registry / @brainervirus/workit-opencode / 1.0.7
@brainervirus/workit-opencode@1.0.7
⚠ Under reviewWorkit OpenCode plugin — native tools, adaptive policy, and fourteen method skills
Static Scan Results
scanned 1mo ago · by rust-scannerStatic analysis completed at 72.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
2 flagged · loading sourcedist/plugin.jsView file
21// packages/workit-core/src/core.ts
L22: import { spawnSync as spawnSync2 } from "node:child_process";
L23: import { existsSync as existsSync3, realpathSync as realpathSync5 } from "node:fs";
High
21// packages/workit-core/src/core.ts
L22: import { spawnSync as spawnSync2 } from "node:child_process";
L23: import { existsSync as existsSync3, realpathSync as realpathSync5 } from "node:fs";
...
L422: for (let i = 0;i < units - 1; i++) {
L423: if ((str.charCodeAt(i) & 64512) === 55296 && (str.charCodeAt(i + 1) & 64512) === 56320) {
L424: count--;
...
L848: error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config())))
L849: } : { success: true, data: result.value };
L850: };
...
L1723: try {
L1724: new URL(`http://[${value}]`);
L1725: return true;
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/plugin.jsView on unpkg · L21Findings
3 High2 Medium4 Low
HighChild Processdist/plugin.js
HighShell
HighCommand Output Exfiltrationdist/plugin.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @brainervirus/workit-opencode@1.0.7.
See all versions of @brainervirus/workit-opencode for other recorded verdicts.
- Review the evidence and your use of @brainervirus/workit-opencode@1.0.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.