registry / minimal-forge-work-pack-sync / 0.1.21
minimal-forge-work-pack-sync@0.1.21
Minimal Forge Work Pack startup synchronization for OpenCode and OpenWork.
AI Security Review
scanned 16d ago · by lpm-firewall-aiThe package automatically installs and projects Forge-managed agent extensions when its runtime plugin starts, which presents an agent-extension lifecycle risk. Source inspection found no install hook or unrelated credential recipient, so the evidence supports a warning rather than a block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The OpenCode host loads the exported server plugin.
Impact
Forge-managed extensions can affect the host agent configuration automatically when the plugin starts.
Mechanism
The plugin fetches a manifest and applies managed work packs, then projects their agent and command files into host configuration.
AI rationale
The package automatically installs and projects Forge-managed agent extensions when its runtime plugin starts, which presents an agent-extension lifecycle risk. Source inspection found no install hook or unrelated credential recipient, so the evidence supports a warning rather than a block.
Evidence
dist/index.js
Network endpoints5
configured forgeBaseUrl: /sync/manifestconfigured forgeBaseUrl: /sync/skills/...configured forgeBaseUrl: /sync/reportconfigured forgeBaseUrl: /sync/evidenceconfigured forgeBaseUrl: /sync/feedback
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json exposes dist/index.js as a runtime entrypoint and contains no lifecycle scripts.
- Loading the server plugin starts a synchronization routine that reads Forge credentials, fetches a manifest, applies it, and reports results.
- The plugin projects managed agent and command files into the host configuration.
- The Forge API key is selected for the configured Forge origin; the origin must use HTTPS or loopback HTTP.
- Work-pack downloads are restricted to the same Forge origin, and usage reports and feedback are sent to that configured origin.
Evidence against
- No install hook or unrelated credential recipient was found; the API key is used with the configured Forge API.
- The feedback tool sends only text supplied through its person-approved feedback field.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsPossibleObfuscation
Source & flagged code
5 flaggeddist/index.jsView file
2613if (typeof node_buffer.Buffer === "function") {
L2614: return node_buffer.Buffer.from(src, "base64");
L2615: } else if (typeof atob === "function") {
...
L5226: yield* this.next(token);
L5227: yield* this.end(forceDoc, endOffset);
L5228: }
...
L5230: *next(token) {
L5231: if (node_process.env.LOG_STREAM)
L5232: console.dir(token, { depth: null });
...
L7657: const probe = async () => {
L7658: const response = await fetch(new URL(route, url2), { headers, signal: controller.signal, redirect: "error" });
L7659: if (!response.ok) return { status: "unknown" };
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L26132613Trigger-reachable chain: manifest.main -> dist/index.js
L2613: if (typeof node_buffer.Buffer === "function") {
L2614: return node_buffer.Buffer.from(src, "base64");
L2615: } else if (typeof atob === "function") {
...
L5226: yield* this.next(token);
L5227: yield* this.end(forceDoc, endOffset);
L5228: }
...
L5230: *next(token) {
L5231: if (node_process.env.LOG_STREAM)
L5232: console.dir(token, { depth: null });
...
L7657: const probe = async () => {
L7658: const response = await fetch(new URL(route, url2), { headers, signal: controller.signal, redirect: "error" });
L7659: if (!response.ok) return { status: "unknown" };
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsFindings
2 Critical1 High5 Medium4 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencedist/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to minimal-forge-work-pack-sync@0.1.21.
See all versions of minimal-forge-work-pack-sync for other recorded verdicts.
- Review the evidence and your use of minimal-forge-work-pack-sync@0.1.21 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.