registry / @nac3/forge-cli / 1.2.5

@nac3/forge-cli@1.2.5

Yujin Forge -- voice-first NAC-3 React development framework. CLI + chat panel + spec ingest + 10-format document reader + voice loop.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Run the yf chat workflow with a paired mobile device, or invoke a panel artifact action.

Impact

Activity payloads and bearer authentication reach the relay; generated content can create or overwrite project documentation.

Mechanism

Paired-device event relay and agent-originated project document persistence.

AI rationale

The package has no automatic npm install lifecycle hook, and the inspected credentialed API call is tied to an explicit CLI command. However, automatic pairing-gated relay behavior and server-side project writes leave a meaningful capability risk that cannot be treated as clean under incomplete static coverage.

Evidence

dist/chat/server.jsdist/relay/relay_client.jsdist/chat/board_artifacts.jsdist/commands/app.jsdocs/<slug>.html|mddocs/flows/<slug>.svgdocs/flows/<slug>.bpmn.json~/.yujin-forge/bridge/bridge.json

Network endpoints2

yujin-hito4.yujinapp.workers.dev/v1/relay/<handle>slack.com/api/chat.postMessage

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The CLI automatically enables a mobile relay after a phone has been paired.
The relay posts event payloads and bearer authentication to a fixed external worker.
Chat-panel actions persist generated documents into the current project.
The CLI can send vault-held service credentials to third-party APIs for requested actions.

Evidence against

package.json has no npm preinstall, install, or postinstall hook.
The relay is gated by pairing or an explicit environment override.
The external app request shown is an explicit Slack notify command, not background credential collection.
The native opener restricts URLs to HTTP(S) and blocks project-path escapes and executable extensions.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicense

scanned 373 file(s), 3.87 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.bitbucket.org, api.cohere.com, api.deepseek.com, api.elevenlabs.io, api.figma.com, api.github.com, api.linear.app, api.mailgun.net, api.mistral.ai, api.notion.com, api.openai.com, api.sendgrid.com, api.slack.com, api.stripe.com, api.twilio.com, api.x.ai, api.z.ai, app.mailgun.com, app.sendgrid.com, bitbucket.org, buy.polar.sh, console.anthropic.com, console.aws.amazon.com, console.cloud.google.com, console.twilio.com, dashboard.stripe.com, dashscope-intl.aliyuncs.com, developers.cloudflare.com, discord.com, docs.google.com, elevenlabs.io, fonts.googleapis.com, generativelanguage.googleapis.com, github.com, gitlab.com, hub.docker.com, linear.app, platform.openai.com, prompts.yujin.app, pypi.org, registry.npmjs.org, schemas.openxmlformats.org, slack.com, speech.googleapis.com, texttospeech.googleapis.com, unpkg.com, upload.pypi.org, www.figma.com

Source & flagged code

12 flagged

dist/codegen/e2e.jsView file

Lines 370-410javascript

370}

371export function emitCypress(plan, opts) {

372 const baseUrl = (opts?.baseUrl || plan.page_url_token).replace(/\/$/, '');

373 const fixtures = plan.fixtures || {};

374 const body = [

375 '/* Auto-generated by Yujin Forge -- e2e test corpus.',

376 ' * Plugin: ' + plan.plugin,

377 ' * Surface coverage: ' + plan.exercised_elements + ' / ' + plan.total_elements + ' manifest elements.',

378 ' * Framework: Cypress. Re-generate with: yf gen-tests <dir> --framework cypress',

379 ' * H1.v3: each test that needs dynamic-route data CREATEs the',

380 ' * resource via API in beforeEach + DELETEs in afterEach so the',

381 ' * suite is reproducible from a clean DB. Seed is deterministic',

382 ' * (test index), never random.',

383 ' */',

384 "const BASE_URL = Cypress.env('FORGE_E2E_BASE_URL') || '" + baseUrl + "';",

385 "/* H1.v4: Router kind from manifest. 'hash' -> cy.visit prefixes",

386 " the route with '#' so SPA hash router engages. */",

387 "const ROUTER_KIND = '" + (plan.router_kind || 'browser') + "';",

388 "const FORGE_TEST_USER = Cypress.env('FORGE_TEST_USER') || {",

389 " email: 'forge-e2e@yujin.app',",

390 " password: 'forge-e2e-2026',",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/codegen/e2e.jsView on unpkg · L390

