github.com / forge-agents

forge-agents/forge

TypeScript·2625 files·commit 149875e·scanned 4d ago·cached ✓

14/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

verdict accurate?

35% file coverage

Partial architecture graph

threat-state: lowlive

FINDINGS ░▒▓

warningGo unsafe package usageunsafe package bypasses Go's type safety. Malware uses it for memory tricks, pointer casts, and hiding behavior.packages/opencode-archive/sdk-variants/go/internal/apijson/decoder.go

	"time"
	"unsafe"

	"github.com/tidwall/gjson"

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.packages/forge/src/session/message-v2.ts+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.packages/opencode-archive/console/app/src/routes/index.tsx+3

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

913 files scanned @ 149875e | 10/25/2026 | heuristic scan — always review manually

risk by category

code execution5

network & exfiltration0

file system access0

obfuscation6

supply chain0

owasp / injection0

telemetry

files 913/2625rules hit 4engine v7commit 149875e

github

forge-agents/forge

Universal CLI for coding agents, powered by the Agent Client Protocol

TypeScript

342d

2625 files

913 scanned(35%)

149875e

architecture░▒▓

entry (4) flagged (3) pkg (297)

697 nodes · 1949 edgesscroll to zoom · click node to jump to finding