registry / @aion0/forge / 0.13.4

@aion0/forge@0.13.4

⚠ Under review

Unified AI workflow platform — multi-model task orchestration, persistent sessions, web terminal, remote access

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 22 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 485 file(s), 4.62 MB of source, external domains: 0.0.0.0, 127.0.0.1, api.anthropic.com, api.deepseek.com, api.github.com, api.openai.com, api.telegram.org, api.x.ai, cli.github.com, dashscope.aliyuncs.com, enterprise-center.example.com, example.com, generativelanguage.googleapis.com, git-scm.com, github.com, gitlab.com, nvd.nist.gov, raw.githubusercontent.com, registry.npmjs.org, www.w3.org

Source & flagged code

15 flagged

app/api/craft-system/publish/auto/route.tsView file

Lines 1-39typescript

1import { NextResponse } from 'next/server';

2import { existsSync, mkdtempSync, rmSync, writeFileSync, mkdirSync, readFileSync } from 'node:fs';

3import { join, dirname } from 'node:path';

4import { tmpdir } from 'node:os';

5import { bundleCraftForPublish } from '@/lib/crafts/registry';

6import { loadSettings } from '@/lib/settings';

7import { run } from '@/lib/safe-exec';

9// One-click publish via the user's gh CLI: fork → clone → write files →

10// append registry entry → push → open PR. Falls back to the manual flow

11// (existing /api/craft-system/publish) when gh isn't available.

13interface AutoPublishRequest {

14 projectPath: string;

15 name: string;

16}

18// argv-array exec — no shell, so `name`/`branch`/`ownerRepo`/`me` cannot inject.

19// args[0] is the program; the rest are literal arguments. Throws on non-zero exit.

20function exec(args: readonly string[], cwd?: string, timeout = 60000): string {

21 return run(args[0], args.slice(1), { cwd, timeout, maxBuffer: 10 * 1024 * 1024 });

High

Child Process

Package source references child process execution.

app/api/craft-system/publish/auto/route.tsView on unpkg · L19

22}

24export async function POST(req: Request) {

25 const { projectPath, name } = (await req.json()) as AutoPublishRequest;

26 if (!projectPath || !name) return NextResponse.json({ error: 'projectPath + name required' }, { status: 400 });

27 // `name` becomes a directory (join(repoDir, name)) and a branch segment — keep

28 // it kebab-case so it can't traverse or carry odd characters.

29 if (!/^[a-z][a-z0-9-]{1,40}$/.test(name)) {

30 return NextResponse.json({ error: 'name must be kebab-case (letter, then lowercase/digits/hyphens)' }, { status: 400 });

31 }

33 // ── Pre-flight ────────────────────────────────────

34 let me: string;

35 try {

36 exec(['gh', 'auth', 'status'], undefined, 5000);

37 me = exec(['gh', 'api', 'user', '--jq', '.login'], undefined, 5000).trim();

38 } catch (e: any) {

39 return NextResponse.json({

lib/plugins/executor.tsView file

Lines 120-160typescript

120 return { ok: false, output: {}, error: 'Poll timeout', duration: Date.now() - startTime };

121}

122

123function evaluateCondition(data: any, expr: string): boolean {

124

lib/crafts/runtime.tsView file

Lines 1-37typescript

1// Runtime: load + cache craft server modules; build the ForgeServerApi per request.

3import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync, statSync } from 'node:fs';

4import { join } from 'node:path';

5import { execSync } from 'node:child_process';

6import { tmpdir } from 'node:os';

7import

app/api/monitor/route.tsView file

Lines 81-121typescript

81 if (chatRes) {

82 const data = JSON.parse(chatRes);

83 chatStatus.running = true;

84 chatStatus.sessions = data.active_sse_sessions ?? 0;

85 }

86 } catch {}

app/api/crafts/route.tsView file

Lines 1-30typescript

1import { NextResponse } from 'next/server';

2import { createHash } from 'node:crypto';

3import { listProjectCrafts, shouldShow } from '@/lib/crafts/loader';

5function tmuxSessionName(projectPath: string, craftName: string)

cli/mw.mjsView file

Lines 481-521javascript

481

482To create a job, use the Forge extension Jobs tab or POST /api/jobs directly

483(the YAML-vs-form authoring story lives in the extension).`);

484}

485var isTty2, dim2, red2, grn, cyan2;

486var init_jobs = __esm({

487 "cli/jobs.ts"() {

488 "use strict";

489 isTty2 = !!process.stdout.isTTY;

lib/task-manager.tsView file

Lines 1-26typescript

1/**

2 * Task Manager — persistent task queue backed by SQLite.

