registry / @brainervirus/workit-opencode / 0.9.0
@brainervirus/workit-opencode@0.9.0
⚠ Under reviewWorkit OpenCode plugin (thin wrapper over @brainervirus/workit-core)
Static Scan Results
scanned 1mo ago · by rust-scannerStatic analysis completed at 93.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
4 flagged · loading sourceassets/vendor/superpowers/skills/brainstorming/scripts/server.cjsView file
1const crypto = require('crypto');
L2: const http = require('http');
L3: const fs = require('fs');
...
L12: function computeAcceptKey(clientKey) {
L13: return crypto.createHash('sha1').update(clientKey + WS_MAGIC).digest('base64');
L14: }
...
L84:
L85: const PORT_FILE = process.env.BRAINSTORM_PORT_FILE || null;
L86: const randomPort = () => 49152 + Math.floor(Math.random() * 16383);
...
L195: try { sessionStorage.setItem('brainstorm-session-key', ${jsonKey}); } catch (e) {}
L196: location.replace('/');
L197: </script>
Low
Weak Crypto
Package source references weak cryptographic algorithms.
assets/vendor/superpowers/skills/brainstorming/scripts/server.cjsView on unpkg · L1dist/plugin.jsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/plugin.js:
writeFileSync
writeFileSync(path.join(dir, "config.json"), JSON.stringify(config, null, 2) + `
import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, readdirSync as readdirSync2, writeFileSync as writeFileSync2 } from "node:fs";
writeFileSync2(file, md, "utf8");
import { writeFileSync as writeFileSync3 } from "node:fs";
function writeFileExclusive(file, content, mode) {
writeFileSync3(file, content, { encoding: "utf8", flag: "wx", mode });
writeFileSync as writeFileSync7
Findings
3 High2 Medium6 Low
HighCredential Redirect Persistencedist/plugin.js
HighSemantic Analysis Limitedassets/vendor/superpowers/skills/brainstorming/scripts/server.cjs#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/plugin.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEval
LowWeak Cryptoassets/vendor/superpowers/skills/brainstorming/scripts/server.cjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @brainervirus/workit-opencode@0.9.0.
See all versions of @brainervirus/workit-opencode for other recorded verdicts.
- Review the evidence and your use of @brainervirus/workit-opencode@0.9.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.