Loading npm security reports…

@nac3/forge-cli@1.7.4: Unknown npm security report (Allow) | LPM Firewall

registry / @nac3/forge-cli / 1.7.4

@nac3/forge-cli@1.7.4

⚠ Under review

Yujin Forge -- voice-first NAC-3 React development framework. CLI + chat panel + spec ingest + 10-format document reader + voice loop.

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 32 low-signal pattern(s) were surfaced and cleared.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicense

scanned 377 file(s), 4.00 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.bitbucket.org, api.cohere.com, api.deepseek.com, api.elevenlabs.io, api.figma.com, api.github.com, api.linear.app, api.mailgun.net, api.mistral.ai, api.notion.com, api.openai.com, api.sendgrid.com, api.slack.com, api.stripe.com, api.twilio.com, api.x.ai, api.z.ai, app.mailgun.com, app.sendgrid.com, bitbucket.org, buy.polar.sh, console.anthropic.com, console.aws.amazon.com, console.cloud.google.com, console.twilio.com, dashboard.stripe.com, dashscope-intl.aliyuncs.com, developers.cloudflare.com, discord.com, docs.google.com, elevenlabs.io, fonts.googleapis.com, generativelanguage.googleapis.com, github.com, gitlab.com, hub.docker.com, linear.app, platform.openai.com, prompts.yujin.app, pypi.org, registry.npmjs.org, schemas.openxmlformats.org, slack.com, speech.googleapis.com, texttospeech.googleapis.com, unpkg.com, upload.pypi.org, www.figma.com

Source & flagged code

23 flagged

dist/codegen/e2e.jsView file

Lines 370-410javascript

370}

371export function emitCypress(plan, opts) {

372 const baseUrl = (opts?.baseUrl || plan.page_url_token).replace(/\/$/, '');

373 const fixtures = plan.fixtures || {};

374 const body = [

375 '/* Auto-generated by Yujin Forge -- e2e test corpus.',

376 ' * Plugin: ' + plan.plugin,

377 ' * Surface coverage: ' + plan.exercised_elements + ' / ' + plan.total_elements + ' manifest elements.',

378 ' * Framework: Cypress. Re-generate with: yf gen-tests <dir> --framework cypress',

379 ' * H1.v3: each test that needs dynamic-route data CREATEs the',

380 ' * resource via API in beforeEach + DELETEs in afterEach so the',

381 ' * suite is reproducible from a clean DB. Seed is deterministic',

382 ' * (test index), never random.',

383 ' */',

384 "const BASE_URL = Cypress.env('FORGE_E2E_BASE_URL') || '" + baseUrl + "';",

385 "/* H1.v4: Router kind from manifest. 'hash' -> cy.visit prefixes",

386 " the route with '#' so SPA hash router engages. */",

387 "const ROUTER_KIND = '" + (plan.router_kind || 'browser') + "';",

388 "const FORGE_TEST_USER = Cypress.env('FORGE_TEST_USER') || {",

389 " email: 'forge-e2e@yujin.app',",

390 " password: 'forge-e2e-2026',",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/codegen/e2e.jsView on unpkg · L390

391 " username: 'forge_e2e'",

392 "};",

393 "/* H1.v6 item 4 -- secondary user for multi-user fixtures.",

394 " Verbs like follow_author / favorite_article require the viewer",

395 " to differ from the author. This second user authors fixtures",

396 " that the primary test user then interacts with. Deterministic",

397 " credentials, idempotent registration. */",

398 "const FORGE_TEST_USER2 = Cypress.env('FORGE_TEST_USER2') || {",

399 " email: 'forge-e2e-other@yujin.app',",

400 " password: 'forge-e2e-2026',",

401 " username: 'forge_e2e_other'",

402 "};",

403 "",

404 "function ensureTestUser(user) {",

405 " /* Idempotent: register if absent, ignore conflict. */",

406 " cy.request({",

407 " method: 'POST',",

408 " url: BASE_URL + '/api/users',",

409 " body: { user: user || FORGE_TEST_USER },",

410 " failOnStatusCode: false,",

400patternName = generic_password severity = medium line = 400

Medium

Secret Pattern

Hardcoded password in dist/codegen/e2e.js

dist/codegen/e2e.jsView on unpkg · L400

dist/chat/project_slug.jsView file

Lines 58-98javascript

58 }

59 catch { /* fall through */ }

60 /* 2. package.json.name */

61 try {

62 const raw = await fs.readFile(path.join

dist/chat/instance_lock.jsView file

Lines 13-53javascript

13 * - release() removes the file only if we still own it.

