registry / @dawipong/opcflow / 0.9.0

@dawipong/opcflow@0.9.0

Spec-anchored, drift-enforced execution layer for AI coding agents — artifact DAG, trust gates, multi-role pipeline; generates agents/MCP/hooks for Claude Code, Codex, OpenCode & Cursor.

AI Security Review

scanned 1h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

User runs opcflow init, gen-agents, install-hooks, serve, mcp, or hook commands.

Impact

Project AI agents and git hooks may execute opcflow hook commands and enforce/observe workflow gates.

Mechanism

explicit project scaffolding and agent/MCP/hook generation

Rationale

Static inspection supports a warning for explicit AI-agent/MCP/hook setup capability, not a publish block. The suspicious primitives are documented and user-invoked, with no concrete malicious chain or install-time mutation found.

Evidence

package.jsondist/cli.mjsREADME.en.mdweb/dist/index.htmlweb/dist/assets/chunk-KEIR6QF5-BfrZ3jm6.jsworkbench.config.jsondocs/.workbench/workbench.db.workbench/approvals.json.workbench/approved/<artifactId>.mcp.json.claude/settings.json.claude/agents/<role>.md.codex/config.toml.codex/agents/<role>.toml.agents/skills/opencode.json.opencode/plugins/opcflow.ts.opencode/agents/<role>.md.cursor/mcp.json.cursor/hooks.json

Network endpoints3

models.dev/api.jsonopencode.ai/config.json127.0.0.1:5620

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

dist/cli.mjs init writes AI-agent configs/hooks for .claude, .codex, .cursor, .opencode and MCP registrations.
dist/cli.mjs install-hooks writes .git/hooks/post-commit and optionally prepare-commit-msg.
dist/cli.mjs generated OpenCode plugin spawns configured hook commands on tool events.
dist/cli.mjs can run user-configured machineChecks via execSync and uses gh/git commands for project workflows.

Evidence against

package.json has only prepublishOnly; no preinstall/install/postinstall runtime mutation.
AI-agent config writes occur from explicit CLI commands such as init/gen-agents/install-hooks, not package install or import.
Network use is package-aligned: model selection fetches https://models.dev/api.json and serve binds local Fastify UI.
No credential harvesting, hidden exfiltration endpoint, remote payload loader, destructive behavior, or persistence outside declared workflow found.
Trojan-source hint was in bundled web dependency code; inspection did not show an attack chain tied to package logic.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 96 file(s), 4.69 MB of source, external domains: 127.0.0.1, cdn.jsdelivr.net, chevrotain.io, en.wikipedia.org, github.com, langium.org, opencode.ai, reactflow.dev, reactjs.org, www.w3.org

Source & flagged code

3 flagged

dist/cli.mjsView file

Lines 1-39javascript

1#!/usr/bin/env node

2var __defProp = Object.defineProperty;

3var __getOwnPropNames = Object.getOwnPropertyNames;

4var __esm = (fn, res, err) => function __init() {

5 if (err) throw err[0];

6 try {

7 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

8 } catch (e) {

9 throw err = [e], e;

10 }

11};

12var __export = (target, all) => {

13 for (var name in all)

14 __defProp(target, name, { get: all[name], enumerable: true });

15};

17// core/config.ts

18import { existsSync, readFileSync } from "node:fs";

19import { dirname, join, resolve } from "node:path";

20function findProjectRoot(from = process.cwd()) {

21 let dir = resolve(from);

22 while (true) {

23 if (existsSync(join(dir, CONFIG_FILENAME))) return dir;

24 const parent = dirname(dir);

25 if (parent === dir) return resolve(from);

26 dir = parent;

27 }

28}

29function loadConfig(root) {

30 const file = join(root, CONFIG_FILENAME);

31 if (!existsSync(file)) return { ...DEFAULTS };

32 const raw = JSON.parse(

33 readFileSync(file, "utf-8")

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.mjsView on unpkg · L19

34 );

