registry / @cmmd-center/forge / 0.9.7
@cmmd-center/forge@0.9.7
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe high-risk scanner signals resolve to ordinary application or dependency behavior, and the manifest has no install hook. Inspected source did not establish credential disclosure, payload execution, persistence, or unauthorized agent configuration changes.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The CLI runs when invoked; the manifest contains no npm install lifecycle hook.
Impact
No security impact was established from the inspected paths.
Mechanism
The reviewed paths do not establish credential transfer, payload execution, persistence, or unconsented agent configuration changes.
AI rationale
The high-risk scanner signals resolve to ordinary application or dependency behavior, and the manifest has no install hook. Inspected source did not establish credential disclosure, payload execution, persistence, or unauthorized agent configuration changes.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- The manifest defines a CLI entrypoint and has no npm lifecycle hook.
- The flagged client code derives repository and worktree paths; it does not mutate agent settings.
- The flagged runtime code builds WebSocket handshake headers; it does not perform an account action.
- The reviewed browser code adds a UTF-8 download marker and sends code to a worker for syntax highlighting.
- Other flagged excerpts show command construction, an OS opener, a dependency exec wrapper, generic schema code, and Sentry reporting that requires a configured DSN and scrubs events.
- The unusual backup artifact has valid PNG framing and CRCs with no trailing bytes; pixel decoding was not performed.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell
HighEntropyStrings
Source & flagged code
14 flagged · loading sourcedist/HttpServer-BTcgkY38.cjsView file
4247patternName = generic_password
severity = medium
line = 4247
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/HttpServer-BTcgkY38.cjsView on unpkg · L42472L3: const require_Schema = require("./Schema-DaFukK_y.cjs");
L4: const require_Path = require("./Path-qpublmG3.cjs");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/HttpServer-BTcgkY38.cjsView on unpkg · L2dist/execAsync-BNNdR88o.mjsView file
7exports.execAsync = void 0;
L8: const child_process = __require("child_process");
L9: exports.execAsync = __require("util").promisify(child_process.exec);
High
Child Process
Package source references child process execution.
dist/execAsync-BNNdR88o.mjsFindings
2 Critical5 High10 Medium5 Low
CriticalTrojan Source Unicodedist/client/assets/jspdf.es.min-_OjqfV_L.js
CriticalPrevious Version Dangerous Deltadist/NodeHttpServer-D6YVHsL8.cjs
HighChild Processdist/execAsync-BNNdR88o.mjs
HighShelldist/open-FIgTDosf.mjs
HighCross File Remote Execution Contextdist/NodeTerminal-D86oor5_.cjs
HighShips High Entropy Blobdist/client/apple-touch-icon.png.publish-bak
HighSemantic Analysis Limiteddist/NodeTerminal-D86oor5_.cjs#virtual:normalized:round1
MediumSecret Patterndist/HttpServer-BTcgkY38.cjs
MediumDynamic Requiredist/HttpServer-BTcgkY38.cjs
MediumNetwork
MediumEnvironment Vars
Medium
Affected versions and remediation
This report applies to @cmmd-center/forge@0.9.7.
See all versions of @cmmd-center/forge for other recorded verdicts.
- Review the evidence and your use of @cmmd-center/forge@0.9.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.