Loading npm security reports…

job-forge@2.14.56: AI-agent policy block | LPM Firewall

registry / job-forge / 2.14.56

job-forge@2.14.56

AI-powered job search pipeline for Codex and OpenCode

AI Security Review

scanned 9h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. Installing the package executes a postinstall hook that changes the consumer project's AI-agent configuration surface. It adds package-controlled symlinks and config mutations that can affect future Codex, Claude, Cursor, and OpenCode sessions.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation of job-forge@2.14.56

Impact

Unconsented broad AI-agent control-surface mutation and later MCP command execution.

Mechanism

postinstall symlink and configuration injection into consumer AI-agent directories

Policy narrative

At npm postinstall, bin/sync.mjs uses INIT_CWD/cwd to write into the consuming project. It installs symlinks for multiple AI-agent platforms, patches opencode.json, and applies migrations to package.json and .gitignore. The supplied MCP configurations include a Gmail MCP launched through npx -y, so a subsequent agent session can execute package-selected tooling. This is an unconsented lifecycle mutation of a broad foreign AI-agent control surface.

Rationale

Source inspection confirms concrete postinstall mutation of consumer AI-agent configuration across several platforms. Under the stated policy, this requires blocking even though no direct exfiltration was confirmed.

Evidence

package.jsonbin/sync.mjstemplates/migrations.json.codex/config.toml.mcp.json.cursor/mcp.jsonPROJECT_DIR/.codex/config.tomlPROJECT_DIR/.mcp.jsonPROJECT_DIR/.cursor/mcp.json

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/sync.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

config/profile.example.ymlView file

53patternName = generic_password severity = medium line = 53 matchedText = # pass...026"

Medium

Secret Pattern

Package contains a possible secret pattern.

config/profile.example.ymlView on unpkg · L53

124patternName = generic_password severity = medium line = 124 matchedText = # pass...auth

Medium

Secret Pattern

Hardcoded password in config/profile.example.yml

config/profile.example.ymlView on unpkg · L124

bin/create-job-forge.mjsView file

•matchType = normalized_sha256 matchedPackage = job-forge@2.14.55 matchedPath = bin/create-job-forge.mjs matchedIdentity = npm:am9iLWZvcmdl:2.14.55 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/create-job-forge.mjsView on unpkg

215// invoke them via npx without local package pins. L216: 'update-harness': 'npm update job-forge @razroo/gmail-mcp @geometra/mcp && job-forge sync && node -e "console.log(\'✅ harness at\', require(\'./package-lock.json\').packages[\'node... L217: },

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/create-job-forge.mjsView on unpkg · L215

scripts/receipts.mjsView file

417package = job-forge; repositoryIdentity = jobforge; dependency = @agent-pattern-labs/iso-receipts L417: try { L418: return await import('@agent-pattern-labs/iso-receipts'); L419: } catch {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

scripts/receipts.mjsView on unpkg · L417

bin/sync.mjsView file

1Install-time AI-agent control hijack evidence: L22: L23: import { existsSync, lstatSync, readlinkSync, symlinkSync, mkdirSync, readFileSync, writeFileSync } from 'fs'; L24: import { dirname, join, resolve, relative } from 'path'; ... L71: // settings + iso-route resolved role map. L72: { src: '.mcp.json', dst: '.mcp.json' }, L73: { src: '.claude/agents', dst: '.claude/agents' }, L74: { src: '.claude/settings.json', dst: '.claude/settings.json' }, L75: { src: '.claude/iso-route.resolved.json', dst: '.claude/iso-route.resolved.json' }, L76: ... L78: // blocks. The shared Open Agent Skill is also discovered by OpenCode. L79: { src: '.codex/config.toml', dst: '.codex/config.toml' }, L80: { src: '.codex/iso-route.md', dst: '

