registry / @cmmd-center/forge / 0.9.0

@cmmd-center/forge@0.9.0

⚠ Under review

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 20 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareUrlStrings

Manifest

NoLicense

scanned 392 file(s), 18.9 MB of source, external domains: api.example.com, base-ui.com, browser.sentry-cdn.com, cdn.jsdelivr.net, cdnjs.cloudflare.com, creativecommons.org, docs.sentry.io, github.com, json-schema.org, jsonplaceholder.typicode.com, lexical.dev, o447951.ingest.sentry.io, purl.org, raw.githubusercontent.com, react.dev, sentry.io, spotlightjs.com, www.dicebear.com, www.ibm.com, www.w3.org, yandex.com

Oversized source lightweight scan

dist/bin.cjs11.0 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoHighEntropyStrings

dist/bin.mjs10.6 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVars

Source & flagged code

12 flagged

dist/HttpServer-ByyNdEXm.mjsView file

Lines 4104-4144javascript

4104/**

4105* @since 4.0.0

4106* @category Tracer

4107*/

4108const tracer = /* @__PURE__ */ make$2((httpApp) => withFiber((fiber) => {

4109 const request = getUnsafe$1(fiber.context, HttpServerRequest);

4110 if (!fiber.getRef(TracerEnabled) || fiber.getRef(TracerDisabledWhen)(request)) return httpApp;

4111 const span = makeSpanUnsafe(fiber, fiber.getRef(SpanNameGenerator)(request), {

4112 parent: getOrUndefined(fromHeaders(request.headers)),

4113 kind: "server"

4114 });

4115 const prevServices = fiber.context;

4116 fiber.setContext(add(fiber.context, ParentSpan, span));

4117 return onExitPrimitive(httpApp, (exit) => {

4118 fiber.setContext(prevServices);

4119 const endTime = fiber.getRef(Clock).currentTimeNanosUnsafe();

4120 fiber.currentDispatcher.scheduleTask(() => {

4121 const url = toURL(request);

4122 if (isSome(url) && (url.value.username !== "" || url.value.password !== "")) {

4123 url.value.username = "REDACTED";

4124 url.value.password = "REDACTED";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/HttpServer-ByyNdEXm.mjsView on unpkg · L4124

4125 }

4126 const redactedHeaderNames = fiber.getRef(CurrentRedactedNames);

4127 const requestHeaders = redact(request.headers, redactedHeaderNames);

4128 span.attribute("http.request.method", request.method);

4129 if (isSome(url)) {

4130 span.attribute("url.full", url.value.toString());

4131 span.attribute("url.path", url.value.pathname);

4132 if (url.value.search.slice(1) !== "") span.attribute("url.query", url.value.search.slice(1));

4133 span.attribute("url.scheme", url.value.protocol.slice(0, -1));

4134 }

4135 if (request.headers["user-agent"] !== void 0) span.attribute("user_agent.original", request.headers["user-agent"]);

4136 for (const name in requestHeaders) span.attribute(`http.request.header.${name}`, String(requestHeaders[name]));

4137 if (isSome(request.remoteAddress)) span.attribute("client.address", request.remoteAddress.value);

4138 const response = exitResponse(exit);

4139 span.attribute("http.response.status_code", response.status);

4140 const responseHeaders = redact(response.headers, redactedHeaderNames);

4141 for (const name in responseHeaders) span.attribute(`http.response.header.${name}`, String(responseHeaders[name]));

4142 span.end(endTime, exit);

4143 }, 0);

4144 }, true);

dist/open-DV4yE_Ex.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import childProcess, { execFile } from "node:child_process";

4import fs from "node:fs";

High

Child Process

Package source references child process execution.

dist/open-DV4yE_Ex.mjsView on unpkg · L2

5import $U from

dist/BunPTY-z9OKvyBo.cjsView file

Lines 1-22javascript

1#!/usr/bin/env node

3require("./chunk-BhaIgcZK.cjs");

