registry / Credential exfiltration / @brainervirus/workit-opencode
@brainervirus/workit-opencode
Workit OpenCode plugin — native tools, adaptive policy, and sixteen method skills
This report shows the evidence for @brainervirus/workit-opencode@8.22.1. 3 of 90 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 49m ago · by lpm-firewall-aiThe active runtime sends a saved service token to a package-selected default host that is not the intended YouTrack service. The configurable URL and runtime-only trigger do not remove the disclosure on the default path.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A YouTrack context read when a token has been saved and the default base URL has not been changed.
Impact
The saved YouTrack token is disclosed to the package-selected default host.
Mechanism
The plugin reads the saved token and attaches it as bearer authorization to an issue API request whose destination comes from the configured base URL.
Attack narrative
The runtime bundle is the package entrypoint. Its YouTrack scaffold writes a configuration using youtrack.example.com unless the base URL is overridden, and the token creation flow derives its link from that same setting. When a YouTrack context read fetches an issue, the plugin reads the saved token and sends it as a bearer credential to the configured host. This is a credential disclosure to the shipped default recipient.
AI rationale
The active runtime sends a saved service token to a package-selected default host that is not the intended YouTrack service. The configurable URL and runtime-only trigger do not remove the disclosure on the default path.
Evidence
package.jsondist/plugin.jsyoutrack.jsonyoutrack.token
Network endpoints1
youtrack.example.com
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package exports dist/plugin.js as its runtime entrypoint.
- The YouTrack scaffold defaults its base URL to youtrack.example.com and writes that configuration to disk.
- The token creation link uses the configured base URL, and setup instructions direct the user to create a token and save it locally.
- The runtime reads the saved token and sends it as a bearer credential to an API URL built from that base URL.
- A YouTrack context read reaches the issue-fetch operation that sends the credential.
Evidence against
- The base URL can be overridden through configuration, and the credential transfer occurs during runtime context reads rather than an install hook.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcedist/plugin.jsView file
6// packages/workit-core/src/core.ts
L7: import { spawnSync as spawnSync16 } from "node:child_process";
L8: import { existsSync as existsSync8, realpathSync as realpathSync5 } from "node:fs";
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/plugin.js:
decision: "Record or revoke a user decision (never an authorization).",
fs3.writeFileSync(fd, raw, "utf8");
writeFileSync
writeFileSync(path3.join(dir, "config.json"), JSON.stringify(config, null, 2) + `
youtrack: object({ baseUrl: nonBlank.optional(), link_issues: boolean2().optional() }).passthrough().optional(),
baseUrl: text2(yt.baseUrl),
if (common.baseUrl)
return { provider: "youtrack", link: false, ...common, source: "youtrack.baseUrl" };
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/plugin.jsView on unpkg6// packages/workit-core/src/core.ts
L7: import { spawnSync as spawnSync16 } from "node:child_process";
L8: import { existsSync as existsSync8, realpathSync as realpathSync5 } from "node:fs";
...
L396: for (let i = 0;i < units - 1; i++) {
L397: if ((str.charCodeAt(i) & 64512) === 55296 && (str.charCodeAt(i + 1) & 64512) === 56320) {
L398: count--;
...
L830: }
L831: return result.issues.length ? failure(_Err, result.issues, ctx) : { success: true, data: result.value };
L832: };
...
L1706: return false;
L1707: return canParseURL(`http://[${value}]`);
L1708: }
Findings
5 High2 Medium5 Low
HighChild Processdist/plugin.js
HighCredential Redirect Persistencedist/plugin.js
HighCommand Output Exfiltrationdist/plugin.js
HighKnown Malware Source Similaritydist/plugin.js
HighKnown Malware Source Fingerprint Signaturedist/plugin.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @brainervirus/workit-opencode@8.22.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing @brainervirus/workit-opencode@8.22.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.