registry / @brainervirus/workit-opencode / 0.9.2

@brainervirus/workit-opencode@0.9.2

⚠ Under review

Workit OpenCode plugin (thin wrapper over @brainervirus/workit-core)

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 809 KB of source, external domains: bun.sh, cli.github.com, enghouseamg.youtrack.cloud, github.com, gitlab.com, json-schema.org, keepachangelog.com, primeradiant.com, semver.org, www.jetbrains.com

Source & flagged code

4 flagged

assets/vendor/superpowers/skills/brainstorming/scripts/server.cjsView file

Lines 1-21javascript

1const crypto = require('crypto');

2const http = require('http');

3const fs = require('fs');

4const path = require('path');

6// ========== WebSocket Protocol (RFC 6455) ==========

8const OPCODES = { TEXT: 0x01, CLOSE: 0x08, PING: 0x09, PONG: 0x0A };

9const WS_MAGIC = '258EAFA5-E914-47DA-95CA-C5AB0DC85B11';

10const MAX_FRAME_PAYLOAD_BYTES = 10 * 1024 * 1024;

12function computeAcceptKey(clientKey) {

13 return crypto.createHash('sha1').update(clientKey + WS_MAGIC).digest('base64');

14}

Low

Weak Crypto

Package source references weak cryptographic algorithms.

assets/vendor/superpowers/skills/brainstorming/scripts/server.cjsView on unpkg · L1

16function encodeFrame(opcode, payload) {

17 const fin = 0x80;

18 const len = payload.length;

19 let header;

21 if (len < 126) {

dist/plugin.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/plugin.js: writeFileSync writeFileSync(path.join(dir, "config.json"), JSON.stringify(config, null, 2) + ` import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, readdirSync as readdirSync2, writeFileSync as writeFileSync2 } from "node:fs"; writeFileSync2(file, md, "utf8"); import { writeFileSync as writeFileSync3 } from "node:fs"; function writeFileExclusive(file, content, mode) { writeFileSync3(file, content, { encoding: "utf8", flag: "wx", mode }); writeFileSync as writeFileSync7

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/plugin.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @brainervirus/workit-opencode@0.11.0 matchedIdentity = npm:[redacted]:0.11.0 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/plugin.jsView on unpkg

assets/vendor/superpowers/skills/brainstorming/scripts/server.cjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

assets/vendor/superpowers/skills/brainstorming/scripts/server.cjs#virtual:normalized:round1View on unpkg

Source & flagged code

4 flagged · loading source

assets/vendor/superpowers/skills/brainstorming/scripts/server.cjsView file

1const crypto = require('crypto'); L2: const http = require('http'); L3: const fs = require('fs'); ... L12: function computeAcceptKey(clientKey) { L13: return crypto.createHash('sha1').update(clientKey + WS_MAGIC).digest('base64'); L14: } ... L84: L85: const PORT_FILE = process.env.BRAINSTORM_PORT_FILE || null; L86: const randomPort = () => 49152 + Math.floor(Math.random() * 16383); ... L195: try { sessionStorage.setItem('brainstorm-session-key', ${jsonKey}); } catch (e) {} L196: location.replace('/'); L197: </script>

Low

Weak Crypto

Package source references weak cryptographic algorithms.

assets/vendor/superpowers/skills/brainstorming/scripts/server.cjsView on unpkg · L1

dist/plugin.jsView file

Findings

3 High2 Medium6 Low

HighCredential Redirect Persistencedist/plugin.js

HighSemantic Analysis Limitedassets/vendor/superpowers/skills/brainstorming/scripts/server.cjs#virtual:normalized:round1

HighPrevious Version Dangerous Deltadist/plugin.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEval

LowWeak Cryptoassets/vendor/superpowers/skills/brainstorming/scripts/server.cjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @brainervirus/workit-opencode@0.9.2.

See all versions of @brainervirus/workit-opencode for other recorded verdicts.

Review the evidence and your use of @brainervirus/workit-opencode@0.9.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-19 11:04:36.775Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.