Loading npm security reports…

@cotal-ai/connector-opencode@0.50.1: Suspicious npm security | LPM Firewall

registry / @cotal-ai/connector-opencode / 0.50.1

@cotal-ai/connector-opencode@0.50.1

Cotal connector for OpenCode: a native in-process plugin that joins a session to the mesh.

AI Security Review

scanned 16d ago · by lpm-firewall-ai

No attack was identified. The package is a user-invoked OpenCode connector that registers a local launcher and, when that launcher runs, starts opencode on 127.0.0.1 and joins a mesh only if the launcher supplied an identity.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A caller invokes the connector launch, which executes dist/serve.js. Importing dist/index.js only registers the connector and does not start a process.

Impact

No install-time file or agent-config mutation, secret harvesting, or unsolicited remote execution was found.

Mechanism

serve.js spawns the local opencode binary bound to loopback. The bundled plugin returns immediately without a COTAL identity and otherwise talks to the configured local OpenCode server.

AI rationale

Inspection of package.json and the three published bundles shows no npm lifecycle hook and no import-time launch. Process spawn and mesh join happen only through the connector launch path and stay on the local OpenCode server unless the operator configured a mesh.

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Why the final policy warns

The AI recommended clean, but the final policy action is warn. This report does not record a matching static-policy override reason.

Evidence for AI clean decision

package.json has no preinstall, install, or postinstall hook; the published entry is dist/index.js.

Source & flagged code

7 flagged · loading source

dist/serve.jsView file

1// src/serve.ts L2: import { execFileSync, spawn } from "node:child_process"; L3: import { createServer } from "node:net"; L4: import { once } from "node:events"; ... L8: function resolveOpencodeBin() { L9: const override = process.env.COTAL_OPENCODE_BIN?.trim() || process.env.COTAL_OPENCODE_RESOLVED_BIN?.trim(); L10: if (override) return override; L11: if (process.platform !== "win32") return "opencode"; L12: for (const dir of (process.env.PATH ?? "").split(delimiter)) { ... L31: async function killServe(serve) { L32: if (serve.exitCode !== null || serve.signalCode !== null) return; L33: serve.kill("SIGTERM");

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

dist/serve.jsView on unpkg · L1

1// src/serve.ts L2: import { execFileSync, spawn } from "node:child_process"; L3: import { createServer } from "node:net";

High

Child Process

Package source references child process execution.

dist/serve.jsView on unpkg · L1

1// src/serve.ts L2: import { execFileSync, spawn } from "node:child_process"; L3: import { createServer } from "node:net"; L4: import { once } from "node:events"; ... L8: function resolveOpencodeBin() { L9: const override = process.env.COTAL_OPENCODE_BIN?.trim() || process.env.COTAL_OPENCODE_RESOLVED_BIN?.trim(); L10: if (override) return override;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/serve.jsView on unpkg · L1

1// src/serve.ts L2: import { execFileSync, spawn } from "node:child_process"; L3: import { createServer } from "node:net"; L4: import { once } from "node:events"; ... L8: function resolveOpencodeBin() { L9: const override = process.env.COTAL_OPENCODE_BIN?.trim() || process.env.COTAL_OPENCODE_RESOLVED_BIN?.trim(); L10: if (override) return override; L11: if (process.platform !== "win32") return "opencode"; L12: for (const dir of (process.env.PATH ?? "").split(delimiter)) { ... L31: async function killServe(serve) { L32: if (serve.exitCode !== null || serve.signalCode !== null) return; L33: serve.kill("SIGTERM");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/serve.jsView on unpkg · L1

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @cotal-ai/connector-opencode@0.49.0 matchedIdentity = npm:[redacted]:0.49.0 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

7Cross-file remote execution chain: dist/index.js spawns dist/plugin.bundle.js; helper contains network access plus dynamic code execution. L7: // src/extension.ts L8: import { execFileSync } from "node:child_process"; L9: import { fileURLToPath } from "node:url"; ... L24: import { createHash, randomBytes } from "node:crypto"; L25: var SUN_PATH_MAX_BYTES = process.platform === "darwin" ? 104 : 108; L26: function controlEndpoint(space, name, token = randomBytes(32).toString("base64url")) { L27: const id = createHash("sha256").update(`${space}\0${name}\0${process.pid}\0${token}`).digest("base64url").slice(0, 32); ... L116: const sourceKey = /* @__PURE__ */ new Map(); L117: for (const k of Object.keys(process.env)) L118: sourceKey.set(k.toLowerCase(), k); ... L1809: error: new (_Err ?? $ZodErr

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L7

dist/plugin.bundle.jsView file

•matchType = normalized_sha256 matchedPackage = @cotal-ai/connector-opencode@0.29.0 matchedPath = dist/plugin.bundle.js matchedIdentity = npm:[redacted]:0.29.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin.bundle.jsView on unpkg

Source & flagged code

7 flagged

dist/serve.jsView file

Lines 1-21javascript

1// src/serve.ts

2import { execFileSync, spawn } from "node:child_process";

3import { createServer } from "node:net";

High

Child Process

Package source references child process execution.

dist/serve.jsView on unpkg · L1

4import { once } from "node:events";

5import { randomBytes } from "node:crypto";

6import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";

7import { delimiter, join } from "node:path";

8function resolveOpencodeBin() {

9 const override = process.env.COTAL_OPENCODE_BIN?.trim() || process.env.COTAL_OPENCODE_RESOLVED_BIN?.trim();

10 if (override) return override;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/serve.jsView on unpkg · L1

11 if (process.platform !== "win32") return "opencode";

12 for (const dir of (process.env.PATH ?? "").split(delimiter)) {

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

dist/serve.jsView on unpkg · L1

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/serve.jsView on unpkg · L1

13 if (!dir) continue;

14 for (const exe of [join(dir, "opencode.exe"), join(dir, "node_modules", "opencode-ai", "bin", "opencode.exe")]) {

15 if (existsSync(exe)) return exe;

16 }

17 }

18 return "opencode";

19}

20var BIN = resolveOpencodeBin();

21var USERNAME = "opencode";

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @cotal-ai/connector-opencode@0.49.0 matchedIdentity = npm:[redacted]:0.49.0 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

7Cross-file remote execution chain: dist/index.js spawns dist/plugin.bundle.js; helper contains network access plus dynamic code execution. L7: // src/extension.ts L8: import { execFileSync } from "node:child_process"; L9: import { fileURLToPath } from "node:url"; ... L24: import { createHash, randomBytes } from "node:crypto"; L25: var SUN_PATH_MAX_BYTES = process.platform === "darwin" ? 104 : 108; L26: function controlEndpoint(space, name, token = randomBytes(32).toString("base64url")) { L27: const id = createHash("sha256").update(`${space}\0${name}\0${process.pid}\0${token}`).digest("base64url").slice(0, 32); ... L116: const sourceKey = /* @__PURE__ */ new Map(); L117: for (const k of Object.keys(process.env)) L118: sourceKey.set(k.toLowerCase(), k); ... L1809: error: new (_Err ?? $ZodErr

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L7

dist/plugin.bundle.jsView file

•matchType = normalized_sha256 matchedPackage = @cotal-ai/connector-opencode@0.29.0 matchedPath = dist/plugin.bundle.js matchedIdentity = npm:[redacted]:0.29.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin.bundle.jsView on unpkg