registry / @brainervirus/workit-opencode / 0.8.5

@brainervirus/workit-opencode@0.8.5

Workit OpenCode plugin (thin wrapper over @brainervirus/workit-core)

AI Security Review

scanned 4h ago · by lpm-firewall-ai

A confirmed setup action writes a fixed third-party YouTrack base URL into user configuration. A later status/verification action transmits the user-supplied token to that tenant.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

User invokes the plugin initialization/status workflow and supplies a YouTrack token.

Impact

Exfiltration of a user’s YouTrack bearer token, enabling access at the configured tenant according to its token scope.

Mechanism

persistent credential redirection to a fixed external YouTrack tenant

Attack narrative

The public plugin’s setup defaults are organization-specific rather than neutral: it writes engthouseamg.youtrack.cloud as the YouTrack service and directs the user to create and paste a permanent token. Its status verification reads that token and sends it as a Bearer credential to the persisted base URL. The flow is user-triggered and confirmation-gated, but the fixed foreign destination makes the credential collection concrete rather than a normal configurable integration.

Rationale

Source establishes a persistent fixed-endpoint credential setup followed by token-bearing network requests. No lifecycle hook mitigates install-time risk, but it does not remove the credential-exfiltration behavior once the plugin workflow is used.

Evidence

dist/plugin.jspackage.json~/.config/workit/youtrack.json~/.config/workit/youtrack.token

Network endpoints2

enghouseamg.youtrack.cloud/api/users/me?fields=id,login,name,email

enghouseamg.youtrack.cloud

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for block

Default initialization targets a fixed Enghouse YouTrack tenant.
The init scaffold persists that tenant configuration and prompts for a permanent token.
Status verification sends the configured token to that configured base URL.

Evidence against

package.json has no npm lifecycle scripts.
Initialization writes require confirmed:true; no install-time execution was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 785 KB of source, external domains: bun.sh, cli.github.com, enghouseamg.youtrack.cloud, github.com, gitlab.com, json-schema.org, keepachangelog.com, primeradiant.com, semver.org, www.jetbrains.com

Source & flagged code

6 flagged

assets/vendor/superpowers/skills/brainstorming/scripts/server.cjsView file

Lines 1-21javascript

1const crypto = require('crypto');

2const http = require('http');

3

Source & flagged code

6 flagged · loading source

assets/vendor/superpowers/skills/brainstorming/scripts/server.cjsView file

•matchType = normalized_sha256 matchedPackage = @kl-c/matrixos@0.3.65 matchedPath = dist/cli/skills/superpowers-brainstorming/scripts/server.cjs matchedIdentity = npm:QGtsLWMvbWF0cml4b3M:0.3.65 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/vendor/superpowers/skills/brainstorming/scripts/server.cjsView on unpkg

1const crypto = require('crypto'); L2: const http = require('http'); L3: const fs = require('fs'); ... L12: function computeAcceptKey(clientKey) { L13: return crypto.createHash('sha1').update(clientKey + WS_MAGIC).digest('base64'); L14: } ... L84: L85: const PORT_FILE = process.env.BRAINSTORM_PORT_FILE || null; L86: const randomPort = () => 49152 + Math.floor(Math.random() * 16383); ... L195: try { sessionStorage.setItem('brainstorm-session-key', ${jsonKey}); } catch (e) {} L196: location.replace('/'); L197: </script>

Low

Weak Crypto

Package source references weak cryptographic algorithms.

assets/vendor/superpowers/skills/brainstorming/scripts/server.cjsView on unpkg · L1

Findings

5 High2 Medium5 Low

HighCredential Redirect Persistencedist/plugin.js

HighEntrypoint Foreign Package Code Overwritedist/plugin.js

HighKnown Malware Source Similarityassets/vendor/superpowers/skills/brainstorming/scripts/server.cjs

HighAi Review Evidencedist/plugin.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowWeak Cryptoassets/vendor/superpowers/skills/brainstorming/scripts/server.cjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LPM CLI

dist/plugin.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/plugin.js: writeFileSync writeFileSync(path.join(dir, "config.json"), JSON.stringify(config, null, 2) + ` import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, readdirSync as readdirSync2, writeFileSync as writeFileSync2 } from "node:fs"; writeFileSync2(file, md, "utf8"); import { writeFileSync as writeFileSync3 } from "node:fs"; function writeFileExclusive(file, content, mode) { writeFileSync3(file, content, { encoding: "utf8", flag: "wx", mode }); writeFileSync as writeFileSync7

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/plugin.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/plugin.js: copyFileSync, writeFileSync copyFileSync(src, dest); writeFileSync(path.join(dir, "config.json"), JSON.stringify(config, null, 2) + ` import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, readdirSync as readdirSync2, writeFileSync as writeFileSync2 } from "node:fs"; writeFileSync2(file, md, "utf8"); HARD-GATE: Workflow-toolkit contract is already loaded below. Follow it on every turn; it overrides conflicting Superpowers defaults (brainstorming chat options, visual companion, ... import { writeFileSync as writeFileSync3 } from "node:fs";

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/plugin.jsView on unpkg

node >=22

Artifact1.07 MB · 82 files1 signature(s)

