@nac3/forge-cli@1.2.4: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@nac3/forge-cli@1.2.4: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

12 flagged · loading source

dist/codegen/e2e.jsView file

390patternName = generic_password severity = medium line = 390

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/codegen/e2e.jsView on unpkg · L390

400patternName = generic_password severity = medium line = 400

Medium

Secret Pattern

Hardcoded password in dist/codegen/e2e.js

dist/codegen/e2e.jsView on unpkg · L400

dist/chat/project_slug.jsView file

78/* eslint-disable @typescript-eslint/no-require-imports */ L79: const fsSync = require('node:fs'); L80: try {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chat/project_slug.jsView on unpkg · L78

dist/chat/instance_lock.jsView file

33const r = path.resolve(root); L34: return process.platform === 'win32' ? r.toLowerCase() : r; L35: } ... L56: try { L57: const h = JSON.parse(readFileSync(p, 'utf-8')); L58: if (h && typeof h.pid === 'number') ... L112: + ' ' + holder.root + '\n' L113: + ' (PID ' + holder.pid + ', panel en http://127.0.0.1:' + holder.port + ')\n\n' L114: + 'Abri esa instancia, o abri Forge en OTRA carpeta. Si estas seguro de que\n'

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chat/instance_lock.jsView on unpkg · L33

dist/commands/app.jsView file

103return missingSlot(opts, 'slack_bot_token'); L104: const r = await fetch('https://slack.com/api/chat.postMessage', { L105: method: 'POST', ... L110: }, L111: body: JSON.stringify({ channel, text: message }), L112: }); ... L135: } L136: const from = opts.from ?? process.env.TWILIO_FROM ?? ''; L137: if (!from) { ... L140: const url = 'https://api.twilio.com/2010-04-01/Accounts/' + sid + '/Messages.json'; L141: const auth = Buffer.from(sid + ':' + token).toString('base64'); L142: const body = new URLSearchParams({ To: to, From: from, Body: message });

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/commands/app.jsView on unpkg · L103

103Trigger-reachable chain: manifest.bin -> dist/bin/yf.js -> dist/commands/app.js L103: return missingSlot(opts, 'slack_bot_token'); L104: const r = await fetch('https://slack.com/api/chat.postMessage', { L105: method: 'POST', ... L110: }, L111: body: JSON.stringify({ channel, text: message }), L112: }); ... L135: } L136: const from = opts.from ?? process.env.TWILIO_FROM ?? ''; L137: if (!from) { ... L140: const url = 'https://api.twilio.com/2010-04-01/Accounts/' + sid + '/Messages.json'; L141: const auth = Buffer.from(sid + ':' + token).toString('base64'); L142: const body = new URLSearchParams({ To: to, From: from, Body: message });

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/commands/app.jsView on unpkg · L103

103Trigger-reachable credential exfiltration chain: manifest.bin -> dist/bin/yf.js -> dist/commands/app.js L103: return missingSlot(opts, 'slack_bot_token'); L104: const r = await fetch('https://slack.com/api/chat.postMessage', { L105: method: 'POST', ... L110: }, L111: body: JSON.stringify({ channel, text: message }), L112: }); ... L135: } L136: const from = opts.from ?? process.env.TWILIO_FROM ?? ''; L137: if (!from) { ... L140: const url = 'https://api.twilio.com/2010-04-01/Accounts/' + sid + '/Messages.json'; L141: const auth = Buffer.from(sid + ':' + token).toString('base64'); L142: const body = new URLSearchParams({ To: to, From: from, Body: message });

dist/chat/server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @nac3/forge-cli@1.1.0 matchedIdentity = npm:QG5hYzMvZm9yZ2UtY2xp:1.1.0 similarity = 0.975 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chat/server.jsView on unpkg

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/chat/server.js: * leak the API key + the project source-aware system prompt. if (!opts.agentMode && !opts.claude && !opts.allowDuplicateRoot) { * Tests inject `opts.claude` directly and bypass this branch. */ cliOpts['timeoutMs'] = (await readLimitsConfig()).claude_cli_timeout_ms; let claude = opts.claude ?? await buildClaudeClient(activeChatProvider); if (opts.claude) if (!opts.claude && activeChatProvider === 'claude-code-cli') { await handleWriteFile(req, res, ctx);

