@brainervirus/workit-opencode@8.19.1
Workit OpenCode plugin — native tools, adaptive policy, and sixteen method skills
AI Security Review
scanned 16h ago · by lpm-firewall-aiThe runtime sends a stored YouTrack token to a package-provided default host without recipient validation or recipient-specific consent. This is concrete credential disclosure, so the package should be blocked.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the YouTrack setup flow without overriding its base URL, stores a token, then requests YouTrack issue context.
Impact
The token is disclosed to the configured recipient, potentially exposing the associated YouTrack account.
Mechanism
The plugin reads the token file and attaches its contents as a bearer credential to a request at the configured base URL, which defaults to https://youtrack.example.com.
Attack narrative
The package exports the plugin containing a YouTrack context path that reads a saved token and sends it as a bearer credential. Its setup flow supplies https://youtrack.example.com as the default base URL and directs the user to create and store a token, so following the setup without an override sends that credential to the package-selected host.
AI rationale
The runtime sends a stored YouTrack token to a package-provided default host without recipient validation or recipient-specific consent. This is concrete credential disclosure, so the package should be blocked.
Evidence
dist/plugin.jspackage.json
Network endpoints1
youtrack.example.com
Decision evidence
public snapshotAI called this Malicious at 91.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package exports dist/plugin.js as its runtime entrypoint.
- YouTrack setup defaults to https://youtrack.example.com unless an environment override is supplied.
- The setup flow creates a token file and tells the user to create a YouTrack token and paste it there.
- The runtime reads that token from the configured token file.
- A YouTrack context request sends the token as a bearer credential to the configured base URL without validating the recipient.
- The runtime invokes that request when a YouTrack issue context is requested.
Evidence against
- Setup requires an explicit confirmed action, and the base URL can be overridden; neither establishes consent to send a service token to the default recipient.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcedist/plugin.jsView file
6// packages/workit-core/src/core.ts
L7: import { spawnSync as spawnSync16 } from "node:child_process";
L8: import { existsSync as existsSync8, realpathSync as realpathSync5 } from "node:fs";
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/plugin.js:
decision: "Record or revoke a user decision (never an authorization).",
fs3.writeFileSync(fd, raw, "utf8");
writeFileSync
writeFileSync(path3.join(dir, "config.json"), JSON.stringify(config, null, 2) + `
youtrack: object({ baseUrl: nonBlank.optional(), link_issues: boolean2().optional() }).passthrough().optional(),
baseUrl: text2(yt.baseUrl),
if (common.baseUrl)
return { provider: "youtrack", link: false, ...common, source: "youtrack.baseUrl" };
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/plugin.jsView on unpkg6// packages/workit-core/src/core.ts
L7: import { spawnSync as spawnSync16 } from "node:child_process";
L8: import { existsSync as existsSync8, realpathSync as realpathSync5 } from "node:fs";
...
L396: for (let i = 0;i < units - 1; i++) {
L397: if ((str.charCodeAt(i) & 64512) === 55296 && (str.charCodeAt(i + 1) & 64512) === 56320) {
L398: count--;
...
L830: }
L831: return result.issues.length ? failure(_Err, result.issues, ctx) : { success: true, data: result.value };
L832: };
...
L1706: return false;
L1707: return canParseURL(`http://[${value}]`);
L1708: }
Findings
5 High2 Medium5 Low
HighChild Processdist/plugin.js
HighCredential Redirect Persistencedist/plugin.js
HighCommand Output Exfiltrationdist/plugin.js
HighAi Review Evidencepackage.json
HighAi Review Evidencedist/plugin.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @brainervirus/workit-opencode@8.19.1.
See all versions of @brainervirus/workit-opencode for other recorded verdicts.
- Avoid installing @brainervirus/workit-opencode@8.19.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.