3 * Tasks survive server restarts. Background runner picks up queued tasks.

4 */

6import { randomUUID } from 'node:crypto';

7import { spawn, execSync } from 'node:child_process';

8import { realpathSync, existsSync } from 'node:fs';

bin/forge-server.mjsView file

Lines 47-87javascript

47// Pre-install EnvHttpProxyAgent before any dynamic import('undici') can

48// clobber Node's NODE_USE_ENV_PROXY agent (see lib/proxy-setup.ts).

49// No-op off-corp (no proxy env), so non-docker deployments are unchanged.

50if (process.env.HTTPS_PROXY || process.env.HTTP_PROXY ||

51 process.env.https_proxy || process.env.http_proxy) {

52 try {

53 const { setGlobalDispatcher, EnvHttpProxyAgent

check-forge-status.shView file

•path = check-forge-status.sh kind = build_helper sizeBytes = 3853 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

check-forge-status.shView on unpkg

docs/Forge_Strategy_Research_2026.docxView file

•path = docs/Forge_Strategy_Research_2026.docx kind = high_entropy_blob sizeBytes = 23982 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

docs/Forge_Strategy_Research_2026.docxView on unpkg

•path = docs/Forge_Strategy_Research_2026.docx kind = compressed_blob sizeBytes = 23982 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

docs/Forge_Strategy_Research_2026.docxView on unpkg

•path = docs/Forge_Strategy_Research_2026.docx kind = nested_archive_needs_inspection sizeBytes = 23982 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

docs/Forge_Strategy_Research_2026.docxView on unpkg

lib/init.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @aion0/forge@0.11.19 matchedIdentity = npm:QGFpb24wL2Zvcmdl:0.11.19 similarity = 0.908 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/init.tsView on unpkg

lib/help-docs/21-build-connector.mdView file

159patternName = generic_password severity = medium line = 159 matchedText = password...en}'

Medium

Secret Pattern

Hardcoded password in lib/help-docs/21-build-connector.md

lib/help-docs/21-build-connector.mdView on unpkg · L159

208patternName = generic_password severity = medium line = 208 matchedText = password...rd}'

Medium

Secret Pattern

Hardcoded password in lib/help-docs/21-build-connector.md

lib/help-docs/21-build-connector.mdView on unpkg · L208

Source & flagged code

15 flagged · loading source

app/api/craft-system/publish/auto/route.tsView file

19// args[0] is the program; the rest are literal arguments. Throws on non-zero exit. L20: function exec(args: readonly string[], cwd?: string, timeout = 60000): string { L21: return run(args[0], args.slice(1), { cwd, timeout, maxBuffer: 10 * 1024 * 1024 });

High

Child Process

Package source references child process execution.

app/api/craft-system/publish/auto/route.tsView on unpkg · L19

lib/plugins/executor.tsView file

140async function executeShell(action: PluginAction, ctx: Record<string, any>): Promise<PluginActionResult> { L141: // Shell actions run a free-form `/bin/sh -c` built from a template + request L142: // params — RCE by design. Enforce the operator opt-in flag HERE, at the single

High

Shell

Package source references shell execution.

lib/plugins/executor.tsView on unpkg · L140

lib/crafts/runtime.tsView file

17// Function-wrapped dynamic import so Turbopack doesn't try to statically resolve the URL. L18: const dynamicImport = new Function('u', 'return import(u)') as (u: string) => Promise<any>; L19:

High

Eval

Package source references dynamic code evaluation.

lib/crafts/runtime.tsView on unpkg · L17

app/api/monitor/route.tsView file

101try { L102: const { readFileSync } = require('fs'); L103: const { join } = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/api/monitor/route.tsView on unpkg · L101

app/api/crafts/route.tsView file

13const projectPath = url.searchParams.get('projectPath'); L14: if (!projectPath) return NextResponse.json({ error: 'projectPath required' }, { status: 400 }); L15: const all = listProjectCrafts(projectPath);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

app/api/crafts/route.tsView on unpkg · L13

cli/mw.mjsView file

501}); L502: import { execSync, spawnSync } from "node:child_process"; L503: import { existsSync as existsSync2, readdirSync, statSync } from "node:fs"; ... L507: const port = portArgIdx >= 0 ? process.argv[portArgIdx + 1] : void 0; L508: return process.env.MW_URL || `http://localhost:${port || "8403"}`; L509: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

cli/mw.mjsView on unpkg · L501

lib/task-manager.tsView file

6import { randomUUID } from 'node:crypto'; L7: import { spawn, execSync } from 'node:child_process'; L8: import { realpathSync, existsSync } from 'node:fs'; ... L245: let entry: TaskLogEntry & { _truncated?: number; _index?: number }; L246: try { entry = JSON.parse(r.value); } L247: catch { entry = { type: 'system', content: '<unparseable entry>' } as any; } ... L561: _tmuxHookInstalled = true; L562: try { installForgeStopHook(Number(process.env.PORT) || 8403); } catch {} L563: } ... L607: // entire Next.js worker and triggering a supervisor restart loop. L608: const shell = process.env.SHELL && process.env.SHELL.endsWith('bash') ? process.env.SHELL : '/bin/bash'; L609: const child = spawn(shell, ['-c', task.prompt], {