14 * - Headless sub-sessions (agentMode) and the test harness bypass the lock

15 * at the caller; this module only

dist/commands/app.jsView file

Lines 83-123javascript

83 .action(async (fileKey, nodeId, opts) => {

84 await figmaExport(fileKey, nodeId, opts);

85 });

86}

87/* =========================================================

dist/chat/server.jsView file

Lines 4096-4136javascript

4096 if (!built.ok || !built.qr) {

4097 sendJson(res, 200, { ok: false, error: built.error ?? 'no pude generar el pairing', hint: built.hint });

4098 return;

4099

dist/core/desktop_open.jsView file

Lines 3-43javascript

3 *

4 * .xlsx/.xls/.csv -> Excel (or the system spreadsheet app)

5 * .docx/.doc -> Word

6 * .pdf -> the

dist/agents/bridge.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 149

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agents/bridge.jsView on unpkg

dist/core/cf_tunnel.jsView file

•matchType = normalized_sha256 matchedPackage = @nac3/forge-cli@1.3.6 matchedPath = dist/core/cf_tunnel.js matchedIdentity = npm:QG5hYzMvZm9yZ2UtY2xp:1.3.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/cf_tunnel.jsView on unpkg

dist/chat/tools/shell.jsView file

•matchType = normalized_sha256 matchedPackage = @nac3/forge-cli@1.3.6 matchedPath = dist/chat/tools/shell.js matchedIdentity = npm:QG5hYzMvZm9yZ2UtY2xp:1.3.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chat/tools/shell.jsView on unpkg

dist/commands/doctor.jsView file

•matchType = normalized_sha256 matchedPackage = @nac3/forge-cli@1.3.6 matchedPath = dist/commands/doctor.js matchedIdentity = npm:QG5hYzMvZm9yZ2UtY2xp:1.3.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/doctor.jsView on unpkg

dist/tasks/supervisor.jsView file

•matchType = normalized_sha256 matchedPackage = @nac3/forge-cli@1.3.6 matchedPath = dist/tasks/supervisor.js matchedIdentity = npm:QG5hYzMvZm9yZ2UtY2xp:1.3.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tasks/supervisor.jsView on unpkg

dist/chat/tool_status.jsView file

•matchType = normalized_sha256 matchedPackage = @nac3/forge-cli@1.3.6 matchedPath = dist/chat/tool_status.js matchedIdentity = npm:QG5hYzMvZm9yZ2UtY2xp:1.3.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chat/tool_status.jsView on unpkg

dist/chat/tools/db_query.jsView file

•matchType = normalized_sha256 matchedPackage = @nac3/forge-cli@1.3.6 matchedPath = dist/chat/tools/db_query.js matchedIdentity = npm:QG5hYzMvZm9yZ2UtY2xp:1.3.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chat/tools/db_query.jsView on unpkg

dist/chat/tools/git.jsView file

•matchType = normalized_sha256 matchedPackage = @nac3/forge-cli@1.3.6 matchedPath = dist/chat/tools/git.js matchedIdentity = npm:QG5hYzMvZm9yZ2UtY2xp:1.3.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chat/tools/git.jsView on unpkg

dist/chat/tools/misc_verbs.jsView file

•matchType = normalized_sha256 matchedPackage = @nac3/forge-cli@1.3.6 matchedPath = dist/chat/tools/misc_verbs.js matchedIdentity = npm:QG5hYzMvZm9yZ2UtY2xp:1.3.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chat/tools/misc_verbs.jsView on unpkg

