registry / forjajs / 1.1.5

forjajs@1.1.5

Forja — framework CLI-first de orquestração multiagente, memória hierárquica e geração de projetos com IA

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 171 file(s), 434 KB of source, external domains: cdn.tailwindcss.com, github.com

Source & flagged code

6 flagged

bin/forja.mjsView file

Lines 1-36javascript

1#!/usr/bin/env node

3/**

4 * bin/forja.mjs — core executivo do Forja (ADR-0020).

5 *

6 * Ponto de entrada único dos comandos de processo:

7 * forja <comando> [args]

8 *

9 * Responsabilidades transversais:

10 * 1. Roteamento via lib/core/registry.mjs (declarativo).

11 * 2. Gates antes do alvo (workspace, ADR-0019).

12 * 3. Trilha de auditoria append-only em .context/forja-runs.jsonl.

13 */

15import fs from 'node:fs';

16import path from 'node:path';

17import { spawnSync } from 'node:child_process';

18import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

bin/forja.mjsView on unpkg · L16

19import { COMMANDS, DOMAINS } from '../lib/core/registry.mjs';

20import { getWorkspaceInfo, getWorkspaceContextDir } from '../lib/workspace.mjs';

22const __dirname = path.dirname(fileURLToPath(import.meta.url));

23const root = path.resolve(__dirname, '..');

25function printHelp() {

26 console.log('Forja — core executivo (ADR-0020)');

27 console.log('Uso: forja <comando> [args]\n');

28 const byDomain = new Map();

29 for (const [name, cmd] of Object.entries(COMMANDS)) {

30 if (!byDomain.has(cmd.domain)) byDomain.set(cmd.domain, []);

31 byDomain.get(cmd.domain).push([name, cmd.desc]);

32 }

33 for (const [domain, label] of Object.entries(DOMAINS)) {

34 const entries = byDomain.get(domain);

35 if (!entries) continue;

36 console.log(`${label}:`);

lib/core/release.mjsView file

Lines 244-284javascript

244const importsResolve = {

245 id: 'imports-resolve',

246 title: 'imports relativos resolvem dentro do tarball',

247 severity: 'critical',

248 dependsOn: 'install',

249 probe(env) {

250 const quebrados

scripts/hook-user-prompt.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

2/**

3 * Hook UserPromptSubmit — injeção opcional de smart-context.

4 *

5 * Protocolo:

6 * - stdin: JSON com { prompt, session_id, ... }

7 * - stdout: JSON com { hookSpecificOutput: { hookEventName, additionalContext } } ou vazio

8 *

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/hook-user-prompt.mjsView on unpkg · L6

9 * Dois caminhos de injeção:

10 * 1. Slug de spec detectado no prompt (specs/<slug>/ existe) → injeta pack

scripts/hook-session-start.mjsView file

Lines 27-67javascript

28function safeReadDir(p) { try { return fs.readdirSync(p); } catch { return []; } }

30function listSpecs() {

31 const specsDir = path.join(root, 'specs');

scripts/tools-doctor.mjsView file

Lines 1-40javascript

1#!/usr/bin/env node

2/**

3 * tools-doctor — raio-x do núcleo (SPEC-009) e das ferramentas de processo (ADR-0018).

4 *

5 * Duas seções, dois contratos distintos:

6 *

7 * Núcleo O que impede o framework de trabalhar. Falha crítica → exit 1.

8 * Ferramentas Binários opcionais que potencializam o harness. Ausência nunca trava.

9 *

10 * A separação é o ponto. Este comando auditava só as ferramentas — sobre as quais ele mesmo

11 * dizia "o fluxo nunca trava por elas" — e era cego para tudo que trava. Quando o better-sqlite3

scripts/pre-commit.shView file

•path = scripts/pre-commit.sh kind = build_helper sizeBytes = 4414 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/pre-commit.shView on unpkg

Source & flagged code

6 flagged · loading source

bin/forja.mjsView file

16import path from 'node:path'; L17: import { spawnSync } from 'node:child_process'; L18: import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

bin/forja.mjsView on unpkg · L16

lib/core/release.mjsView file

264status: 'fail', L265: detail: `${quebrados.length} import(s) sem destino no tarball: ${quebrados.slice(0, 3).join('; ')}`, L266: fix: 'adicione o arquivo ao files[] do package.json',

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/core/release.mjsView on unpkg · L264

scripts/hook-user-prompt.mjsView file

6* - stdin: JSON com { prompt, session_id, ... } L7: * - stdout: JSON com { hookSpecificOutput: { hookEventName, additionalContext } } ou vazio L8: * ... L29: const __filename = fileURLToPath(import.meta.url); L30: const __dirname = path.dirname(__filename); L31: const root = path.resolve(__dirname, '..'); ... L52: try { L53: const cfg = JSON.parse(fs.readFileSync(path.join(root, '.memoryrc.json'), 'utf8')); L54: return cfg.hooks || {}; ... L58: function keywordTriggered(prompt) { L59: if (process.env.FRAMEWORK_HOOK_INJECT !== '1') return false; L60: if (!prompt) return false;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/hook-user-prompt.mjsView on unpkg · L6

scripts/hook-session-start.mjsView file

47package = forjajs; repositoryIdentity = forja; dependency = better-sqlite3 L47: const { getWorkspaceDbPath } = await import('../lib/workspace.mjs'); L48: const { default: Database } = await import('better-sqlite3'); L49: const db = new Database(getWorkspaceDbPath(), { readonly: true });