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

lib/task-manager.tsView on unpkg · L6

bin/forge-server.mjsView file

67// installed npm-package copy (.npmrc isn't published). L68: execSync('npm install --include=dev --legacy-peer-deps', { cwd: ROOT, stdio: 'inherit' }); L69: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/forge-server.mjsView on unpkg · L67

check-forge-status.shView file

•path = check-forge-status.sh kind = build_helper sizeBytes = 3853 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

check-forge-status.shView on unpkg

docs/Forge_Strategy_Research_2026.docxView file

•path = docs/Forge_Strategy_Research_2026.docx kind = high_entropy_blob sizeBytes = 23982 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

docs/Forge_Strategy_Research_2026.docxView on unpkg

•path = docs/Forge_Strategy_Research_2026.docx kind = compressed_blob sizeBytes = 23982 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

docs/Forge_Strategy_Research_2026.docxView on unpkg

•path = docs/Forge_Strategy_Research_2026.docx kind = nested_archive_needs_inspection sizeBytes = 23982 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

docs/Forge_Strategy_Research_2026.docxView on unpkg

lib/init.tsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/init.tsView on unpkg

lib/help-docs/21-build-connector.mdView file

159patternName = generic_password severity = medium line = 159 matchedText = password...en}'

Medium

Secret Pattern

Hardcoded password in lib/help-docs/21-build-connector.md

lib/help-docs/21-build-connector.mdView on unpkg · L159

208patternName = generic_password severity = medium line = 208 matchedText = password...rd}'

Medium

Secret Pattern

Hardcoded password in lib/help-docs/21-build-connector.md

lib/help-docs/21-build-connector.mdView on unpkg · L208

Findings

2 Critical6 High8 Medium6 Low

CriticalCommand Output Exfiltrationlib/task-manager.ts

CriticalPrevious Version Dangerous Deltalib/init.ts

HighChild Processapp/api/craft-system/publish/auto/route.ts

HighShelllib/plugins/executor.ts

HighEvallib/crafts/runtime.ts

HighSame File Env Network Executioncli/mw.mjs

HighRuntime Package Installbin/forge-server.mjs

HighShips High Entropy Blobdocs/Forge_Strategy_Research_2026.docx

MediumDynamic Requireapp/api/monitor/route.ts

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpercheck-forge-status.sh

MediumShips Compressed Blobdocs/Forge_Strategy_Research_2026.docx

MediumStructural Risk Force Deep Review

MediumSecret Patternlib/help-docs/21-build-connector.md

LowScripts Present

LowWeak Cryptoapp/api/crafts/route.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectiondocs/Forge_Strategy_Research_2026.docx

Source & flagged code

15 flagged

app/api/craft-system/publish/auto/route.tsView file

Lines 1-39typescript

1import { NextResponse } from 'next/server';

2import { existsSync, mkdtempSync, rmSync, writeFileSync, mkdirSync, readFileSync } from 'node:fs';

3import { join, dirname } from 'node:path';

4import { tmpdir } from 'node:os';

5import { bundleCraftForPublish } from '@/lib/crafts/registry';

6import { loadSettings } from '@/lib/settings';

7import { run } from '@/lib/safe-exec';

9// One-click publish via the user's gh CLI: fork → clone → write files →

10// append registry entry → push → open PR. Falls back to the manual flow

11// (existing /api/craft-system/publish) when gh isn't available.

13interface AutoPublishRequest {

14 projectPath: string;

15 name: string;

16}

18// argv-array exec — no shell, so `name`/`branch`/`ownerRepo`/`me` cannot inject.

19// args[0] is the program; the rest are literal arguments. Throws on non-zero exit.

20function exec(args: readonly string[], cwd?: string, timeout = 60000): string {

21 return run(args[0], args.slice(1), { cwd, timeout, maxBuffer: 10 * 1024 * 1024 });

High

Child Process

Package source references child process execution.

app/api/craft-system/publish/auto/route.tsView on unpkg · L19

22}

24export async function POST(req: Request) {

25 const { projectPath, name } = (await req.json()) as AutoPublishRequest;

26 if (!projectPath || !name) return NextResponse.json({ error: 'projectPath + name required' }, { status: 400 });

27 // `name` becomes a directory (join(repoDir, name)) and a branch segment — keep

28 // it kebab-case so it can't traverse or carry odd characters.

