registry / forgedock / 1.1.1

forgedock@1.1.1

Autonomous dev pipeline for Claude Code. GitHub as institutional memory — every issue, PR, and annotation survives context resets and makes the next agent smarter.

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 15 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 29 file(s), 374 KB of source, external domains: api.anthropic.com, api.example.com, claude.com, cli.github.com, dev.to, docs.anthropic.com, git-scm.com, gitforwindows.org, github.com, gql.hashnode.com, nodejs.org

Source & flagged code

7 flagged

examples/forgedock-demo/src/db.jsView file

Lines 14-54javascript

14 { id: 1, owner: 'alice', title: 'Buy milk', body: 'Whole milk, 2 liters', secret: false },

15 { id: 2, owner: 'alice', title: 'Launch plan', body: 'Ship the demo repo', secret: true },

16 { id: 3, owner: 'bob', title: 'Gym', body: 'Leg day', secret: false },

17];

19let nextId = 4;

21function all() {

22 return notes;

23}

25function findById(id) {

26 return notes.find((n) => n.id === Number(id));

27}

29// Simulated SQL query. `whereClause` is a raw expression like "owner == 'alice'".

30// INTENTIONAL FLAW: the clause is evaluated directly, so a caller can inject

31// arbitrary expressions (e.g. "true || secret"). A real fix would use a

32// parameterized filter instead of evaluating untrusted strings.

33function query(whereClause) {

34 // eslint-disable-next-line no-new-func

35 const predicate = new Function('row', `with (row) { return (${whereClause}); }`);

36 return notes.filter((row) => {

Low

Eval

Package source references a known benign dynamic code generation pattern.

examples/forgedock-demo/src/db.jsView on unpkg · L34

37 try {

38 return predicate(row);

39 } catch {

40 return false;

41 }

42 });

43}

45function insert(note) {

46 const record = { id: nextId++, secret: false, ...note };

47 notes.push(record);

48 return record;

49}

51function remove(id) {

52 const before = notes.length;

53 notes = notes.filter((n) => n.id !== Number(id));

54 return notes.length < before;

bin/hooks/session-start.mjsView file

Lines 56-96javascript

56// forge-utils helpers — populated inside the try block to honour fail-open

57// ---------------------------------------------------------------------------

59// Declared at module scope so they are accessible from context-builder

60// functions called from within the try block. Assigned inside the try/catch

61// so that any import failure (missing file, permissions error, syntax error)

62// is caught and the hook still exits 0.

63let parseForgeYaml;

64let sanitizeContextValue;

66// ---------------------------------------------------------------------------

bin/forgedock.mjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios

3// SPDX-License-Identifier: AGPL-3.0-or-later

5import { fileURLToPath } from "url";

6import { dirname, join, relative, resolve } from "path";

7import { mkdir, lstat, readlink, readdir, unlink, readFile, writeFile } from "fs/promises";

8import {

examples/forgedock-demo/bootstrap.shView file

•path = examples/forgedock-demo/bootstrap.sh kind = build_helper sizeBytes = 4902 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/forgedock-demo/bootstrap.shView on unpkg

docs/CONFIG.mdView file

Lines 412-461markdown

412|-------|------|----------|-------------|

418| `services[].health_url`

Source & flagged code

7 flagged · loading source

examples/forgedock-demo/src/db.jsView file

34// eslint-disable-next-line no-new-func L35: const predicate = new Function('row', `with (row) { return (${whereClause}); }`); L36: return notes.filter((row) => {

Low

Eval

Package source references a known benign dynamic code generation pattern.

examples/forgedock-demo/src/db.jsView on unpkg · L34

bin/hooks/session-start.mjsView file

76// Use pathToFileURL() to convert the OS-native path to a file:// URL before L77: // passing it to dynamic import(). On Windows, join() produces backslash paths L78: // that import() rejects with ERR_UNSUPPORTED_ESM_URL_SCHEME.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/hooks/session-start.mjsView on unpkg · L76

bin/forgedock.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = forgedock@1.0.22 matchedIdentity = npm:Zm9yZ2Vkb2Nr:1.0.22 similarity = 0.842 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/forgedock.mjsView on unpkg

