registry / minimal-forge-work-pack-sync / 0.1.19
minimal-forge-work-pack-sync@0.1.19
Minimal Forge Work Pack startup synchronization for OpenCode and OpenWork.
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe scanner’s credential-transfer finding corresponds to Forge API requests using a key associated with the configured Forge origin. The inspected source shows no unrelated recipient or other concrete attack behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The host loads the plugin, or a user invokes a Forge-managed skill.
Impact
The inspected credential transfer is restricted to the configured Forge service; no unrelated credential recipient or other confirmed attack surface was established.
Mechanism
The plugin reads a Forge API key associated with its configured Forge origin and sends synchronization requests or skill usage events to that origin.
AI rationale
The scanner’s credential-transfer finding corresponds to Forge API requests using a key associated with the configured Forge origin. The inspected source shows no unrelated recipient or other concrete attack behavior.
Evidence
package.jsondist/index.js
Network endpoints1
${forgeBaseUrl}/sync/evidence
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes dist/index.js as the package entrypoint and has no lifecycle scripts.
- The plugin accepts a Forge origin only over HTTPS or loopback HTTP, and rejects URL credentials, query strings, fragments, and non-root paths.
- The API key is read from OpenCode authentication data for that same Forge origin and must have the expected well-known credential type and key.
- Skill usage reports are sent to that Forge origin and contain event data; the caller limits reporting to use of a Forge-managed skill.
Evidence against
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
5 flaggeddist/index.jsView file
2613if (typeof node_buffer.Buffer === "function") {
L2614: return node_buffer.Buffer.from(src, "base64");
L2615: } else if (typeof atob === "function") {
...
L5226: yield* this.next(token);
L5227: yield* this.end(forceDoc, endOffset);
L5228: }
...
L5230: *next(token) {
L5231: if (node_process.env.LOG_STREAM)
L5232: console.dir(token, { depth: null });
...
L7731: const credentialId = createHash("sha256").update(credentials.forgeApiKey).digest("hex")
L7732: const report = sk[redacted](origin, credentialId, (events) => fetch(origin + "/sync/evidence", {
L7733: method: "POST", redirect: "error",
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L26132613Trigger-reachable chain: manifest.main -> dist/index.js
L2613: if (typeof node_buffer.Buffer === "function") {
L2614: return node_buffer.Buffer.from(src, "base64");
L2615: } else if (typeof atob === "function") {
...
L5226: yield* this.next(token);
L5227: yield* this.end(forceDoc, endOffset);
L5228: }
...
L5230: *next(token) {
L5231: if (node_process.env.LOG_STREAM)
L5232: console.dir(token, { depth: null });
...
L7731: const credentialId = createHash("sha256").update(credentials.forgeApiKey).digest("hex")
L7732: const report = sk[redacted](origin, credentialId, (events) => fetch(origin + "/sync/evidence", {
L7733: method: "POST", redirect: "error",
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
Findings
2 Critical1 High3 Medium6 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to minimal-forge-work-pack-sync@0.1.19.
See all versions of minimal-forge-work-pack-sync for other recorded verdicts.
- Review the evidence and your use of minimal-forge-work-pack-sync@0.1.19 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.