dist/chat/tools/session_verbs.jsView file

•matchType = normalized_sha256 matchedPackage = @nac3/forge-cli@1.3.6 matchedPath = dist/chat/tools/session_verbs.js matchedIdentity = npm:QG5hYzMvZm9yZ2UtY2xp:1.3.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chat/tools/session_verbs.jsView on unpkg

dist/commands/repo.jsView file

•matchType = normalized_sha256 matchedPackage = @nac3/forge-cli@1.3.6 matchedPath = dist/commands/repo.js matchedIdentity = npm:QG5hYzMvZm9yZ2UtY2xp:1.3.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/repo.jsView on unpkg

dist/core/repo_state.jsView file

•matchType = normalized_sha256 matchedPackage = @nac3/forge-cli@1.3.6 matchedPath = dist/core/repo_state.js matchedIdentity = npm:QG5hYzMvZm9yZ2UtY2xp:1.3.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/repo_state.jsView on unpkg

dist/pending/store.jsView file

•matchType = normalized_sha256 matchedPackage = @nac3/forge-cli@1.3.6 matchedPath = dist/pending/store.js matchedIdentity = npm:QG5hYzMvZm9yZ2UtY2xp:1.3.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/pending/store.jsView on unpkg

Source & flagged code

23 flagged · loading source

dist/codegen/e2e.jsView file

390patternName = generic_password severity = medium line = 390

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/codegen/e2e.jsView on unpkg · L390

400patternName = generic_password severity = medium line = 400

Medium

Secret Pattern

Hardcoded password in dist/codegen/e2e.js

dist/codegen/e2e.jsView on unpkg · L400

dist/chat/project_slug.jsView file

78/* eslint-disable @typescript-eslint/no-require-imports */ L79: const fsSync = require('node:fs'); L80: try {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chat/project_slug.jsView on unpkg · L78

dist/chat/instance_lock.jsView file

33const r = path.resolve(root); L34: return process.platform === 'win32' ? r.toLowerCase() : r; L35: } ... L56: try { L57: const h = JSON.parse(readFileSync(p, 'utf-8')); L58: if (h && typeof h.pid === 'number') ... L112: + ' ' + holder.root + '\n' L113: + ' (PID ' + holder.pid + ', panel en http://127.0.0.1:' + holder.port + ')\n\n' L114: + 'Abri esa instancia, o abri Forge en OTRA carpeta. Si estas seguro de que\n'

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chat/instance_lock.jsView on unpkg · L33

dist/commands/app.jsView file

103return missingSlot(opts, 'slack_bot_token'); L104: const r = await fetch('https://slack.com/api/chat.postMessage', { L105: method: 'POST', ... L110: }, L111: body: JSON.stringify({ channel, text: message }), L112: }); ... L135: } L136: const from = opts.from ?? process.env.TWILIO_FROM ?? ''; L137: if (!from) { ... L140: const url = 'https://api.twilio.com/2010-04-01/Accounts/' + sid + '/Messages.json'; L141: const auth = Buffer.from(sid + ':' + token).toString('base64'); L142: const body = new URLSearchParams({ To: to, From: from, Body: message });

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/commands/app.jsView on unpkg · L103

103Trigger-reachable chain: manifest.bin -> dist/bin/yf.js -> dist/commands/app.js L103: return missingSlot(opts, 'slack_bot_token'); L104: const r = await fetch('https://slack.com/api/chat.postMessage', { L105: method: 'POST', ... L110: }, L111: body: JSON.stringify({ channel, text: message }), L112: }); ... L135: } L136: const from = opts.from ?? process.env.TWILIO_FROM ?? ''; L137: if (!from) { ... L140: const url = 'https://api.twilio.com/2010-04-01/Accounts/' + sid + '/Messages.json'; L141: const auth = Buffer.from(sid + ':' + token).toString('base64'); L142: const body = new URLSearchParams({ To: to, From: from, Body: message });

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/commands/app.jsView on unpkg · L103

