registry  /  @islee23520/lfg  /  0.1.26

@islee23520/lfg@0.1.26

OpenCode OmO / lazycodex GrokBuild port: npx @islee23520/lfg setup --run installs the lfg-owned Grok Build plugin payload under ~/.grok/plugins/lfg.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
Manifest
NoLicense
scanned 96 file(s), 2.77 MB of source, external domains: 127.0.0.1, api.x.ai, api.z.ai, auth.x.ai, biomejs.dev, clangd.llvm.org, docs.z.ai, github.com, json-schema.org, mcp.context7.com, mcp.grep.app, raw.githubusercontent.com

Source & flagged code

6 flagged · loading source
dist/grok-install/mcp-runtimes/ast-grep-mcp/dist/cli.jsView file
1#!/usr/bin/env node L2: import { spawn } from "node:child_process" L3: import { constants } from "node:fs"
High
Child Process

Package source references child process execution.

dist/grok-install/mcp-runtimes/ast-grep-mcp/dist/cli.jsView on unpkg · L1
dist/grok-install/skills/ultimate-browsing/engine/templates/playwright_mobile_chrome.jsView file
56} L57: return require(resolvedModule); L58: }
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/grok-install/skills/ultimate-browsing/engine/templates/playwright_mobile_chrome.jsView on unpkg · L56
dist/lfg-setup-tui.jsView file
309assignProp: () => assignProp, L310: base64ToUint8Array: () => base64ToUint8Array, L311: base64urlToUint8Array: () => base64urlToUint8Array, ... L1186: error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config()))) L1187: } : { success: true, data: result.value }; L1188: }; ... L2710: try { L2711: new URL(`http://[${payload.value}]`); L2712: } catch { ... L16291: async function writeGrokModelConfig(discovery, options = {}) { L16292: const home = options.home ?? homedir(); L16293: const path = join5(home, ".grok", "config.toml");
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/lfg-setup-tui.jsView on unpkg · L309
309Cross-file remote execution chain: dist/lfg-setup-tui.js spawns dist/lfg.js; helper contains network access plus dynamic code execution. L309: assignProp: () => assignProp, L310: base64ToUint8Array: () => base64ToUint8Array, L311: base64urlToUint8Array: () => base64urlToUint8Array, ... L1186: error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config()))) L1187: } : { success: true, data: result.value }; L1188: }; ... L2710: try { L2711: new URL(`http://[${payload.value}]`); L2712: } catch { ... L16291: async function writeGrokModelConfig(discovery, options = {}) { L16292: const home = options.home ?? homedir(); L16293: const path = join5(home, ".grok", "config.toml");
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/lfg-setup-tui.jsView on unpkg · L309
dist/grok-install/skills/ast-grep/install.shView file
•path = dist/grok-install/skills/ast-grep/install.sh kind = build_helper sizeBytes = 7581 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/grok-install/skills/ast-grep/install.shView on unpkg
dist/grok-install/skills/ast-grep/tests/smoke.ps1View file
•path = dist/grok-install/skills/ast-grep/tests/smoke.ps1 kind = payload_in_excluded_dir sizeBytes = 5701 magicHex = [redacted]
High
Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/grok-install/skills/ast-grep/tests/smoke.ps1View on unpkg

Findings

5 High5 Medium6 Low
HighChild Processdist/grok-install/mcp-runtimes/ast-grep-mcp/dist/cli.js
HighShell
HighSandbox Evasion Gated Capabilitydist/lfg-setup-tui.js
HighCross File Remote Execution Contextdist/lfg-setup-tui.js
HighPayload In Excluded Dirdist/grok-install/skills/ast-grep/tests/smoke.ps1
MediumDynamic Requiredist/grok-install/skills/ultimate-browsing/engine/templates/playwright_mobile_chrome.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/grok-install/skills/ast-grep/install.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License