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/sync.mjsView on unpkg · L1

batch/batch-runner.shView file

•path = batch/batch-runner.sh kind = build_helper sizeBytes = 21665 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

batch/batch-runner.shView on unpkg

fonts/space-grotesk-latin.woff2View file

•path = fonts/space-grotesk-latin.woff2 kind = high_entropy_blob sizeBytes = 22320 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

fonts/space-grotesk-latin.woff2View on unpkg

bin/geometra-mcp-launcher.mjsView file

•matchType = normalized_sha256 matchedPackage = job-forge@2.14.55 matchedPath = bin/geometra-mcp-launcher.mjs matchedIdentity = npm:am9iLWZvcmdl:2.14.55 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/geometra-mcp-launcher.mjsView on unpkg

bin/job-forge.mjsView file

•matchType = normalized_sha256 matchedPackage = job-forge@2.14.55 matchedPath = bin/job-forge.mjs matchedIdentity = npm:am9iLWZvcmdl:2.14.55 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/job-forge.mjsView on unpkg

merge-tracker.mjsView file

•matchType = normalized_sha256 matchedPackage = job-forge@2.14.55 matchedPath = merge-tracker.mjs matchedIdentity = npm:am9iLWZvcmdl:2.14.55 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

merge-tracker.mjsView on unpkg

scripts/apply-queue.mjsView file

•matchType = normalized_sha256 matchedPackage = job-forge@2.14.55 matchedPath = scripts/apply-queue.mjs matchedIdentity = npm:am9iLWZvcmdl:2.14.55 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/apply-queue.mjsView on unpkg

modes/reference-portals.mdView file

68patternName = generic_password severity = medium line = 68 matchedText = password...onal

Medium

Secret Pattern

Hardcoded password in modes/reference-portals.md

modes/reference-portals.mdView on unpkg · L68

modes/_shared.mdView file

99patternName = generic_password severity = medium line = 99 matchedText = password...026"

Medium

Secret Pattern

Hardcoded password in modes/_shared.md

modes/_shared.mdView on unpkg · L99

Source & flagged code

15 flagged

package.jsonView file

Lines 117-157json

117 "receipts:redact": "node bin/job-forge.mjs receipts:redact",

118 "receipts:path": "node bin/job-forge.mjs receipts:path",

119 "apply:queue": "node scripts/apply-queue.mjs",

120 "migrate:plan": "node bin/job-forge.mjs migrate:plan",

121 "migrate:apply": "node bin/job-forge.mjs migrate:apply",

122 "migrate:check": "node bin/job-forge.mjs migrate:check",

123 "migrate:explain": "node bin/job-forge.mjs migrate:explain",

124 "plan": "iso plan .",

125 "lint:agentmd": "agentmd lint iso/instructions.md",

126 "lint:modes": "isolint lint modes/",

127 "lint:helpers": "node scripts/check-helper-integration.mjs .",

128 "test:agentmd": "agentmd test iso/instructions.md --fixtures fixtures/instructions.yml --via claude-code --model claude-haiku-4-5 --concurrency 2",

129 "test:agentmd:baseline": "agentmd test iso/instructions.md --fixtures fixtures/instructions.yml --via claude-code --model claude-haiku-4-5 --concurrency 2 --trials 3 --format json --out fixtures/baseline.json",

130 "test:agentmd:apply": "agentmd test modes/apply.md --fixtures fixtures/modes/apply.yml --via claude-code --model claude-haiku-4-5 --concurrency 2 --trials 3",

131 "lint:agentmd:modes": "agentmd lint modes/apply.md",

132 "smoke:iso": "iso plan . && iso build . --dry-run && node scripts/build-client-skills.mjs --dry-run && iso-route verify models.yaml && node scripts/check-iso-smoke.mjs . && node scripts/check-helper-integration.mjs . && JOBFORGE_ROOT=$PWD iso-eval run fixtures/iso-smoke/eval.yml",

133 "build:skills": "node scripts/build-client-skills.mjs",

134 "build:config": "iso build . && node scripts/build-client-skills.mjs",

135 "prepack": "npm run build:config",

136 "release:check-source": "node ./scripts/release/check-source.mjs",

137 "postinstall": "node bin/sync.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L137

138 },

139 "files": [

140 "bin/",

141 "iso/",

142 "models.yaml",

143 ".claude/settings.json",

144 ".claude/iso-route.resolved.json",

145 ".claude/agents/",

146 ".cursor/mcp.json",

147 ".cursor/rules/",

148 ".cursor/iso-route.md",

149 ".agents/",

150 ".opencode/",

151 ".codex/",

152 ".mcp.json",

153 "CLAUDE.md",

154 "AGENTS.md",

155 "opencode.json",

156 "modes/",

157 "templates/",

config/profile.example.ymlView file

Lines 33-73yaml

33 # Your professional headline (1 line)

34 headline: "ML Engineer turned AI product builder"

35 # Your exit story — what makes you unique

36 exit_story: "Built and sold my SaaS after 5 years. Now focused on applied AI at scale."

