registry / @cmmd-center/forge / 0.9.8

@cmmd-center/forge@0.9.8

AI Security Review

scanned 4d ago · by lpm-firewall-ai

The manifest has no install lifecycle hook, and source inspection found no concrete malicious behavior. The flagged process, network, Unicode, and artifact indicators resolve to bundled utilities, a text-download byte-order mark, and valid PNG data.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Running the published CLI or loading its browser interface.

Impact

No unauthorized package-driven effect was identified.

Mechanism

The CLI reads configured error-reporting settings and sanitizes selected event fields; the flagged path helper reads working-directory names. No malicious action was established.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json points to the CLI bundle and contains no lifecycle script.
The CLI configures error reporting from runtime environment settings; it redacts sensitive fields before sending events.
The flagged browser code derives project names from working-directory paths, including Claude worktree paths.
The flagged server code sets WebSocket protocol and origin headers during connection setup.
The Unicode match is a byte-order mark used when downloading UTF-8 text, not a bidi control.
Other flagged files contain bundled utility code, and the offline analysis identifies the high-entropy file as a valid PNG with no trailing bytes.

Evidence against

Static hints flagged process execution, network use, Unicode, and a high-entropy file; inspected source ties these to bundled utilities and data rather than a concrete attack.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetwork

Source & flagged code

14 flagged

dist/HttpServer-BTcgkY38.cjsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const require_Schema = require("./Schema-DaFukK_y.cjs");

4const require_Path = require("./Path-qpublmG3.cjs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/HttpServer-BTcgkY38.cjsView on unpkg · L2

5//#region ../../node_modules/.bun/effect@4.0.0-beta.45/node_modules/effect/dist/UndefinedOr.js

6/**

7* @since 4.0.0

8*/

9const map = /* @__PURE__ */ require_Schema.dual(2, (self, f) => self === void 0 ? void 0 : f(self));

10require_Schema.CurrentErrorReporters;

11/**

12* Symbol key used to mark an error as unreportable.

13*

14* Set this property to `true` on any error class to prevent it from being

15* forwarded to reporters. Useful for expected errors such as HTTP 404s.

16*

17* @example

18* ```ts

19* import { Data, ErrorReporter } from "effect"

20*

21* class NotFoundError extends Data.TaggedError("NotFoundError")<{}> {

22* readonly [ErrorReporter.ignore] = true

Lines 4227-4267javascript

4227* @since 4.0.0

4228* @category Tracer

4229*/

4230const tracer = /* @__PURE__ */ make$2((httpApp) => require_Schema.withFiber((fiber) => {

dist/execAsync-BNNdR88o.mjsView file

Lines 1-14javascript

1#!/usr/bin/env node

3import { i as __require, t as __commonJSMin } from "./chunk-C5ckVeoz.mjs";

4//#region ../../node_modules/.bun/@opentelemetry+resources@2.10.0+e40b0dfdd726a224/node_modules/@opentelemetry/resources/build/src/detectors/platform/node/machine-id/execAsync.js

5var require_execAsync = /* @__PURE__ */ __commonJSMin(((

dist/open-D8mGyWmt.mjsView file

Lines 43-83javascript

43};

44function isInsideContainer() {

45 if (cachedResult === void 0) cachedResult = hasContainerEnv() || isDocker();

46 return

dist/NodeHttpServer-D6YVHsL8.cjsView file

Lines 1-33javascript

1#!/usr/bin/env node

3const require_chunk = require("./chunk-BhaIgcZK.cjs");

4const require_Schema = require("./Schema-DaFukK_y.cjs");

5const

dist/client/assets/jspdf.es.min-_OjqfV_L.jsView file

Lines 1-23javascript

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/html2canvas-C_LL7spC.js","assets/rolldown-runtime-BeQ30c1w.js","assets/index.es-piUKIQw4.js","assets/typeof-DOAxNSYQ.js"])))=>i.

dist/NodeTerminal-D86oor5_.cjsView file

Lines 1-25javascript

1#!/usr/bin/env node

3const require_chunk = require("./chunk-BhaIgcZK.cjs");

4const require_Schema = require("./Schema-DaFukK_y.cjs");

5const

dist/forge-provision-display.shView file

•path = dist/forge-provision-display.sh kind = build_helper sizeBytes = 13090 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/forge-provision-display.shView on unpkg

dist/client/apple-touch-icon.png.publish-bakView file

•path = dist/client/apple-touch-icon.png.publish-bak kind = high_entropy_blob sizeBytes = 12054 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/apple-touch-icon.png.publish-bakView on unpkg

dist/bin.mjsView file

•path = dist/bin.mjs kind = oversized_source_file sizeBytes = 11522471 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bin.mjsView on unpkg

•path = dist/bin.mjs kind = oversized_cli_entrypoint sizeBytes = 11522471 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin.mjsView on unpkg

dist/NodeTerminal-D86oor5_.cjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/NodeTerminal-D86oor5_.cjs#virtual:normalized:round1View on unpkg

dist/HttpServer-DV-x5DVo.mjsView file

Lines 4218-4258javascript

4218/**

4219* @since 4.0.0

4220* @category Tracer

4221*/

4222const tracer = /* @__PURE__ */ make$2((httpApp) =>

Source & flagged code

14 flagged · loading source

dist/HttpServer-BTcgkY38.cjsView file

4247patternName = generic_password severity = medium line = 4247

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/HttpServer-BTcgkY38.cjsView on unpkg · L4247

2L3: const require_Schema = require("./Schema-DaFukK_y.cjs"); L4: const require_Path = require("./Path-qpublmG3.cjs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/HttpServer-BTcgkY38.cjsView on unpkg · L2

dist/execAsync-BNNdR88o.mjsView file

7exports.execAsync = void 0; L8: const child_process = __require("child_process"); L9: exports.execAsync = __require("util").promisify(child_process.exec);

High

Child Process

Package source references child process execution.

dist/execAsync-BNNdR88o.mjs

Findings

2 Critical5 High10 Medium5 Low

CriticalTrojan Source Unicodedist/client/assets/jspdf.es.min-_OjqfV_L.js

CriticalPrevious Version Dangerous Deltadist/NodeHttpServer-D6YVHsL8.cjs

HighChild Processdist/execAsync-BNNdR88o.mjs

HighShelldist/open-D8mGyWmt.mjs

HighCross File Remote Execution Contextdist/NodeTerminal-D86oor5_.cjs

HighShips High Entropy Blobdist/client/apple-touch-icon.png.publish-bak

HighSemantic Analysis Limiteddist/NodeTerminal-D86oor5_.cjs#virtual:normalized:round1

MediumSecret Patterndist/HttpServer-BTcgkY38.cjs

MediumDynamic Requiredist/HttpServer-BTcgkY38.cjs

MediumNetwork

MediumEnvironment Vars

Medium

Affected versions and remediation

This report applies to @cmmd-center/forge@0.9.8.

See all versions of @cmmd-center/forge for other recorded verdicts.

Review the evidence and your use of @cmmd-center/forge@0.9.8 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-19 06:55:39.531Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.