registry / AI-agent control-surface risk / job-forge

job-forge

AI-powered job search pipeline for Codex and OpenCode

This report shows the evidence for job-forge@2.14.56. 4 of 8 known versions are blocked or flagged. The newest version, 2.14.70, is flagged. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

Source inspection confirms concrete postinstall mutation of consumer AI-agent configuration across several platforms. Under the stated policy, this requires blocking even though no direct exfiltration was confirmed.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation of job-forge@2.14.56

Impact

Unconsented broad AI-agent control-surface mutation and later MCP command execution.

Mechanism

postinstall symlink and configuration injection into consumer AI-agent directories

Policy narrative

At npm postinstall, bin/sync.mjs uses INIT_CWD/cwd to write into the consuming project. It installs symlinks for multiple AI-agent platforms, patches opencode.json, and applies migrations to package.json and .gitignore. The supplied MCP configurations include a Gmail MCP launched through npx -y, so a subsequent agent session can execute package-selected tooling. This is an unconsented lifecycle mutation of a broad foreign AI-agent control surface.

AI rationale

Evidence

package.jsonbin/sync.mjstemplates/migrations.json.codex/config.toml.mcp.json.cursor/mcp.jsonPROJECT_DIR/.codex/config.tomlPROJECT_DIR/.mcp.jsonPROJECT_DIR/.cursor/mcp.jsonPROJECT_DIR/.claude/settings.jsonPROJECT_DIR/opencode.jsonPROJECT_DIR/.agents/skills/job-forge

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs bin/sync.mjs automatically via postinstall.
bin/sync.mjs symlinks package-controlled MCP, Codex, Claude, Cursor, OpenCode, and shared-agent files into the consumer project.
bin/sync.mjs modifies an existing consumer opencode.json and invokes migrations without user action.
templates/migrations.json automatically merges consumer package.json scripts and .gitignore entries.
Injected MCP configs configure npx -y @razroo/gmail-mcp@1.8.1 for later agent startup.

Evidence against

sync.mjs preserves existing real files and conflicting symlinks.
No source-confirmed credential exfiltration or hidden network endpoint was found in inspected lifecycle code.
The observed network check in scripts/verify-greenhouse-urls.mjs is an explicit utility, not install-time behavior.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

Source & flagged code

15 flagged

package.jsonView file

•scripts.postinstall = node bin/sync.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

config/profile.example.ymlView file

53patternName = generic_password severity = medium line = 53 matchedText = # pass...026"

Medium

Secret Pattern

Package contains a possible secret pattern.

config/profile.example.ymlView on unpkg · L53

124patternName = generic_password severity = medium line = 124 matchedText = # pass...auth

Medium

Secret Pattern

Hardcoded password in config/profile.example.yml

config/profile.example.ymlView on unpkg · L124

bin/create-job-forge.mjsView file

•matchType = normalized_sha256 matchedPackage = job-forge@2.14.55 matchedPath = bin/create-job-forge.mjs matchedIdentity = npm:am9iLWZvcmdl:2.14.55 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/create-job-forge.mjsView on unpkg

215// invoke them via npx without local package pins. L216: 'update-harness': 'npm update job-forge @razroo/gmail-mcp @geometra/mcp && job-forge sync && node -e "console.log(\'✅ harness at\', require(\'./package-lock.json\').packages[\'node... L217: },

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/create-job-forge.mjsView on unpkg · L215

scripts/receipts.mjsView file

417package = job-forge; repositoryIdentity = jobforge; dependency = @agent-pattern-labs/iso-receipts L417: try { L418: return await import('@agent-pattern-labs/iso-receipts'); L419: } catch {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

scripts/receipts.mjsView on unpkg · L417

bin/sync.mjsView file

1Install-time AI-agent control hijack evidence: L22: L23: import { existsSync, lstatSync, readlinkSync, symlinkSync, mkdirSync, readFileSync, writeFileSync } from 'fs'; L24: import { dirname, join, resolve, relative } from 'path'; ... L71: // settings + iso-route resolved role map. L72: { src: '.mcp.json', dst: '.mcp.json' }, L73: { src: '.claude/agents', dst: '.claude/agents' }, L74: { src: '.claude/settings.json', dst: '.claude/settings.json' }, L75: { src: '.claude/iso-route.resolved.json', dst: '.claude/iso-route.resolved.json' }, L76: ... L78: // blocks. The shared Open Agent Skill is also discovered by OpenCode. L79: { src: '.codex/config.toml', dst: '.codex/config.toml' }, L80: { src: '.codex/iso-route.md', dst: '

