensitive credentials — social engineering

AST03

CRITICAL

Privileged sudo commandscripts/ci-postgres-17.sh:83 · Privileged sudo command — agent may execute with elevated privileges

AST05

CRITICAL

Privileged sudo commandplugins/kxm/src/cli.ts:1382 · Privileged sudo command — agent may execute with elevated privileges

AST05

CRITICAL

Fake instruction boundary tagdocs/operations/deploy.md:306 · Fake instruction boundary tag

AST01

CRITICAL

Prompting user to enter sensitive credentialsplugins/kxm/README.md:213 · Prompting user to enter sensitive credentials — social engineering

AST03

MEDIUM

URL using raw IP addressdocs/operations/deploy.md:264 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressCHANGELOG.md:210 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressdocs/operations.md:122 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressdocs/operations/deploy.md:145 · URL using raw IP address — may bypass domain-based filtering

AST07

HIGH

Outbound HTTP to raw IP addressplugins/kxm/README.md:39 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

MEDIUM

URL using raw IP addressdocs/operations/deploy.md:149 · URL using raw IP address — may bypass domain-based filtering

AST07

HIGH

Outbound HTTP to raw IP addressdocs/guides/pi-workers.md:29 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Outbound HTTP to raw IP addressplugins/kxm/README.md:57 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

MEDIUM

URL using raw IP addressREADME.md:104 · URL using raw IP address — may bypass domain-based filtering

AST07

HIGH

Outbound HTTP to raw IP addressscripts/native-critic.mjs:34 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Outbound HTTP to raw IP addressdocs/operations.md:122 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Outbound HTTP to raw IP addressCHANGELOG.md:210 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

MEDIUM

URL using raw IP addressdocs/operations.md:88 · URL using raw IP address — may bypass domain-based filtering

AST07

HIGH

npx invocation of non-well-known packagepackage.json:56 · npx invocation of non-well-known package — may execute untrusted code

AST06

MEDIUM

URL using raw IP addressdocs/operations.md:79 · URL using raw IP address — may bypass domain-based filtering

AST07

HIGH

Outbound HTTP to raw IP addressexamples/requester.ts:11 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Instructs the agent to modify its persistent memory or instruction filesscripts/emit-codex-artifacts.mjs:237 · Instructs the agent to modify its persistent memory or instruction files

AST01

MEDIUM

URL using raw IP addressdocs/guides/pi-workers.md:40 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressREADME.md:113 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressdocs/operations.md:94 · URL using raw IP address — may bypass domain-based filtering

AST07

HIGH

Outbound HTTP to raw IP addressdocs/operations.md:88 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

npx invocation of non-well-known packagepackage.json:55 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Outbound HTTP to raw IP addressdocs/operations/deploy.md:128 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

MEDIUM

URL using raw IP addressexamples/requester.ts:11 · URL using raw IP address — may bypass domain-based filtering

AST07

HIGH

Outbound HTTP to raw IP addressplugins/kxm/README.md:183 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

MEDIUM

URL using raw IP addressplugins/kxm/README.md:39 · URL using raw IP address — may bypass domain-based filtering

AST07

HIGH

File permission modification commandscripts/ci-postgres-17.sh:112 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

npx invocation of non-well-known packagepackage.json:57 · npx invocation of non-well-known package — may execute untrusted code

AST06

MEDIUM

URL using raw IP addressdocs/operations.md:34 · URL using raw IP address — may bypass domain-based filtering

AST07

HIGH

Outbound HTTP to raw IP addressscripts/docker-install-smoke.mjs:249 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Outbound HTTP to raw IP addressREADME.md:113 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Outbound HTTP to raw IP addressdocs/operations/deploy.md:264 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

File permission modification commandscripts/assignment-run.mjs:1019 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

Outbound HTTP to raw IP addressdocs/operations/deploy.md:145 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Outbound HTTP to raw IP addressdocs/operations.md:94 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Outbound HTTP to raw IP addressdocs/guides/pi-workers.md:40 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

MEDIUM

URL using raw IP addressplugins/kxm/README.md:57 · URL using raw IP address — may bypass domain-based filtering

AST07

HIGH

Outbound HTTP to raw IP addressdocs/operations.md:34 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Access to sensitive file pathsdocs/operations.md:44 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

Outbound HTTP to raw IP addressREADME.md:104 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Outbound HTTP to raw IP addressscripts/smoke-multi-pi.mjs:310 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

MEDIUM

File type combined with upload actiondocs/reference/tools.md:47 · File type combined with upload action — agent may exfiltrate local data files

AST07

HIGH

Outbound HTTP to raw IP addressdocs/operations/deploy.md:155 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Outbound HTTP to raw IP addressdocs/operations/deploy.md:149 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

File permission modification commandscripts/harness-run.mjs:1600 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

Outbound HTTP to raw IP addressscripts/obscura.mjs:118 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Outbound HTTP to raw IP addressdocs/operations.md:79 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

MEDIUM

URL using raw IP addressdocs/guides/pi-workers.md:29 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressdocs/operations/deploy.md:155 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressdocs/operations/deploy.md:128 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressplugins/kxm/README.md:183 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressscripts/native-critic.mjs:34 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressscripts/obscura.mjs:118 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressscripts/docker-install-smoke.mjs:249 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

File type combined with upload actionplugins/kxm/src/cli.ts:387 · File type combined with upload action — agent may exfiltrate local data files

AST07

LOW

Unpinned dependencydocs/start/install.md:116 · Unpinned dependency

AST06

MEDIUM

URL using raw IP addressscripts/smoke-multi-pi.mjs:310 · URL using raw IP address — may bypass domain-based filtering

AST07