35 return {

36 ...DEFAULTS,

37 ...raw,

38 docs: { ...DEFAULTS.docs, ...raw.docs },

39 gates: { ...DEFAULTS.gates, ...raw.gates },

•matchType = previous_version_dangerous_delta matchedPackage = @dawipong/opcflow@0.8.0 matchedIdentity = npm:QGRhd2lwb25nL29wY2Zsb3c:0.8.0 similarity = 0.990 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.mjsView on unpkg

web/dist/assets/chunk-KEIR6QF5-BfrZ3jm6.jsView file

46contains invisible/control Unicode U+FEFF (zero width no-break space) \r \v \xA0  \u2028\u2029  　<U+FEFF>`.split(``);function Da(e){let t=typeof e==`string`?new RegExp(e):e;return Ea.some(e=>t.test(e))}o(Da,`isWhitespace`);function Oa(e){return e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`)}o(Oa,`escapeReg

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

web/dist/assets/chunk-KEIR6QF5-BfrZ3jm6.jsView on unpkg · L46

Source & flagged code

3 flagged · loading source

dist/cli.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.mjsView on unpkg

19import { dirname, join, resolve } from "node:path"; L20: function findProjectRoot(from = process.cwd()) { L21: let dir = resolve(from); ... L31: if (!existsSync(file)) return { ...DEFAULTS }; L32: const raw = JSON.parse( L33: readFileSync(file, "utf-8") ... L348: IGNORE_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", ".workbench"]); L349: IGNORE_FILES = /* @__PURE__ */ new Set(["pnpm-lock.yaml", "package-lock.json", "yarn.lock", ".DS_Store", "Thumbs.db"]); L350: } ... L517: }), L518: respondBlocked: (msg) => ({ exitCode: 2, stderr: msg }), L519: formatModel: (_providerId, modelId) => modelId,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.mjsView on unpkg · L19

web/dist/assets/chunk-KEIR6QF5-BfrZ3jm6.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

web/dist/assets/chunk-KEIR6QF5-BfrZ3jm6.jsView on unpkg · L46

Findings

1 Critical1 High4 Medium7 Low

CriticalTrojan Source Unicodeweb/dist/assets/chunk-KEIR6QF5-BfrZ3jm6.js

HighPrevious Version Dangerous Deltadist/cli.mjs

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/cli.mjs

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/cli.mjsView file

Lines 1-39javascript

1#!/usr/bin/env node

2var __defProp = Object.defineProperty;

3var __getOwnPropNames = Object.getOwnPropertyNames;

4var __esm = (fn, res, err) => function __init() {

5 if (err) throw err[0];

6 try {

7 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

8 } catch (e) {

9 throw err = [e], e;

10 }

11};

12var __export = (target, all) => {

13 for (var name in all)

14 __defProp(target, name, { get: all[name], enumerable: true });

15};

17// core/config.ts

18import { existsSync, readFileSync } from "node:fs";

19import { dirname, join, resolve } from "node:path";

20function findProjectRoot(from = process.cwd()) {

21 let dir = resolve(from);

22 while (true) {

23 if (existsSync(join(dir, CONFIG_FILENAME))) return dir;

24 const parent = dirname(dir);

25 if (parent === dir) return resolve(from);

26 dir = parent;

27 }

28}

29function loadConfig(root) {

30 const file = join(root, CONFIG_FILENAME);

31 if (!existsSync(file)) return { ...DEFAULTS };

32 const raw = JSON.parse(

33 readFileSync(file, "utf-8")

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.mjsView on unpkg · L19

34 );

35 return {

36 ...DEFAULTS,

37 ...raw,

38 docs: { ...DEFAULTS.docs, ...raw.docs },

39 gates: { ...DEFAULTS.gates, ...raw.gates },

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.mjsView on unpkg

web/dist/assets/chunk-KEIR6QF5-BfrZ3jm6.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

web/dist/assets/chunk-KEIR6QF5-BfrZ3jm6.jsView on unpkg · L46