@anthonyhaussman/opencode-agy-auth@1.4.3
⚠ Under review[](https://www.npmjs.com/package/@anthonyhaussman/opencode-agy-auth) [](https://www.npmjs.com/
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe reviewed runtime behavior is consistent with the package’s Google authentication and Code Assist function, and does not establish a concrete attack. The declared @opencode-ai/plugin dependency could not be independently reviewed, so the package needs manual review before a clean verdict.
Decision evidence
public snapshot- package.json declares @opencode-ai/plugin as a runtime dependency, whose source could not be independently reviewed in this snapshot.
- The plugin sends client-style metrics to its configured Code Assist endpoint after a successful model response.
- The default Code Assist endpoint is a Google service; an environment setting can change the destination.
- The inspected behavior is part of the Google authentication and Code Assist plugin flow; no concrete attack was established in the reviewed source.
Source & flagged code
4 flaggedA single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L118Findings
Affected versions and remediation
This report applies to @anthonyhaussman/opencode-agy-auth@1.4.3.
See all versions of @anthonyhaussman/opencode-agy-auth for other recorded verdicts.
- Review the evidence and your use of @anthonyhaussman/opencode-agy-auth@1.4.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.