registry / job-forge / 2.14.70

job-forge@2.14.70

⚠ Under review

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 23 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 80 file(s), 871 KB of source, external domains: example.test, github.com, linkedin.com, opencode.ai

Source & flagged code

15 flagged

package.jsonView file

Lines 117-157json

117 "receipts:redact": "node bin/job-forge.mjs receipts:redact",

118 "receipts:path": "node bin/job-forge.mjs receipts:path",

119 "apply:queue": "node scripts/apply-queue.mjs",

120 "migrate:plan": "node bin/job-forge.mjs migrate:plan",

121 "migrate:apply": "node bin/job-forge.mjs migrate:apply",

122 "migrate:check": "node bin/job-forge.mjs migrate:check",

123 "migrate:explain": "node bin/job-forge.mjs migrate:explain",

124 "plan": "iso plan .",

125 "lint:agentmd": "agentmd lint iso/instructions.md",

126 "lint:modes": "isolint lint modes/",

127 "lint:helpers": "node scripts/check-helper-integration.mjs .",

128 "test:agentmd": "agentmd test iso/instructions.md --fixtures fixtures/instructions.yml --via claude-code --model claude-haiku-4-5 --concurrency 2",

129 "test:agentmd:baseline": "agentmd test iso/instructions.md --fixtures fixtures/instructions.yml --via claude-code --model claude-haiku-4-5 --concurrency 2 --trials 3 --format json --out fixtures/baseline.json",

130 "test:agentmd:apply": "agentmd test modes/apply.md --fixtures fixtures/modes/apply.yml --via claude-code --model claude-haiku-4-5 --concurrency 2 --trials 3",

131 "lint:agentmd:modes": "agentmd lint modes/apply.md",

132 "smoke:iso": "iso plan . && iso build . --dry-run && node scripts/build-client-skills.mjs --dry-run && iso-route verify models.yaml && node scripts/check-iso-smoke.mjs . && node scripts/check-helper-integration.mjs . && JOBFORGE_ROOT=$PWD iso-eval run fixtures/iso-smoke/eval.yml",

133 "build:skills": "node scripts/build-client-skills.mjs",

134 "build:config": "iso build . && node scripts/build-client-skills.mjs",

135 "prepack": "npm run build:config",

136 "release:check-source": "node ./scripts/release/check-source.mjs",

137 "postinstall": "node bin/sync.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L137

138 },

139 "files": [

140 "bin/",

141 "iso/",

142 "models.yaml",

143 ".claude/settings.json",

144 ".claude/iso-route.resolved.json",

145 ".claude/agents/",

146 ".cursor/mcp.json",

147 ".cursor/rules/",

148 ".cursor/iso-route.md",

149 ".agents/",

150 ".opencode/",

151 ".codex/",

152 ".mcp.json",

153 "CLAUDE.md",

154 "AGENTS.md",

155 "opencode.json",

156 "modes/",

157 "templates/",

config/profile.example.ymlView file

Lines 33-73yaml

33 # Your professional headline (1 line)

34 headline: "ML Engineer turned AI product builder"

35 # Your exit story — what makes you unique

36 exit_story: "Built and sold my SaaS after 5 years. Now focused on applied AI at scale."

37 # Your top 3-5 superpowers

38 superpowers:

39 -

bin/create-job-forge.mjsView file

Lines 195-235javascript

195 'lineage:stale': 'job-forge lineage:stale',

196 'lineage:verify': 'job-forge lineage:verify',

197 'lineage:explain': 'job-forge lineage:explain',

198 'redact:scan': 'job-forge redact:scan',

199

generate-pdf.mjsView file

Lines 84-124javascript

84 }

86 console.log(`📄 Input: ${inputPath}`);

87 console.log(`📁 Output: ${outputPath}`);

88 console.log(`📏 Format: ${format.toUpperCase()

bin/sync.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2/**

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/sync.mjsView on unpkg · L1

3 * sync.mjs — Create/refresh harness symlinks in the consumer's project.

