Loading npm security reports…

@cotal-ai/connector-opencode@0.29.0: AI-agent control-surface | LPM Firewall

registry / @cotal-ai/connector-opencode / 0.29.0

@cotal-ai/connector-opencode@0.29.0

Cotal connector for OpenCode: a native in-process plugin that joins a session to the mesh.

AI Security Review

scanned 19d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. When the connector launches an OpenCode session, its plugin injects package-authored steering into the session's system instructions. This can redirect an agent's delegation behavior toward the package's mesh tools.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Launching an OpenCode session through this connector with a persona.

Impact

Agent control can be redirected from the user's normal harness and tool choices to package-provided mesh capabilities.

Mechanism

Runtime system-prompt injection through an enabled OpenCode plugin.

Policy narrative

The connector configures OpenCode to load its bundled plugin in allow mode. On the first prompted turn, the plugin adds MESH_FIRST_STEER to the system prompt and posts that body to OpenCode. The injected instruction tells the agent to avoid its normal subagent and parallel-agent facilities in favor of Cotal mesh delegation, creating a package-controlled agent-behavior override.

AI rationale

This is active runtime prompt-based control hijacking, not inert documentation. Although there is no npm install hook, the package injects steering into an agent's system prompt when its connector is used.

Evidence

dist/index.jsdist/plugin.bundle.js

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.

Source & flagged code

5 flagged · loading source

dist/serve.jsView file

1// src/serve.ts L2: import { execFileSync, spawn } from "node:child_process"; L3: import { createServer } from "node:net"; L4: import { once } from "node:events"; ... L8: function resolveOpencodeBin() { L9: const override = process.env.COTAL_OPENCODE_BIN?.trim(); L10: if (override) return override; L11: if (process.platform !== "win32") return "opencode"; L12: for (const dir of (process.env.PATH ?? "").split(delimiter)) { ... L31: async function killServe(serve) { L32: if (serve.exitCode !== null || serve.signalCode !== null) return; L33: serve.kill("SIGTERM");

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

dist/serve.jsView on unpkg · L1

1// src/serve.ts L2: import { execFileSync, spawn } from "node:child_process"; L3: import { createServer } from "node:net";

High

Child Process

Package source references child process execution.

dist/serve.jsView on unpkg · L1

1// src/serve.ts L2: import { execFileSync, spawn } from "node:child_process"; L3: import { createServer } from "node:net"; L4: import { once } from "node:events"; ... L8: function resolveOpencodeBin() { L9: const override = process.env.COTAL_OPENCODE_BIN?.trim(); L10: if (override) return override;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/serve.jsView on unpkg · L1

1// src/serve.ts L2: import { execFileSync, spawn } from "node:child_process"; L3: import { createServer } from "node:net"; L4: import { once } from "node:events"; ... L8: function resolveOpencodeBin() { L9: const override = process.env.COTAL_OPENCODE_BIN?.trim(); L10: if (override) return override; L11: if (process.platform !== "win32") return "opencode"; L12: for (const dir of (process.env.PATH ?? "").split(delimiter)) { ... L31: async function killServe(serve) { L32: if (serve.exitCode !== null || serve.signalCode !== null) return; L33: serve.kill("SIGTERM");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/serve.jsView on unpkg · L1

dist/index.jsView file

7Cross-file remote execution chain: dist/index.js spawns dist/plugin.bundle.js; helper contains network access plus dynamic code execution. L7: // src/extension.ts L8: import { execFileSync } from "node:child_process"; L9: import { fileURLToPath } from "node:url"; ... L22: import { createHash, randomBytes } from "node:crypto"; L23: function controlEndpoint(space, name, token = randomBytes(32).toString("base64url")) { L24: const id = createHash("sha256").update(`${space}\0${name}\0${process.pid}\0${token}`).digest("base64url").slice(0, 32); L25: const path = process.platform === "win32" ? `\\\\.\\pipe\\cotal-${id}` : join(tmpdir(), `cotal-${id}.sock`); L26: return { path, token }; ... L103: const sourceKey = /* @__PURE__ */ new Map(); L104: for (const k of Object.keys(process.env)) L105: sou

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L7

Source & flagged code

5 flagged

dist/serve.jsView file

Lines 1-21javascript

1// src/serve.ts

2import { execFileSync, spawn } from "node:child_process";

3import { createServer } from "node:net";

High

Child Process

Package source references child process execution.

dist/serve.jsView on unpkg · L1

4import { once } from "node:events";

5import { randomBytes } from "node:crypto";

6import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";

7import { delimiter, join } from "node:path";

8function resolveOpencodeBin() {

9 const override = process.env.COTAL_OPENCODE_BIN?.trim();

10 if (override) return override;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/serve.jsView on unpkg · L1

11 if (process.platform !== "win32") return "opencode";

12 for (const dir of (process.env.PATH ?? "").split(delimiter)) {

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

dist/serve.jsView on unpkg · L1

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/serve.jsView on unpkg · L1

13 if (!dir) continue;

14 for (const exe of [join(dir, "opencode.exe"), join(dir, "node_modules", "opencode-ai", "bin", "opencode.exe")]) {

15 if (existsSync(exe)) return exe;

16 }

17 }

18 return "opencode";

19}

20var BIN = resolveOpencodeBin();

21var USERNAME = "opencode";

dist/index.jsView file

7Cross-file remote execution chain: dist/index.js spawns dist/plugin.bundle.js; helper contains network access plus dynamic code execution. L7: // src/extension.ts L8: import { execFileSync } from "node:child_process"; L9: import { fileURLToPath } from "node:url"; ... L22: import { createHash, randomBytes } from "node:crypto"; L23: function controlEndpoint(space, name, token = randomBytes(32).toString("base64url")) { L24: const id = createHash("sha256").update(`${space}\0${name}\0${process.pid}\0${token}`).digest("base64url").slice(0, 32); L25: const path = process.platform === "win32" ? `\\\\.\\pipe\\cotal-${id}` : join(tmpdir(), `cotal-${id}.sock`); L26: return { path, token }; ... L103: const sourceKey = /* @__PURE__ */ new Map(); L104: for (const k of Object.keys(process.env)) L105: sou

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L7