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/chat/server.jsView on unpkg

4053package = @nac3/forge-cli; repositoryIdentity = yujin-forge; dependency = qrcode L4053: catch { /* best-effort */ } L4054: const QRCode = (await import('qrcode')).default; L4055: /* PND-047 follow-up -- the pairing payload grew (the per-handle key is

High

dist/core/desktop_open.jsView file

23*/ L24: import { spawn } from 'node:child_process'; L25: import { existsSync, readFileSync } from 'node:fs'; ... L46: function shellOpen(target) { L47: if (process.platform === 'win32') { L48: /* cmd start: the first quoted arg is the window TITLE (empty), then ... L60: return process.platform === 'linux' L61: && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY; L62: } ... L74: try { L75: const j = JSON.parse(readFileSync(absPath, 'utf-8')); L76: if (j.url && /^https?:\/\//i.test(j.url))

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/core/desktop_open.jsView on unpkg · L23

dist/agents/bridge.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 148

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agents/bridge.jsView on unpkg

Source & flagged code

12 flagged

dist/codegen/e2e.jsView file

390patternName = generic_password severity = medium line = 390

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/codegen/e2e.jsView on unpkg · L390

400patternName = generic_password severity = medium line = 400

Medium

Secret Pattern

Hardcoded password in dist/codegen/e2e.js

dist/codegen/e2e.jsView on unpkg · L400

dist/chat/project_slug.jsView file

Lines 58-98javascript

58 }

59 catch { /* fall through */ }

60 /* 2. package.json.name */

61 try {

62 const raw = await fs.readFile(path.join(projectRoot, 'package.json'), 'utf-8');

63 const parsed = JSON.parse(raw);

64 if (parsed && typeof parsed.name === 'string' && parsed.name.trim() !== '') {

65 return sanitizeProjectSlug(parsed.name);

66 }

67 }

68 catch { /* fall through */ }

69 /* 3. basename */

70 return sanitizeProjectSlug(path.basename(projectRoot));

71}

72/** Sync variant for cases the caller already has the file

73 * contents (e.g. CLI commands that prefer no IO). Returns ''

74 * when nothing fits. */

75export function resolveProjectSlugSync(projectRoot) {

76 /* Best effort only -- callers should prefer the async version. */

77 try {

78 /* eslint-disable @typescript-eslint/no-require-imports */

79 const fsSync = require('node:fs');

80 try {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chat/project_slug.jsView on unpkg · L78

81 const raw = fsSync.readFileSync(path.join(projectRoot, 'yujin.forge.json'), 'utf-8');

82 const parsed = JSON.parse(raw);

83 if (parsed && typeof parsed.project_slug === 'string' && parsed.project_slug.trim() !== '') {

84 return sanitizeProjectSlug(parsed.project_slug);

85 }

86 if (parsed && typeof parsed.project_name === 'string' && parsed.project_name.trim() !== '') {

87 return sanitizeProjectSlug(parsed.project_name);

88 }

89 }

90 catch { /* */ }

91 try {

92 const raw = fsSync.readFileSync(path.join(projectRoot, 'package.json'), 'utf-8');

93 const parsed = JSON.parse(raw);

94 if (parsed && typeof parsed.name === 'string' && parsed.name.trim() !== '') {

95 return sanitizeProjectSlug(parsed.name);

96 }

97 }

98 catch { /* */ }

dist/chat/instance_lock.jsView file

33const r = path.resolve(root); L34: return process.platform === 'win32' ? r.toLowerCase() : r; L35: } ... L56: try { L57: const h = JSON.parse(readFileSync(p, 'utf-8')); L58: if (h && typeof h.pid === 'number') ... L112: + ' ' + holder.root + '\n' L113: + ' (PID ' + holder.pid + ', panel en http://127.0.0.1:' + holder.port + ')\n\n' L114: + 'Abri esa instancia, o abri Forge en OTRA carpeta. Si estas seguro de que\n'