4 *

5 * When job-forge is installed as an npm dependency, opencode / cursor /

6 * claude code / codex need to see certain files at the *consumer project

7 * root* (not inside node_modules). These are generated at publish time from

8 * the harness's iso/ source by iso-harness plus the client-skill adapter; this

batch/batch-runner.shView file

•path = batch/batch-runner.sh kind = build_helper sizeBytes = 24911 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

batch/batch-runner.shView on unpkg

fonts/space-grotesk-latin.woff2View file

•path = fonts/space-grotesk-latin.woff2 kind = high_entropy_blob sizeBytes = 22320 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

fonts/space-grotesk-latin.woff2View on unpkg

bin/geometra-mcp-launcher.mjsView file

•matchType = normalized_sha256 matchedPackage = job-forge@2.14.56 matchedPath = bin/geometra-mcp-launcher.mjs matchedIdentity = npm:am9iLWZvcmdl:2.14.56 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/geometra-mcp-launcher.mjsView on unpkg

bin/job-forge.mjsView file

•matchType = normalized_sha256 matchedPackage = job-forge@2.14.56 matchedPath = bin/job-forge.mjs matchedIdentity = npm:am9iLWZvcmdl:2.14.56 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/job-forge.mjsView on unpkg

scripts/session-report.mjsView file

•matchType = normalized_sha256 matchedPackage = job-forge@2.14.56 matchedPath = scripts/session-report.mjs matchedIdentity = npm:am9iLWZvcmdl:2.14.56 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/session-report.mjsView on unpkg

scripts/token-usage-report.mjsView file

•matchType = normalized_sha256 matchedPackage = job-forge@2.14.56 matchedPath = scripts/token-usage-report.mjs matchedIdentity = npm:am9iLWZvcmdl:2.14.56 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/token-usage-report.mjsView on unpkg

modes/reference-portals.mdView file

Lines 48-88markdown

48- **Some Greenhouse tenants route OTP through third-party verification (Toast uses ClinchTalent).** If `from:greenhouse` returns empty after a Greenhouse submit, check the tenant-specific sender row above. Confirmed 2026-04-19: Toast Principal SWE #807 and Toast Senior FE #808.

50---

52## BYO Proxy + Block Detection

54**Problem:** Some portals return CAPTCHA, challenge, access-denied, unsupported-browser, rate-limit, or similar blocked states before a form can be read or submitted. `imeFriendly: true` fixes React validation lag, but it cannot change a server-side portal decision.

modes/_shared.mdView file

Lines 79-119markdown

79- **In Draft Answers (Section G):** Place the transition narrative in the first response.

80- **When the JD asks for "entrepreneurial", "ownership", "builder", "end-to-end":** This is the #1 differentiator. Increase match weight.

82### Use the cross-cutting advantage frame

84Frame the candidate as a **"Technical builder with real-world proof"**. Adapt the phrasing per archetype.

86- For PM: "builder who reduces uncertainty with prototypes then productionizes with discipline."

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/sync.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

config/profile.example.ymlView file

53patternName = generic_password severity = medium line = 53 matchedText = # pass...026"

Medium

Secret Pattern

Package contains a possible secret pattern.

config/profile.example.ymlView on unpkg · L53

124patternName = generic_password severity = medium line = 124 matchedText = # pass...auth

Medium

Secret Pattern

Hardcoded password in config/profile.example.yml

config/profile.example.ymlView on unpkg · L124

Findings

1 Critical8 High9 Medium5 Low

CriticalAi Agent Control Hijackbin/sync.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighCopied Package Dependency Bridgegenerate-pdf.mjs

HighShips High Entropy Blobfonts/space-grotesk-latin.woff2

HighKnown Malware Source Similaritybin/create-job-forge.mjs

HighKnown Malware Source Similaritybin/geometra-mcp-launcher.mjs

HighKnown Malware Source Similaritybin/job-forge.mjs

HighKnown Malware Source Similarityscripts/session-report.mjs

HighKnown Malware Source Similarityscripts/token-usage-report.mjs

MediumSecret Patternconfig/profile.example.yml

MediumDynamic Requirebin/create-job-forge.mjs