registry / @2digits/opencode-plugin / 0.2.46
@2digits/opencode-plugin@0.2.46
OpenCode plugin for PostHog LLM analytics integration
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe inspected runtime implements the PostHog analytics integration declared by the package, with a configurable host and an environment setting to disable content capture. No install-time behavior or independent malicious attack surface was found.
Static reason
No blocking static signals were detected.
Trigger
The plugin is loaded and receives message or tool events during OpenCode use.
Impact
The configured analytics service receives captured interaction data; the source does not establish malicious collection or a separate attack.
Mechanism
It captures analytics events using PostHog, with content collection disabled only when privacy mode is enabled.
AI rationale
The inspected runtime implements the PostHog analytics integration declared by the package, with a configurable host and an environment setting to disable content capture. No install-time behavior or independent malicious attack surface was found.
Evidence
package.jsondist/index.mjs.lpm-dependency-evidence-8da8f8c2-f539-458f-9623-f85d261b970b/0/npm-linux/package.json.lpm-dependency-evidence-8da8f8c2-f539-458f-9623-f85d261b970b/0/npm-linux/dist/entrypoints/index.node.mjs.lpm-dependency-evidence-8da8f8c2-f539-458f-9623-f85d261b970b/1/npm-linux/package.json.lpm-dependency-evidence-8da8f8c2-f539-458f-9623-f85d261b970b/1/npm-linux/dist/index.js
Network endpoints1
eu.i.posthog.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package describes itself as a PostHog LLM analytics integration and declares no install lifecycle hook.
- At runtime, analytics capture includes prompt and model output data, with tool call events captured as well.
- Analytics are enabled by default; the PostHog host can be configured, and privacy mode suppresses content fields when enabled.
- The declared PostHog and OpenCode dependencies match the plugin’s stated analytics purpose.
Evidence against
Behavioral surface
EnvironmentVars
MinifiedTelemetryTrivialUrlStrings
Source & flagged code
8 flaggedpackage.jsonView file
4"description": "OpenCode plugin for PostHog LLM analytics integration",
"license": "MIT",
"repository": {
"type": "git",
"url": "git+https://github.com/2digits-agency/c
Low
Suspicious Lifecycle Evidence
The package describes itself as a PostHog LLM analytics integration and declares no install lifecycle hook.
package.jsonView on unpkg · L449"scripts": {
"build": "vp pack --minify --config-loader unconfig",
"dev": "vp pack --watch --config-loader unconfig",
"test": "vitest run",
"types": "tsc --noEmit"
Low
Suspicious Lifecycle Evidence
The package describes itself as a PostHog LLM analytics integration and declares no install lifecycle hook.
package.jsonView on unpkg · L49dist/index.mjsView file
2D,$ai_provider:i.providerID,$ai_input:C(o.prompt,t.privacyMode),$ai_output_choices:w(a,n,t.privacyMode),$ai_user_prompt:t.privacyMode?void 0:o.prompt,$ai_input_tokens:i.tokens.input,$ai_output_tokens:i.tokens.output,$ai_total_tokens:i.tokens.input+i.tokens.output+i.tokens.reasoning+i.tokens.cache.read+i.tokens.cache.write,$ai_latency:u,$ai_total_cost_usd:i.cost,$ai_stop_reason:v(i.finish,d),$ai_is_error:d,$ai_error:n,$ai_tools_called:c,$ai_tool_c
Findings
1 Medium11 Low
MediumEnvironment Vars
LowScripts Present
LowTelemetry
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.mjs
LowAi Review Evidencedist/index.mjs
LowAi Review Evidencedist/index.mjs
LowAi Review Evidencedist/index.mjs
LowAi Review Evidencedist/index.mjs
LowSuspicious Dependency Evidence.lpm-dependency-evidence-8da8f8c2-f539-458f-9623-f85d261b970b/0/npm-linux/package.json
Affected versions and remediation
This report applies to @2digits/opencode-plugin@0.2.46.
See all versions of @2digits/opencode-plugin for other recorded verdicts.
- Review the evidence and your use of @2digits/opencode-plugin@0.2.46 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.