29 if (!/^[a-z][a-z0-9-]{1,40}$/.test(name)) {

30 return NextResponse.json({ error: 'name must be kebab-case (letter, then lowercase/digits/hyphens)' }, { status: 400 });

31 }

33 // ── Pre-flight ────────────────────────────────────

34 let me: string;

35 try {

36 exec(['gh', 'auth', 'status'], undefined, 5000);

37 me = exec(['gh', 'api', 'user', '--jq', '.login'], undefined, 5000).trim();

38 } catch (e: any) {

39 return NextResponse.json({

lib/plugins/executor.tsView file

Lines 120-160typescript

120 return { ok: false, output: {}, error: 'Poll timeout', duration: Date.now() - startTime };

121}

122

123function evaluateCondition(data: any, expr: string): boolean {

124

lib/crafts/runtime.tsView file

Lines 1-37typescript

1// Runtime: load + cache craft server modules; build the ForgeServerApi per request.

3import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync, statSync } from 'node:fs';

4import { join } from 'node:path';

5import { execSync } from 'node:child_process';

6import { tmpdir } from 'node:os';

7import

app/api/monitor/route.tsView file

Lines 81-121typescript

81 if (chatRes) {

82 const data = JSON.parse(chatRes);

83 chatStatus.running = true;

84 chatStatus.sessions = data.active_sse_sessions ?? 0;

85 }

86 } catch {}

app/api/crafts/route.tsView file

Lines 1-30typescript

1import { NextResponse } from 'next/server';

2import { createHash } from 'node:crypto';

3import { listProjectCrafts, shouldShow } from '@/lib/crafts/loader';

5function tmuxSessionName(projectPath: string, craftName: string)

cli/mw.mjsView file

Lines 481-521javascript

481

482To create a job, use the Forge extension Jobs tab or POST /api/jobs directly

483(the YAML-vs-form authoring story lives in the extension).`);

484}

485var isTty2, dim2, red2, grn, cyan2;

486var init_jobs = __esm({

487 "cli/jobs.ts"() {

488 "use strict";

489 isTty2 = !!process.stdout.isTTY;

lib/task-manager.tsView file

Lines 1-26typescript

1/**

2 * Task Manager — persistent task queue backed by SQLite.

3 * Tasks survive server restarts. Background runner picks up queued tasks.

4 */

6import { randomUUID } from 'node:crypto';

7import { spawn, execSync } from 'node:child_process';

8import { realpathSync, existsSync } from 'node:fs';

bin/forge-server.mjsView file

Lines 47-87javascript

47// Pre-install EnvHttpProxyAgent before any dynamic import('undici') can

48// clobber Node's NODE_USE_ENV_PROXY agent (see lib/proxy-setup.ts).

49// No-op off-corp (no proxy env), so non-docker deployments are unchanged.

50if (process.env.HTTPS_PROXY || process.env.HTTP_PROXY ||

51 process.env.https_proxy || process.env.http_proxy) {

52 try {

53 const { setGlobalDispatcher, EnvHttpProxyAgent

check-forge-status.shView file

•path = check-forge-status.sh kind = build_helper sizeBytes = 3853 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

check-forge-status.shView on unpkg

docs/Forge_Strategy_Research_2026.docxView file

•path = docs/Forge_Strategy_Research_2026.docx kind = high_entropy_blob sizeBytes = 23982 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

docs/Forge_Strategy_Research_2026.docxView on unpkg

•path = docs/Forge_Strategy_Research_2026.docx kind = compressed_blob sizeBytes = 23982 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

docs/Forge_Strategy_Research_2026.docxView on unpkg

•path = docs/Forge_Strategy_Research_2026.docx kind = nested_archive_needs_inspection sizeBytes = 23982 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

docs/Forge_Strategy_Research_2026.docxView on unpkg

lib/init.tsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/init.tsView on unpkg

lib/help-docs/21-build-connector.mdView file

159patternName = generic_password severity = medium line = 159 matchedText = password...en}'

Medium

Secret Pattern

Hardcoded password in lib/help-docs/21-build-connector.md

lib/help-docs/21-build-connector.mdView on unpkg · L159

208patternName = generic_password severity = medium line = 208 matchedText = password...rd}'

Medium

Secret Pattern

Hardcoded password in lib/help-docs/21-build-connector.md

lib/help-docs/21-build-connector.mdView on unpkg · L208