14} from "fs"; L15: import { execSync, execFileSync } from "child_process"; L16: import { homedir } from "os"; ... L52: const __filename = fileURLToPath(import.meta.url); L53: const __dirname = dirname(__filename); L54: const FORGE_HOME = dirname(__dirname); ... L58: // os.homedir() as the always-available fallback (no hard exit — see #744). L59: const HOME = process.env.HOME || process.env.USERPROFILE || homedir(); L60: ... L120: * Strip JSONC syntax (single-line comments, block comments, trailing commas) L121: * from a raw JSON string, returning a plain JSON string that JSON.parse() accepts. L122: *

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/forgedock.mjsView on unpkg · L14

examples/forgedock-demo/bootstrap.shView file

•path = examples/forgedock-demo/bootstrap.sh kind = build_helper sizeBytes = 4902 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/forgedock-demo/bootstrap.shView on unpkg

docs/CONFIG.mdView file

432patternName = generic_password severity = medium line = 432 matchedText = password...ord"

Medium

Secret Pattern

Hardcoded password in docs/CONFIG.md

docs/CONFIG.mdView on unpkg · L432

441patternName = generic_password severity = medium line = 441 matchedText = password...ord"

Medium

Secret Pattern

Hardcoded password in docs/CONFIG.md

docs/CONFIG.mdView on unpkg · L441

Findings

1 High8 Medium6 Low

HighPrevious Version Dangerous Deltabin/forgedock.mjs

MediumDynamic Requirebin/hooks/session-start.mjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencebin/forgedock.mjs

MediumShips Build Helperexamples/forgedock-demo/bootstrap.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterndocs/CONFIG.md

LowScripts Present

LowEvalexamples/forgedock-demo/src/db.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

7 flagged

examples/forgedock-demo/src/db.jsView file

Lines 14-54javascript

14 { id: 1, owner: 'alice', title: 'Buy milk', body: 'Whole milk, 2 liters', secret: false },

15 { id: 2, owner: 'alice', title: 'Launch plan', body: 'Ship the demo repo', secret: true },

16 { id: 3, owner: 'bob', title: 'Gym', body: 'Leg day', secret: false },

17];

19let nextId = 4;

21function all() {

22 return notes;

23}

25function findById(id) {

26 return notes.find((n) => n.id === Number(id));

27}

29// Simulated SQL query. `whereClause` is a raw expression like "owner == 'alice'".

30// INTENTIONAL FLAW: the clause is evaluated directly, so a caller can inject

31// arbitrary expressions (e.g. "true || secret"). A real fix would use a

32// parameterized filter instead of evaluating untrusted strings.

33function query(whereClause) {

34 // eslint-disable-next-line no-new-func

35 const predicate = new Function('row', `with (row) { return (${whereClause}); }`);

36 return notes.filter((row) => {

Low

Eval

Package source references a known benign dynamic code generation pattern.

examples/forgedock-demo/src/db.jsView on unpkg · L34

37 try {

38 return predicate(row);

39 } catch {

40 return false;

41 }

42 });

43}

45function insert(note) {

46 const record = { id: nextId++, secret: false, ...note };

47 notes.push(record);

48 return record;

49}

51function remove(id) {

52 const before = notes.length;

53 notes = notes.filter((n) => n.id !== Number(id));

54 return notes.length < before;

bin/hooks/session-start.mjsView file

Lines 56-96javascript

56// forge-utils helpers — populated inside the try block to honour fail-open

57// ---------------------------------------------------------------------------

59// Declared at module scope so they are accessible from context-builder

60// functions called from within the try block. Assigned inside the try/catch

61// so that any import failure (missing file, permissions error, syntax error)

62// is caught and the hook still exits 0.

63let parseForgeYaml;

64let sanitizeContextValue;

66// ---------------------------------------------------------------------------

bin/forgedock.mjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios

3// SPDX-License-Identifier: AGPL-3.0-or-later

5import { fileURLToPath } from "url";

6import { dirname, join, relative, resolve } from "path";

7import { mkdir, lstat, readlink, readdir, unlink, readFile, writeFile } from "fs/promises";

8import {

examples/forgedock-demo/bootstrap.shView file

•path = examples/forgedock-demo/bootstrap.sh kind = build_helper sizeBytes = 4902 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/forgedock-demo/bootstrap.shView on unpkg

docs/CONFIG.mdView file

Lines 412-461markdown

412|-------|------|----------|-------------|

418| `services[].health_url`