@2digits/opencode-plugin@0.2.50
OpenCode plugin for PostHog LLM analytics integration
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package’s stated purpose is PostHog LLM analytics, but its default runtime behavior transmits prompts, outputs and tool data, and can include a Git email and project name. Because this content-bearing telemetry is enabled by default and has only environment-variable controls, warn about the privacy risk rather than treating it as a clear malicious attack.
Static reason
No blocking static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
When the OpenCode plugin is loaded and receives message or tool events; analytics is enabled unless explicitly disabled.
Impact
User prompts, generated content, tool data and identifying project details may be transmitted to PostHog without an explicit per-user consent step.
Mechanism
The plugin creates PostHog events from prompts, model output, tool arguments and results. Privacy redaction is off by default, and the distinct ID can fall back to the Git email.
AI rationale
The package’s stated purpose is PostHog LLM analytics, but its default runtime behavior transmits prompts, outputs and tool data, and can include a Git email and project name. Because this content-bearing telemetry is enabled by default and has only environment-variable controls, warn about the privacy risk rather than treating it as a clear malicious attack.
Evidence
dist/index.mjspackage.json
Network endpoints1
eu.i.posthog.com
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package describes itself as a PostHog LLM analytics integration and depends on posthog-node.
- Analytics is enabled by default; prompt privacy redaction requires an environment variable to be explicitly set to true.
- The plugin reads the configured Git email and project name for analytics identity and properties.
- On OpenCode message and tool events, it captures prompts, model outputs, tool arguments and outputs as PostHog events.
Evidence against
- The analytics destination is PostHog’s EU endpoint, consistent with the package’s stated purpose.
- The plugin has an environment variable to disable analytics and another to redact prompt and output content.
- No install lifecycle scripts are declared.
Behavioral surface
EnvironmentVars
MinifiedTelemetryTrivialUrlStrings
Source & flagged code
6 flaggeddist/index.mjsView file
•matchType = malicious_source_fingerprint_signature
signature = b8528e9797abecdf
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = @2digits/opencode-plugin@0.2.49
matchedPath = dist/index.mjs
matchedIdentity = npm:[redacted]:0.2.49
similarity = 1.000
shingleOverlap = 2
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
dist/index.mjsView on unpkg27ZnHchwa5C6Tb`,host:process.env.POSTHOG_OPENCODE_HOST??`https://eu.i.posthog.com`,enabled:process.env.POSTHOG_OPENCODE_ENABLED!==`false`,privacyMode:process.env.POSTHOG_OPENCODE_LLMA_PRIVACY_MODE===`true`,traceGrouping:u(process.env.POSTHOG_OPENCODE_LLMA_TRACE_GROUPING),sessionWindowMinutes:d(process.env.POSTHOG_OPENCODE_LLMA_SESSION_WINDOW_MINUTES
Medium
Ai Review Evidence
Analytics is enabled by default; prompt privacy redaction requires an environment variable to be explicitly set to true.
dist/index.mjsView on unpkg · L22,sessionWindowMinutes:d(process.env.POSTHOG_OPENCODE_LLMA_SESSION_WINDOW_MINUTES,60),maxAttributeLength:d(process.env.POSTHOG_OPENCODE_MAX_ATTRIBUTE_LENGTH,12e3),distinctId:p(process.env.POSTHOG_OPENCODE_LLMA_DISTINCT_ID),gitEmail:await M(e),projectName:t,customProperties:n??{}}}function P(e,t){for(let[n,r]of e)r.sessionID===t&&e.delete(n)}function F(e,t,n){e.agentName=n.mode||t.agentName,e.lastActivityAt=n.time.completed,e.totalCostUsd+=n.cost,e.totalInputTokens+=n.tokens.input,e.totalOutputTok
Findings
1 High6 Medium3 Low
HighKnown Malware Source Fingerprint Signaturedist/index.mjs
MediumEnvironment Vars
MediumAi Review Evidencepackage.json
MediumAi Review Evidencedist/index.mjs
MediumAi Review Evidencedist/index.mjs
MediumAi Review Evidencedist/index.mjs
MediumAi Review Evidencedist/index.mjs
LowScripts Present
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @2digits/opencode-plugin@0.2.50.
See all versions of @2digits/opencode-plugin for other recorded verdicts.
- Review the evidence and your use of @2digits/opencode-plugin@0.2.50 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.