37 # Your top 3-5 superpowers

38 superpowers:

39 -

bin/create-job-forge.mjsView file

Lines 195-235javascript

195 'lineage:stale': 'job-forge lineage:stale',

196 'lineage:verify': 'job-forge lineage:verify',

197 'lineage:explain': 'job-forge lineage:explain',

198 'redact:scan': 'job-forge redact:scan',

199

scripts/receipts.mjsView file

Lines 397-437javascript

397 return `jobforge:${kind}`;

398}

399

400function defaultReceiptPath(kind, opts) {

401 const stamp =

bin/sync.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2/**

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/sync.mjsView on unpkg · L1

3 * sync.mjs — Create/refresh harness symlinks in the consumer's project.

4 *

5 * When job-forge is installed as an npm dependency, opencode / cursor /

6 * claude code / codex need to see certain files at the *consumer project

7 * root* (not inside node_modules). These are generated at publish time from

8 * the harness's iso/ source by iso-harness plus the client-skill adapter; this

batch/batch-runner.shView file

•path = batch/batch-runner.sh kind = build_helper sizeBytes = 21665 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

batch/batch-runner.shView on unpkg

fonts/space-grotesk-latin.woff2View file

•path = fonts/space-grotesk-latin.woff2 kind = high_entropy_blob sizeBytes = 22320 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

fonts/space-grotesk-latin.woff2View on unpkg

bin/geometra-mcp-launcher.mjsView file

•matchType = normalized_sha256 matchedPackage = job-forge@2.14.55 matchedPath = bin/geometra-mcp-launcher.mjs matchedIdentity = npm:am9iLWZvcmdl:2.14.55 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/geometra-mcp-launcher.mjsView on unpkg

bin/job-forge.mjsView file

•matchType = normalized_sha256 matchedPackage = job-forge@2.14.55 matchedPath = bin/job-forge.mjs matchedIdentity = npm:am9iLWZvcmdl:2.14.55 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/job-forge.mjsView on unpkg

merge-tracker.mjsView file

•matchType = normalized_sha256 matchedPackage = job-forge@2.14.55 matchedPath = merge-tracker.mjs matchedIdentity = npm:am9iLWZvcmdl:2.14.55 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

merge-tracker.mjsView on unpkg

scripts/apply-queue.mjsView file

•matchType = normalized_sha256 matchedPackage = job-forge@2.14.55 matchedPath = scripts/apply-queue.mjs matchedIdentity = npm:am9iLWZvcmdl:2.14.55 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/apply-queue.mjsView on unpkg

modes/reference-portals.mdView file

Lines 48-88markdown

48- **Some Greenhouse tenants route OTP through third-party verification (Toast uses ClinchTalent).** If `from:greenhouse` returns empty after a Greenhouse submit, check the tenant-specific sender row above. Confirmed 2026-04-19: Toast Principal SWE #807 and Toast Senior FE #808.

49

50---

51

52## BYO Proxy + Block Detection

53

54**Problem:** Some portals return CAPTCHA, challenge, access-denied, unsupported-browser, rate-limit, or similar blocked states before a form can be read or submitted. `imeFriendly: true` fixes React validation lag, but it cannot change a server-side portal decision.

modes/_shared.mdView file

Lines 79-119markdown

79- **In Draft Answers (Section G):** Place the transition narrative in the first response.

80- **When the JD asks for "entrepreneurial", "ownership", "builder", "end-to-end":** This is the #1 differentiator. Increase match weight.

81

82### Use the cross-cutting advantage frame

83

84Frame the candidate as a **"Technical builder with real-world proof"**. Adapt the phrasing per archetype.

85

86- For PM: "builder who reduces uncertainty with prototypes then productionizes with discipline."