103Trigger-reachable credential exfiltration chain: manifest.bin -> dist/bin/yf.js -> dist/commands/app.js L103: return missingSlot(opts, 'slack_bot_token'); L104: const r = await fetch('https://slack.com/api/chat.postMessage', { L105: method: 'POST', ... L110: }, L111: body: JSON.stringify({ channel, text: message }), L112: }); ... L135: } L136: const from = opts.from ?? process.env.TWILIO_FROM ?? ''; L137: if (!from) { ... L140: const url = 'https://api.twilio.com/2010-04-01/Accounts/' + sid + '/Messages.json'; L141: const auth = Buffer.from(sid + ':' + token).toString('base64'); L142: const body = new URLSearchParams({ To: to, From: from, Body: message });

dist/chat/server.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/chat/server.js: * leak the API key + the project source-aware system prompt. if (!opts.agentMode && !opts.claude && !opts.allowDuplicateRoot) { * Tests inject `opts.claude` directly and bypass this branch. */ cliOpts['timeoutMs'] = (await readLimitsConfig()).claude_cli_timeout_ms; let claude = opts.claude ?? await buildClaudeClient(activeChatProvider); if (opts.claude) if (!opts.claude && activeChatProvider === 'claude-code-cli') { await handleWriteFile(req, res, ctx);

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/chat/server.jsView on unpkg

4116package = @nac3/forge-cli; repositoryIdentity = yujin-forge; dependency = qrcode L4116: catch { /* best-effort */ } L4117: const QRCode = (await import('qrcode')).default; L4118: /* PND-047 follow-up -- the pairing payload grew (the per-handle key is

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/chat/server.jsView on unpkg · L4116

dist/core/desktop_open.jsView file

23*/ L24: import { spawn } from 'node:child_process'; L25: import { existsSync, readFileSync } from 'node:fs'; ... L46: function shellOpen(target) { L47: if (process.platform === 'win32') { L48: /* cmd start: the first quoted arg is the window TITLE (empty), then ... L60: return process.platform === 'linux' L61: && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY; L62: } ... L74: try { L75: const j = JSON.parse(readFileSync(absPath, 'utf-8')); L76: if (j.url && /^https?:\/\//i.test(j.url))

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/core/desktop_open.jsView on unpkg · L23

dist/agents/bridge.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 149

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agents/bridge.jsView on unpkg

dist/core/cf_tunnel.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/cf_tunnel.jsView on unpkg

dist/chat/tools/shell.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chat/tools/shell.jsView on unpkg

dist/commands/doctor.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/doctor.jsView on unpkg

dist/tasks/supervisor.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tasks/supervisor.jsView on unpkg

dist/chat/tool_status.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chat/tool_status.jsView on unpkg

dist/chat/tools/db_query.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chat/tools/db_query.jsView on unpkg

dist/chat/tools/git.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chat/tools/git.jsView on unpkg

dist/chat/tools/misc_verbs.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chat/tools/misc_verbs.jsView on unpkg

dist/chat/tools/session_verbs.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chat/tools/session_verbs.jsView on unpkg

dist/commands/repo.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/repo.jsView on unpkg

dist/core/repo_state.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/repo_state.jsView on unpkg

dist/pending/store.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/pending/store.jsView on unpkg

Source & flagged code

23 flagged

dist/codegen/e2e.jsView file

Lines 370-410javascript

370}

371export function emitCypress(plan, opts) {

372 const baseUrl = (opts?.baseUrl || plan.page_url_token).replace(/\/$/, '');

373 const fixtures = plan.fixtures || {};

374 const body = [

375 '/* Auto-generated by Yujin Forge -- e2e test corpus.',

376 ' * Plugin: ' + plan.plugin,

377 ' * Surface coverage: ' + plan.exercised_elements + ' / ' + plan.total_elements + ' manifest elements.',

378 ' * Framework: Cypress. Re-generate with: yf gen-tests <dir> --framework cypress',