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/sync.mjsView on unpkg · L1

batch/batch-runner.shView file

•path = batch/batch-runner.sh kind = build_helper sizeBytes = 21665 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

batch/batch-runner.shView on unpkg

fonts/space-grotesk-latin.woff2View file

•path = fonts/space-grotesk-latin.woff2 kind = high_entropy_blob sizeBytes = 22320 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

fonts/space-grotesk-latin.woff2View on unpkg

bin/geometra-mcp-launcher.mjsView file

•matchType = normalized_sha256 matchedPackage = job-forge@2.14.55 matchedPath = bin/geometra-mcp-launcher.mjs matchedIdentity = npm:am9iLWZvcmdl:2.14.55 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/geometra-mcp-launcher.mjsView on unpkg

bin/job-forge.mjsView file

•matchType = normalized_sha256 matchedPackage = job-forge@2.14.55 matchedPath = bin/job-forge.mjs matchedIdentity = npm:am9iLWZvcmdl:2.14.55 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/job-forge.mjsView on unpkg

merge-tracker.mjsView file

•matchType = normalized_sha256 matchedPackage = job-forge@2.14.55 matchedPath = merge-tracker.mjs matchedIdentity = npm:am9iLWZvcmdl:2.14.55 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

merge-tracker.mjsView on unpkg

scripts/apply-queue.mjsView file

•matchType = normalized_sha256 matchedPackage = job-forge@2.14.55 matchedPath = scripts/apply-queue.mjs matchedIdentity = npm:am9iLWZvcmdl:2.14.55 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/apply-queue.mjsView on unpkg

modes/reference-portals.mdView file

68patternName = generic_password severity = medium line = 68 matchedText = password...onal

Medium

Secret Pattern

Hardcoded password in modes/reference-portals.md

modes/reference-portals.mdView on unpkg · L68

modes/_shared.mdView file

99patternName = generic_password severity = medium line = 99 matchedText = password...026"

Medium

Secret Pattern

Hardcoded password in modes/_shared.md

modes/_shared.mdView on unpkg · L99

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/sync.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

config/profile.example.ymlView file

53patternName = generic_password severity = medium line = 53 matchedText = # pass...026"

Medium

Secret Pattern

Package contains a possible secret pattern.

config/profile.example.ymlView on unpkg · L53

124patternName = generic_password severity = medium line = 124 matchedText = # pass...auth

Medium

Secret Pattern

Hardcoded password in config/profile.example.yml

config/profile.example.ymlView on unpkg · L124

Findings

1 Critical8 High9 Medium5 Low

CriticalAi Agent Control Hijackbin/sync.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighCopied Package Dependency Bridgescripts/receipts.mjs

HighShips High Entropy Blobfonts/space-grotesk-latin.woff2

HighKnown Malware Source Similaritybin/create-job-forge.mjs

HighKnown Malware Source Similaritybin/geometra-mcp-launcher.mjs

HighKnown Malware Source Similaritybin/job-forge.mjs

HighKnown Malware Source Similaritymerge-tracker.mjs

HighKnown Malware Source Similarityscripts/apply-queue.mjs

MediumSecret Patternconfig/profile.example.yml

MediumDynamic Requirebin/create-job-forge.mjs

Affected versions and remediation

This report applies to job-forge@2.14.56.

The versions list below shows the verdict for each recorded version.

Avoid installing job-forge@2.14.56. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-21 00:07:40.595Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

8 known versions

2.14.70latestSuspicious—WarnUnder ReviewJul 22, 2026, 12:23 AM 2.14.56shownMaliciousSoft block: AI-agent control surfaceBlockPublishedJul 21, 2026, 12:05 AM 2.14.55MaliciousSoft block: AI-agent control surfaceBlockPublishedJul 20, 2026, 11:34 PM 2.14.54SuspiciousAgent extension lifecycle riskWarnPublishedJul 20, 2026, 11:15 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code