minimal-forge-work-pack-sync@0.1.46
Minimal Forge Work Pack startup synchronization for OpenCode and OpenWork.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe plugin trusts a manifest-provided HTTPS gateway without checking that it belongs to the configured Forge service, then persists the Forge API key for use there. The source does not identify a fixed unrelated recipient, so this is a real credential-routing risk but not enough to establish malicious exfiltration.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The OpenCode host invokes the plugin server at startup; later provider or image requests use the configured gateway.
Impact
If the Forge endpoint or its manifest is compromised or misconfigured, the Forge key can be disclosed to a different host.
Mechanism
The plugin accepts manifest.gatewayBaseUrl without tying its host to the configured Forge origin, writes it as the provider base URL with the Forge API key, and sends that key in gateway requests.
AI rationale
The plugin trusts a manifest-provided HTTPS gateway without checking that it belongs to the configured Forge service, then persists the Forge API key for use there. The source does not identify a fixed unrelated recipient, so this is a real credential-routing risk but not enough to establish malicious exfiltration.
Evidence
dist/index.jsOpenCode provider configuration at paths.opencodeConfigPath
Network endpoints3
<configured forgeBaseUrl>/sync/manifest<manifest.gatewayBaseUrl>/v1<gatewayBaseUrl>/v1/images
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The package exports dist/index.js as its plugin entrypoint.
- At startup, the plugin reads Forge credentials, fetches a manifest, and takes the gateway URL from that manifest.
- Gateway validation accepts any HTTPS origin; it does not require the host to match the configured Forge service.
- The generated OpenCode provider config uses the manifest gateway as its base URL and reuses the Forge API key.
- The image tool sends that Forge key as a bearer token to the gateway host.
Evidence against
- The manifest itself is fetched from the configured Forge origin with redirects rejected.
- The gateway URL is supplied by the Forge manifest; the package source does not hard-code an unrelated gateway host.
- The credential involved is the Forge-specific key, not a discovered credential for another service.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
5 flaggeddist/index.jsView file
2615if (typeof node_buffer.Buffer === "function") {
L2616: return node_buffer.Buffer.from(src, "base64");
L2617: } else if (typeof atob === "function") {
...
L5229: yield* this.next(token);
L5230: yield* this.end(forceDoc, endOffset);
L5231: }
...
L5233: *next(token) {
L5234: if (node_process.env.LOG_STREAM)
L5235: console.dir(token, { depth: null });
...
L7613: var FIRECRAWL_KEYLESS_MCP_NAME = "firecrawl";
L7614: var FIRECRAWL_KEYLESS_MCP_URL = "https://mcp.firecrawl.dev/v2/mcp";
L7615: var FIRECRAWL_KEYLESS_PERMISSION = `${FIRECRAWL_KEYLESS_MCP_NAME}_*`;
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L26152615Trigger-reachable chain: manifest.main -> dist/index.js
L2615: if (typeof node_buffer.Buffer === "function") {
L2616: return node_buffer.Buffer.from(src, "base64");
L2617: } else if (typeof atob === "function") {
...
L5229: yield* this.next(token);
L5230: yield* this.end(forceDoc, endOffset);
L5231: }
...
L5233: *next(token) {
L5234: if (node_process.env.LOG_STREAM)
L5235: console.dir(token, { depth: null });
...
L7613: var FIRECRAWL_KEYLESS_MCP_NAME = "firecrawl";
L7614: var FIRECRAWL_KEYLESS_MCP_URL = "https://mcp.firecrawl.dev/v2/mcp";
L7615: var FIRECRAWL_KEYLESS_PERMISSION = `${FIRECRAWL_KEYLESS_MCP_NAME}_*`;
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsFindings
3 Critical2 High3 Medium5 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/repair.js
HighCredential Redirect Persistencedist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to minimal-forge-work-pack-sync@0.1.46.
See all versions of minimal-forge-work-pack-sync for other recorded verdicts.
- Review the evidence and your use of minimal-forge-work-pack-sync@0.1.46 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.