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chat/instance_lock.jsView on unpkg · L33

dist/commands/app.jsView file

103return missingSlot(opts, 'slack_bot_token'); L104: const r = await fetch('https://slack.com/api/chat.postMessage', { L105: method: 'POST', ... L110: }, L111: body: JSON.stringify({ channel, text: message }), L112: }); ... L135: } L136: const from = opts.from ?? process.env.TWILIO_FROM ?? ''; L137: if (!from) { ... L140: const url = 'https://api.twilio.com/2010-04-01/Accounts/' + sid + '/Messages.json'; L141: const auth = Buffer.from(sid + ':' + token).toString('base64'); L142: const body = new URLSearchParams({ To: to, From: from, Body: message });

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/commands/app.jsView on unpkg · L103

103Trigger-reachable chain: manifest.bin -> dist/bin/yf.js -> dist/commands/app.js L103: return missingSlot(opts, 'slack_bot_token'); L104: const r = await fetch('https://slack.com/api/chat.postMessage', { L105: method: 'POST', ... L110: }, L111: body: JSON.stringify({ channel, text: message }), L112: }); ... L135: } L136: const from = opts.from ?? process.env.TWILIO_FROM ?? ''; L137: if (!from) { ... L140: const url = 'https://api.twilio.com/2010-04-01/Accounts/' + sid + '/Messages.json'; L141: const auth = Buffer.from(sid + ':' + token).toString('base64'); L142: const body = new URLSearchParams({ To: to, From: from, Body: message });

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/commands/app.jsView on unpkg · L103

103Trigger-reachable credential exfiltration chain: manifest.bin -> dist/bin/yf.js -> dist/commands/app.js L103: return missingSlot(opts, 'slack_bot_token'); L104: const r = await fetch('https://slack.com/api/chat.postMessage', { L105: method: 'POST', ... L110: }, L111: body: JSON.stringify({ channel, text: message }), L112: }); ... L135: } L136: const from = opts.from ?? process.env.TWILIO_FROM ?? ''; L137: if (!from) { ... L140: const url = 'https://api.twilio.com/2010-04-01/Accounts/' + sid + '/Messages.json'; L141: const auth = Buffer.from(sid + ':' + token).toString('base64'); L142: const body = new URLSearchParams({ To: to, From: from, Body: message });

dist/chat/server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @nac3/forge-cli@1.1.0 matchedIdentity = npm:QG5hYzMvZm9yZ2UtY2xp:1.1.0 similarity = 0.975 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chat/server.jsView on unpkg

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/chat/server.js: * leak the API key + the project source-aware system prompt. if (!opts.agentMode && !opts.claude && !opts.allowDuplicateRoot) { * Tests inject `opts.claude` directly and bypass this branch. */ cliOpts['timeoutMs'] = (await readLimitsConfig()).claude_cli_timeout_ms; let claude = opts.claude ?? await buildClaudeClient(activeChatProvider); if (opts.claude) if (!opts.claude && activeChatProvider === 'claude-code-cli') { await handleWriteFile(req, res, ctx);

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/chat/server.jsView on unpkg

4053package = @nac3/forge-cli; repositoryIdentity = yujin-forge; dependency = qrcode L4053: catch { /* best-effort */ } L4054: const QRCode = (await import('qrcode')).default; L4055: /* PND-047 follow-up -- the pairing payload grew (the per-handle key is

High

dist/core/desktop_open.jsView file

23*/ L24: import { spawn } from 'node:child_process'; L25: import { existsSync, readFileSync } from 'node:fs'; ... L46: function shellOpen(target) { L47: if (process.platform === 'win32') { L48: /* cmd start: the first quoted arg is the window TITLE (empty), then ... L60: return process.platform === 'linux' L61: && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY; L62: } ... L74: try { L75: const j = JSON.parse(readFileSync(absPath, 'utf-8')); L76: if (j.url && /^https?:\/\//i.test(j.url))

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/core/desktop_open.jsView on unpkg · L23

dist/agents/bridge.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 148

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agents/bridge.jsView on unpkg