4const require_Schema = require("./Schema-Bij_WAra.cjs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/BunPTY-z9OKvyBo.cjsView on unpkg · L2

5const

dist/NodeHttpServer-BNIz9o3J.cjsView file

Lines 1-33javascript

1#!/usr/bin/env node

3const require_chunk = require("./chunk-BhaIgcZK.cjs");

4const require_Schema = require("./Schema-Bij_WAra.cjs");

5const

dist/client/assets/jspdf.es.min-Hx4pHu4X.jsView file

Lines 1-23javascript

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/html2canvas-CA7kyov8.js","assets/rolldown-runtime-hePW80VL.js","assets/index.es-DH1ipSb3.js","assets/typeof-B5XbjTb1.js"])))=>i.

dist/NodeTerminal-_XekCzf-.mjsView file

Lines 1-24javascript

1#!/usr/bin/env node

3import { $c as none, Ac as Service, Ba as _await, Da as addFinalizer, Dn as asVoid, Ei as void_, Fl as isNotUndefined, Gc as fromUndefinedOr, Hc as flatMap$1, Il as isNullish, Ir as orDie, Ja as

dist/client/apple-touch-icon.png.publish-bakView file

•path = dist/client/apple-touch-icon.png.publish-bak kind = high_entropy_blob sizeBytes = 12054 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/apple-touch-icon.png.publish-bakView on unpkg

dist/bin.mjsView file

•path = dist/bin.mjs kind = oversized_source_file sizeBytes = 11133422 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bin.mjsView on unpkg

•path = dist/bin.mjs kind = oversized_cli_entrypoint sizeBytes = 11133422 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin.mjsView on unpkg

dist/client/assets/DiffPanelShell-RhpdhrM8.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/client/assets/DiffPanelShell-RhpdhrM8.jsView on unpkg

dist/HttpServer-aJkhz6yu.cjsView file

Lines 4114-4154javascript

4114* @since 4.0.0

4115* @category Tracer

4116*/

4117const tracer = /* @__PURE__ */ make$2((httpApp) => require_Schema.withFiber

Source & flagged code

12 flagged · loading source

dist/HttpServer-ByyNdEXm.mjsView file

4124patternName = generic_password severity = medium line = 4124 matchedText = url.valu...ED";

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/HttpServer-ByyNdEXm.mjsView on unpkg · L4124

dist/open-DV4yE_Ex.mjsView file

2L3: import childProcess, { execFile } from "node:child_process"; L4: import fs from "node:fs";

High

Child Process

Package source references child process execution.

dist/open-DV4yE_Ex.mjsView on unpkg · L2

63//#endregion L64: //#region ../../node_modules/.bun/powershell-utils@0.1.0/node_modules/powershell-utils/index.js L65: const execFile$3 = promisify(childProcess.execFile);

High

Shell

Package source references shell execution.

dist/open-DV4yE_Ex.mjsView on unpkg · L63

Findings

1 Critical5 High9 Medium5 Low

CriticalTrojan Source Unicodedist/client/assets/jspdf.es.min-Hx4pHu4X.js

HighChild Processdist/open-DV4yE_Ex.mjs

HighShelldist/open-DV4yE_Ex.mjs

HighCross File Remote Execution Contextdist/NodeTerminal-_XekCzf-.mjs

HighShips High Entropy Blobdist/client/apple-touch-icon.png.publish-bak

HighSemantic Analysis Limiteddist/client/assets/DiffPanelShell-RhpdhrM8.js

MediumSecret Patterndist/HttpServer-ByyNdEXm.mjs

MediumDynamic Requiredist/BunPTY-z9OKvyBo.cjs

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumOversized Source Filedist/bin.mjs

Affected versions and remediation

This report applies to @cmmd-center/forge@0.9.0.

See all versions of @cmmd-center/forge for other recorded verdicts.

Review the evidence and your use of @cmmd-center/forge@0.9.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-27 06:28:58.509Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.