Loading npm security reports…

@invokehq/foundry: Suspicious npm security report (Warn) | LPM Firewall

registry / @invokehq/foundry / 0.8.0

@invokehq/foundry@0.8.0

Forge AI agents locally with a governed workspace — exactly-once, receipted, no account needed. Deploy to Invoke when you're ready.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 12 file(s), 117 KB of source, external domains: api.github.com, api.invokehq.run, api.openai.com, invokehq.run, mcp.deepwiki.com

Source & flagged code

4 flagged

src/commands.jsView file

Lines 1-24javascript

1"use strict";

2const fs = require("node:fs");

3const path = require("node:path");

4const readline = require("node:readline");

5const { spawn } = require("node:child_process");

6const store = require("./store");

High

Child Process

Package source references child process execution.

src/commands.jsView on unpkg · L4

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/commands.jsView on unpkg · L4

7const { Ledger } = require("./ledger");

8const { runTool, BUILTINS, toolType } = require("./tools");

9const mcp = require("./mcp");

10const policy = require("./policy");

11const cloud = require("./cloud");

12const memory = require("./memory");

13const red = (s) => `\x1b[31m${s}\x1b[0m`;

15// Execute a tool locally: a connector tool ("<connector>.<tool>") proxies to its MCP

16// server; otherwise it's a built-in. The ledger (dedup + receipt) wraps this in run().

17async function executeLocal(dir, tool, params) {

18 const conns = store.readConnectors(dir);

19 // `memory.*` is a reserved namespace: the Context layer, governed like any Execution.

20 if (tool.startsWith("memory.")) return memory.runMemoryTool(dir, tool, params);

21 const dot = tool.indexOf(".");

22 if (dot > 0) {

23 const cname = tool.slice(0, dot);

24 if (conns[cname]) return mcp.call(conns[cname], tool.slice(dot + 1), params);

•matchType = previous_version_dangerous_delta matchedPackage = @invokehq/foundry@0.7.0 matchedIdentity = npm:QGludm9rZWhxL2ZvdW5kcnk:0.7.0 similarity = 0.545 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/commands.jsView on unpkg

src/mcp.jsView file

Lines 1-33javascript

1"use strict";

2// Minimal Model Context Protocol client — enough for Foundry to connect a *real* MCP

3// server and govern its tools through the ledger. Two transports, because the ecosystem

4// has two shapes:

5//

6// http — hosted servers (deepwiki, Vercel). Streamable HTTP + optional auth header.

7// stdio — the majority: launched via npx (Slack, GitHub, Postgres, filesystem, …),

8// speaking newline-delimited JSON-RPC over the child's stdin/stdout.

9//

10// Secrets never touch disk: header values and env vars are stored as `${VAR}` templates

Source & flagged code

4 flagged · loading source

src/commands.jsView file

Source & flagged code

4 flagged

src/commands.jsView file

Lines 1-24javascript

1"use strict";

2const fs = require("node:fs");

3const path = require("node:path");

4const readline = require("node:readline");

5const { spawn } = require("node:child_process");

6const store = require("./store");

High

Child Process

Package source references child process execution.

src/commands.jsView on unpkg · L4

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/commands.jsView on unpkg · L4

7const { Ledger } = require("./ledger");

8const { runTool, BUILTINS, toolType } = require("./tools");

9const mcp = require("./mcp");

10const policy = require("./policy");

11const cloud = require("./cloud");

12const memory = require("./memory");

13const red = (s) => `\x1b[31m${s}\x1b[0m`;

15// Execute a tool locally: a connector tool ("<connector>.<tool>") proxies to its MCP

16// server; otherwise it's a built-in. The ledger (dedup + receipt) wraps this in run().

17async function executeLocal(dir, tool, params) {

18 const conns = store.readConnectors(dir);

19 // `memory.*` is a reserved namespace: the Context layer, governed like any Execution.

20 if (tool.startsWith("memory.")) return memory.runMemoryTool(dir, tool, params);

21 const dot = tool.indexOf(".");

22 if (dot > 0) {

23 const cname = tool.slice(0, dot);

24 if (conns[cname]) return mcp.call(conns[cname], tool.slice(dot + 1), params);

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/commands.jsView on unpkg

src/mcp.jsView file

Lines 1-33javascript

1"use strict";

2// Minimal Model Context Protocol client — enough for Foundry to connect a *real* MCP

3// server and govern its tools through the ledger. Two transports, because the ecosystem

4// has two shapes:

5//

6// http — hosted servers (deepwiki, Vercel). Streamable HTTP + optional auth header.

7// stdio — the majority: launched via npx (Slack, GitHub, Postgres, filesystem, …),

8// speaking newline-delimited JSON-RPC over the child's stdin/stdout.

9//

10// Secrets never touch disk: header values and env vars are stored as `${VAR}` templates

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code