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

scripts/hook-session-start.mjsView on unpkg · L47

scripts/tools-doctor.mjsView file

20L21: import { spawnSync } from 'node:child_process'; L22: ... L29: role: 'Code intelligence: chamadores, blast radius, mapa de impacto (ADR-0017).', L30: install: 'npm i -g @codegraph/cli', L31: gate: 'npm run code:check / code:impact',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/tools-doctor.mjsView on unpkg · L20

scripts/pre-commit.shView file

•path = scripts/pre-commit.sh kind = build_helper sizeBytes = 4414 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/pre-commit.shView on unpkg

Findings

4 High5 Medium6 Low

HighChild Processbin/forja.mjs

HighShell

HighCopied Package Dependency Bridgescripts/hook-session-start.mjs

HighRuntime Package Installscripts/tools-doctor.mjs

MediumDynamic Requirelib/core/release.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/pre-commit.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptoscripts/hook-user-prompt.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

bin/forja.mjsView file

Lines 1-36javascript

1#!/usr/bin/env node

3/**

4 * bin/forja.mjs — core executivo do Forja (ADR-0020).

5 *

6 * Ponto de entrada único dos comandos de processo:

7 * forja <comando> [args]

8 *

9 * Responsabilidades transversais:

10 * 1. Roteamento via lib/core/registry.mjs (declarativo).

11 * 2. Gates antes do alvo (workspace, ADR-0019).

12 * 3. Trilha de auditoria append-only em .context/forja-runs.jsonl.

13 */

15import fs from 'node:fs';

16import path from 'node:path';

17import { spawnSync } from 'node:child_process';

18import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

bin/forja.mjsView on unpkg · L16

19import { COMMANDS, DOMAINS } from '../lib/core/registry.mjs';

20import { getWorkspaceInfo, getWorkspaceContextDir } from '../lib/workspace.mjs';

22const __dirname = path.dirname(fileURLToPath(import.meta.url));

23const root = path.resolve(__dirname, '..');

25function printHelp() {

26 console.log('Forja — core executivo (ADR-0020)');

27 console.log('Uso: forja <comando> [args]\n');

28 const byDomain = new Map();

29 for (const [name, cmd] of Object.entries(COMMANDS)) {

30 if (!byDomain.has(cmd.domain)) byDomain.set(cmd.domain, []);

31 byDomain.get(cmd.domain).push([name, cmd.desc]);

32 }

33 for (const [domain, label] of Object.entries(DOMAINS)) {

34 const entries = byDomain.get(domain);

35 if (!entries) continue;

36 console.log(`${label}:`);

lib/core/release.mjsView file

Lines 244-284javascript

244const importsResolve = {

245 id: 'imports-resolve',

246 title: 'imports relativos resolvem dentro do tarball',

247 severity: 'critical',

248 dependsOn: 'install',

249 probe(env) {

250 const quebrados

scripts/hook-user-prompt.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

2/**

3 * Hook UserPromptSubmit — injeção opcional de smart-context.

4 *

5 * Protocolo:

6 * - stdin: JSON com { prompt, session_id, ... }

7 * - stdout: JSON com { hookSpecificOutput: { hookEventName, additionalContext } } ou vazio

8 *

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/hook-user-prompt.mjsView on unpkg · L6

9 * Dois caminhos de injeção:

10 * 1. Slug de spec detectado no prompt (specs/<slug>/ existe) → injeta pack

scripts/hook-session-start.mjsView file

Lines 27-67javascript

28function safeReadDir(p) { try { return fs.readdirSync(p); } catch { return []; } }

30function listSpecs() {

31 const specsDir = path.join(root, 'specs');

scripts/tools-doctor.mjsView file

Lines 1-40javascript

1#!/usr/bin/env node

2/**

3 * tools-doctor — raio-x do núcleo (SPEC-009) e das ferramentas de processo (ADR-0018).

4 *

5 * Duas seções, dois contratos distintos:

6 *

7 * Núcleo O que impede o framework de trabalhar. Falha crítica → exit 1.

8 * Ferramentas Binários opcionais que potencializam o harness. Ausência nunca trava.

9 *

10 * A separação é o ponto. Este comando auditava só as ferramentas — sobre as quais ele mesmo

11 * dizia "o fluxo nunca trava por elas" — e era cego para tudo que trava. Quando o better-sqlite3

scripts/pre-commit.shView file

•path = scripts/pre-commit.sh kind = build_helper sizeBytes = 4414 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/pre-commit.shView on unpkg