379 ' * H1.v3: each test that needs dynamic-route data CREATEs the',

380 ' * resource via API in beforeEach + DELETEs in afterEach so the',

381 ' * suite is reproducible from a clean DB. Seed is deterministic',

382 ' * (test index), never random.',

383 ' */',

384 "const BASE_URL = Cypress.env('FORGE_E2E_BASE_URL') || '" + baseUrl + "';",

385 "/* H1.v4: Router kind from manifest. 'hash' -> cy.visit prefixes",

386 " the route with '#' so SPA hash router engages. */",

387 "const ROUTER_KIND = '" + (plan.router_kind || 'browser') + "';",

388 "const FORGE_TEST_USER = Cypress.env('FORGE_TEST_USER') || {",

389 " email: 'forge-e2e@yujin.app',",

390 " password: 'forge-e2e-2026',",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/codegen/e2e.jsView on unpkg · L390

391 " username: 'forge_e2e'",

392 "};",

393 "/* H1.v6 item 4 -- secondary user for multi-user fixtures.",

394 " Verbs like follow_author / favorite_article require the viewer",

395 " to differ from the author. This second user authors fixtures",

396 " that the primary test user then interacts with. Deterministic",

397 " credentials, idempotent registration. */",

398 "const FORGE_TEST_USER2 = Cypress.env('FORGE_TEST_USER2') || {",

399 " email: 'forge-e2e-other@yujin.app',",

400 " password: 'forge-e2e-2026',",

401 " username: 'forge_e2e_other'",

402 "};",

403 "",

404 "function ensureTestUser(user) {",

405 " /* Idempotent: register if absent, ignore conflict. */",

406 " cy.request({",

407 " method: 'POST',",

408 " url: BASE_URL + '/api/users',",

409 " body: { user: user || FORGE_TEST_USER },",

410 " failOnStatusCode: false,",

400patternName = generic_password severity = medium line = 400

Medium

Secret Pattern

Hardcoded password in dist/codegen/e2e.js

dist/codegen/e2e.jsView on unpkg · L400

dist/chat/project_slug.jsView file

Lines 58-98javascript

58 }

59 catch { /* fall through */ }

60 /* 2. package.json.name */

61 try {

62 const raw = await fs.readFile(path.join

dist/chat/instance_lock.jsView file

Lines 13-53javascript

13 * - release() removes the file only if we still own it.

14 * - Headless sub-sessions (agentMode) and the test harness bypass the lock

15 * at the caller; this module only

dist/commands/app.jsView file

Lines 83-123javascript

83 .action(async (fileKey, nodeId, opts) => {

84 await figmaExport(fileKey, nodeId, opts);

85 });

86}

87/* =========================================================

dist/chat/server.jsView file

Lines 4096-4136javascript

4096 if (!built.ok || !built.qr) {

4097 sendJson(res, 200, { ok: false, error: built.error ?? 'no pude generar el pairing', hint: built.hint });

4098 return;

4099

dist/core/desktop_open.jsView file

Lines 3-43javascript

3 *

4 * .xlsx/.xls/.csv -> Excel (or the system spreadsheet app)

5 * .docx/.doc -> Word

6 * .pdf -> the

dist/agents/bridge.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 149

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agents/bridge.jsView on unpkg

dist/core/cf_tunnel.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/cf_tunnel.jsView on unpkg

dist/chat/tools/shell.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chat/tools/shell.jsView on unpkg

dist/commands/doctor.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/doctor.jsView on unpkg

dist/tasks/supervisor.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tasks/supervisor.jsView on unpkg

dist/chat/tool_status.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chat/tool_status.jsView on unpkg

dist/chat/tools/db_query.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chat/tools/db_query.jsView on unpkg

dist/chat/tools/git.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chat/tools/git.jsView on unpkg

dist/chat/tools/misc_verbs.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chat/tools/misc_verbs.jsView on unpkg

dist/chat/tools/session_verbs.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chat/tools/session_verbs.jsView on unpkg

dist/commands/repo.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/repo.jsView on unpkg

dist/core/repo_state.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/repo_state.jsView on unpkg

dist/pending/store.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/pending/store.jsView on unpkg

@nac3/forge-cli@1.7.4

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code