391 " username: 'forge_e2e'",

392 "};",

393 "/* H1.v6 item 4 -- secondary user for multi-user fixtures.",

394 " Verbs like follow_author / favorite_article require the viewer",

395 " to differ from the author. This second user authors fixtures",

396 " that the primary test user then interacts with. Deterministic",

397 " credentials, idempotent registration. */",

398 "const FORGE_TEST_USER2 = Cypress.env('FORGE_TEST_USER2') || {",

399 " email: 'forge-e2e-other@yujin.app',",

400 " password: 'forge-e2e-2026',",

401 " username: 'forge_e2e_other'",

402 "};",

403 "",

404 "function ensureTestUser(user) {",

405 " /* Idempotent: register if absent, ignore conflict. */",

406 " cy.request({",

407 " method: 'POST',",

408 " url: BASE_URL + '/api/users',",

409 " body: { user: user || FORGE_TEST_USER },",

410 " failOnStatusCode: false,",

400patternName = generic_password severity = medium line = 400

Medium

Secret Pattern

Hardcoded password in dist/codegen/e2e.js

dist/codegen/e2e.jsView on unpkg · L400

dist/chat/project_slug.jsView file

Lines 58-98javascript

58 }

59 catch { /* fall through */ }

60 /* 2. package.json.name */

61 try {

62 const raw = await fs.readFile(path.join

dist/chat/instance_lock.jsView file

Lines 13-53javascript

13 * - release() removes the file only if we still own it.

14 * - Headless sub-sessions (agentMode) and the test harness bypass the lock

15 * at the caller; this module only

dist/commands/app.jsView file

Lines 83-123javascript

83 .action(async (fileKey, nodeId, opts) => {

84 await figmaExport(fileKey, nodeId, opts);

85 });

86}

87/* =========================================================

dist/chat/server.jsView file

Lines 4033-4073javascript

4033 if (!built.ok || !built.qr) {

4034 sendJson(res, 200, { ok: false, error: built.error ?? 'no pude generar el pairing', hint: built.hint });

4035 return;

4036

dist/core/desktop_open.jsView file

Lines 3-43javascript

3 *

4 * .xlsx/.xls/.csv -> Excel (or the system spreadsheet app)

5 * .docx/.doc -> Word

6 * .pdf -> the

dist/agents/bridge.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 148

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agents/bridge.jsView on unpkg

dist/chat/board_artifacts.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @nac3/forge-cli@1.2.4 matchedIdentity = npm:QG5hYzMvZm9yZ2UtY2xp:1.2.4 similarity = 0.992 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chat/board_artifacts.jsView on unpkg

Source & flagged code

12 flagged · loading source

dist/codegen/e2e.jsView file

390patternName = generic_password severity = medium line = 390

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/codegen/e2e.jsView on unpkg · L390

400patternName = generic_password severity = medium line = 400

Medium

Secret Pattern

Hardcoded password in dist/codegen/e2e.js

dist/codegen/e2e.jsView on unpkg · L400

dist/chat/project_slug.jsView file

78/* eslint-disable @typescript-eslint/no-require-imports */ L79: const fsSync = require('node:fs'); L80: try {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chat/project_slug.jsView on unpkg · L78

dist/chat/instance_lock.jsView file

33const r = path.resolve(root); L34: return process.platform === 'win32' ? r.toLowerCase() : r; L35: } ... L56: try { L57: const h = JSON.parse(readFileSync(p, 'utf-8')); L58: if (h && typeof h.pid === 'number') ... L112: + ' ' + holder.root + '\n' L113: + ' (PID ' + holder.pid + ', panel en http://127.0.0.1:' + holder.port + ')\n\n' L114: + 'Abri esa instancia, o abri Forge en OTRA carpeta. Si estas seguro de que\n'

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chat/instance_lock.jsView on unpkg · L33

dist/commands/app.jsView file

103return missingSlot(opts, 'slack_bot_token'); L104: const r = await fetch('https://slack.com/api/chat.postMessage', { L105: method: 'POST', ... L110: }, L111: body: JSON.stringify({ channel, text: message }), L112: }); ... L135: } L136: const from = opts.from ?? process.env.TWILIO_FROM ?? ''; L137: if (!from) { ... L140: const url = 'https://api.twilio.com/2010-04-01/Accounts/' + sid + '/Messages.json'; L141: const auth = Buffer.from(sid + ':' + token).toString('base64'); L142: const body = new URLSearchParams({ To: to, From: from, Body: message });

