registry / @brainervirus/workit-opencode / 0.11.0
@brainervirus/workit-opencode@0.11.0
Workit OpenCode plugin (thin wrapper over @brainervirus/workit-core)
Static Scan Results
scanned 1mo ago · by rust-scannerStatic analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcedist/plugin.jsView file
644// packages/workit-core/src/core/branch-policy.ts
L645: import { spawnSync } from "node:child_process";
L646: var PREFIXES = {
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/plugin.js:
writeFileSync
writeFileSync(path.join(dir, "config.json"), JSON.stringify(config, null, 2) + `
import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, readdirSync as readdirSync2, writeFileSync as writeFileSync2 } from "node:fs";
writeFileSync2(file, md, "utf8");
import { writeFileSync as writeFileSync3 } from "node:fs";
function writeFileExclusive(file, content, mode) {
writeFileSync3(file, content, { encoding: "utf8", flag: "wx", mode });
writeFileSync as writeFileSync7
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/plugin.jsView on unpkg84};
L85: var resolveConfigDir = () => process.env.WORKFLOW_TOOLKIT_CONFIG ?? process.env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path.join(process.env.XDG_CONFIG_HOME || path.join(os.homedir(), ".co...
L86: var migratedDir = null;
...
L151: try {
L152: parsed = JSON.parse(raw);
L153: } catch {
...
L257: }
L258: return { name, description, platforms, body: fm[2].trim() + `
L259: ` };
...
L472: const parent = path4.dirname(dir);
L473: if (existsSync3(path4.join(dir, "package.json")) || parent === dir)
L474: return dir;
Findings
5 High2 Medium5 Low
HighChild Processdist/plugin.js
HighShell
HighCredential Redirect Persistencedist/plugin.js
HighCommand Output Exfiltrationdist/plugin.js
HighSemantic Analysis Limitedassets/vendor/superpowers/skills/brainstorming/scripts/server.cjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowWeak Cryptoassets/vendor/superpowers/skills/brainstorming/scripts/server.cjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @brainervirus/workit-opencode@0.11.0.
See all versions of @brainervirus/workit-opencode for other recorded verdicts.
- Review the evidence and your use of @brainervirus/workit-opencode@0.11.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.