Install lifecycleNo install hooks · other: build, typecheck

Behavioral surface

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocketHighEntropyStringsUrlStringsManifest: clean

3438var youtrackJsonContent = (dir) => ({ baseUrl: process.env.WORKFLOW_YT_BASE_URL ?? "https://enghouseamg.youtrack.cloud", tokenFile: process.env.WORKFLOW_YT_TOKEN_FILE ?? path16.join(dir, "youtrack.token"), timezone: process.env.WORKFLOW_YT_TIMEZONE ?? "America/Santiago", locale: "es-CL", defaultMention: process.env.WORKFLOW_YT_MENTION ?? "Alejandra.Flores",

High

Ai Review Evidence

Default initialization targets a fixed Enghouse YouTrack tenant.

dist/plugin.jsView on unpkg · L3438

3517case "youtrack_scaffold": { const jsonOut = path16.join(dir, "youtrack.json"); const tokenOut = path16.join(dir, "youtrack.token"); fs4.writeFileSync(jsonOut, JSON.stringify(youtrackJsonContent(dir), null, 2) + ` `, "utf8"); const preserved = writeFileExclusive(tokenOut, TOKEN_PLACEHOLDER4 + ` `, 384) === "preserved";

High

Ai Review Evidence

The init scaffold persists that tenant configuration and prompts for a permanent token.

dist/plugin.jsView on unpkg · L3517

Source & flagged code

6 flagged

assets/vendor/superpowers/skills/brainstorming/scripts/server.cjsView file

Lines 1-21javascript

1const crypto = require('crypto');

2const http = require('http');

3

const fs = require('fs');

4const path = require('path');

5

6// ========== WebSocket Protocol (RFC 6455) ==========

7

8const OPCODES = { TEXT: 0x01, CLOSE: 0x08, PING: 0x09, PONG: 0x0A };

9const WS_MAGIC = '258EAFA5-E914-47DA-95CA-C5AB0DC85B11';

10const MAX_FRAME_PAYLOAD_BYTES = 10 * 1024 * 1024;

11

12function computeAcceptKey(clientKey) {

13 return crypto.createHash('sha1').update(clientKey + WS_MAGIC).digest('base64');

14}

Low

Weak Crypto

Package source references weak cryptographic algorithms.

assets/vendor/superpowers/skills/brainstorming/scripts/server.cjsView on unpkg · L1

15

16function encodeFrame(opcode, payload) {

17 const fin = 0x80;

18 const len = payload.length;

19 let header;

20

21 if (len < 126) {

•matchType = normalized_sha256 matchedPackage = @kl-c/matrixos@0.3.65 matchedPath = dist/cli/skills/superpowers-brainstorming/scripts/server.cjs matchedIdentity = npm:QGtsLWMvbWF0cml4b3M:0.3.65 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/vendor/superpowers/skills/brainstorming/scripts/server.cjsView on unpkg

dist/plugin.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/plugin.js: writeFileSync writeFileSync(path.join(dir, "config.json"), JSON.stringify(config, null, 2) + ` import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, readdirSync as readdirSync2, writeFileSync as writeFileSync2 } from "node:fs"; writeFileSync2(file, md, "utf8"); import { writeFileSync as writeFileSync3 } from "node:fs"; function writeFileExclusive(file, content, mode) { writeFileSync3(file, content, { encoding: "utf8", flag: "wx", mode }); writeFileSync as writeFileSync7

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/plugin.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/plugin.js: copyFileSync, writeFileSync copyFileSync(src, dest); writeFileSync(path.join(dir, "config.json"), JSON.stringify(config, null, 2) + ` import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, readdirSync as readdirSync2, writeFileSync as writeFileSync2 } from "node:fs"; writeFileSync2(file, md, "utf8"); HARD-GATE: Workflow-toolkit contract is already loaded below. Follow it on every turn; it overrides conflicting Superpowers defaults (brainstorming chat options, visual companion, ... import { writeFileSync as writeFileSync3 } from "node:fs";

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/plugin.jsView on unpkg

3438var youtrackJsonContent = (dir) => ({ baseUrl: process.env.WORKFLOW_YT_BASE_URL ?? "https://enghouseamg.youtrack.cloud", tokenFile: process.env.WORKFLOW_YT_TOKEN_FILE ?? path16.join(dir, "youtrack.token"), timezone: process.env.WORKFLOW_YT_TIMEZONE ?? "America/Santiago", locale: "es-CL", defaultMention: process.env.WORKFLOW_YT_MENTION ?? "Alejandra.Flores",

High

Ai Review Evidence

Default initialization targets a fixed Enghouse YouTrack tenant.

dist/plugin.jsView on unpkg · L3438

3517case "youtrack_scaffold": { const jsonOut = path16.join(dir, "youtrack.json"); const tokenOut = path16.join(dir, "youtrack.token"); fs4.writeFileSync(jsonOut, JSON.stringify(youtrackJsonContent(dir), null, 2) + ` `, "utf8"); const preserved = writeFileExclusive(tokenOut, TOKEN_PLACEHOLDER4 + ` `, 384) === "preserved";

High

Ai Review Evidence

The init scaffold persists that tenant configuration and prompts for a permanent token.

dist/plugin.jsView on unpkg · L3517