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/commands/app.jsView on unpkg · L103

103Trigger-reachable chain: manifest.bin -> dist/bin/yf.js -> dist/commands/app.js L103: return missingSlot(opts, 'slack_bot_token'); L104: const r = await fetch('https://slack.com/api/chat.postMessage', { L105: method: 'POST', ... L110: }, L111: body: JSON.stringify({ channel, text: message }), L112: }); ... L135: } L136: const from = opts.from ?? process.env.TWILIO_FROM ?? ''; L137: if (!from) { ... L140: const url = 'https://api.twilio.com/2010-04-01/Accounts/' + sid + '/Messages.json'; L141: const auth = Buffer.from(sid + ':' + token).toString('base64'); L142: const body = new URLSearchParams({ To: to, From: from, Body: message });

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/commands/app.jsView on unpkg · L103

103Trigger-reachable credential exfiltration chain: manifest.bin -> dist/bin/yf.js -> dist/commands/app.js L103: return missingSlot(opts, 'slack_bot_token'); L104: const r = await fetch('https://slack.com/api/chat.postMessage', { L105: method: 'POST', ... L110: }, L111: body: JSON.stringify({ channel, text: message }), L112: }); ... L135: } L136: const from = opts.from ?? process.env.TWILIO_FROM ?? ''; L137: if (!from) { ... L140: const url = 'https://api.twilio.com/2010-04-01/Accounts/' + sid + '/Messages.json'; L141: const auth = Buffer.from(sid + ':' + token).toString('base64'); L142: const body = new URLSearchParams({ To: to, From: from, Body: message });

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/commands/app.jsView on unpkg · L103

dist/chat/server.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/chat/server.js: * leak the API key + the project source-aware system prompt. if (!opts.agentMode && !opts.claude && !opts.allowDuplicateRoot) { * Tests inject `opts.claude` directly and bypass this branch. */ cliOpts['timeoutMs'] = (await readLimitsConfig()).claude_cli_timeout_ms; let claude = opts.claude ?? await buildClaudeClient(activeChatProvider); if (opts.claude) if (!opts.claude && activeChatProvider === 'claude-code-cli') { await handleWriteFile(req, res, ctx);

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/chat/server.jsView on unpkg

4053package = @nac3/forge-cli; repositoryIdentity = yujin-forge; dependency = qrcode L4053: catch { /* best-effort */ } L4054: const QRCode = (await import('qrcode')).default; L4055: /* PND-047 follow-up -- the pairing payload grew (the per-handle key is

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/chat/server.jsView on unpkg · L4053

dist/core/desktop_open.jsView file

23*/ L24: import { spawn } from 'node:child_process'; L25: import { existsSync, readFileSync } from 'node:fs'; ... L46: function shellOpen(target) { L47: if (process.platform === 'win32') { L48: /* cmd start: the first quoted arg is the window TITLE (empty), then ... L60: return process.platform === 'linux' L61: && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY; L62: } ... L74: try { L75: const j = JSON.parse(readFileSync(absPath, 'utf-8')); L76: if (j.url && /^https?:\/\//i.test(j.url))

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/core/desktop_open.jsView on unpkg · L23

dist/agents/bridge.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 148

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agents/bridge.jsView on unpkg

dist/chat/board_artifacts.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chat/board_artifacts.jsView on unpkg

Findings

3 Critical5 High6 Medium8 Low

CriticalCredential Exfiltrationdist/commands/app.js

CriticalTrigger Reachable Dangerous Capabilitydist/commands/app.js

CriticalPrevious Version Dangerous Deltadist/chat/board_artifacts.js

HighCredential Redirect Persistencedist/chat/server.js

HighSandbox Evasion Gated Capabilitydist/core/desktop_open.js

HighCopied Package Dependency Bridgedist/chat/server.js

HighTrigger Reachable Credential Exfiltrationdist/commands/app.js

HighSemantic Analysis Limiteddist/agents/bridge.js

MediumSecret Patterndist/codegen/e2e.js

MediumDynamic Requiredist/chat/project_slug.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/codegen/e2e.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/chat/instance_lock.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @nac3/forge-cli@1.2.5.

See version security history for other recorded verdicts.

Review the evidence and your use of @nac3/forge-cli@1.2.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-07 21:38:10.223Z (UTC).