AI Security Review
scanned 4d ago · by lpm-firewall-aiNo confirmed malicious attack surface was found. The package has powerful, user-invoked OpenCode automation: agent config writes, ClickUp API integration, local Chrome/CDP scripting, and git/systemctl helpers.
Static reason
One or more suspicious static signals were detected.
Trigger
OpenCode loads the plugin or a user invokes Optima tools/CLI.
Impact
Can mutate project Optima/OpenCode config and operate browser/ClickUp/Git helpers when configured or invoked; no evidence of covert exfiltration or install-time execution.
Mechanism
AI workflow orchestration plugin with configured network and local automation tools
Rationale
Static inspection shows a high-capability OpenCode workflow plugin, not a covert npm malware package: there are no lifecycle hooks, no hardcoded exfiltration endpoint, and the network/execution primitives are tied to documented plugin tools and configuration. Because it can write agent control files and execute user-provided browser scripts, a warning is appropriate for dangerous capability rather than a publish block.
Evidence
package.jsonREADME.mdscripts/optima-sanitize-host.jsdist/sanitize_cli.jsdist/index.js.gitignore.optima/.config/optima.yaml.optima/.config/generated/agents/*.md.optima/.config/generated/policies/*.mdprocess.env.OPENCODE_CONFIG_DIR/agents/*.md
Network endpoints5
api.clickup.com/api/v2127.0.0.1:3001127.0.0.1:9223chatgpt.com/auth.openai.com/
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- dist/index.js registers OpenCode agents/tools and writes managed agent markdown to process.env.OPENCODE_CONFIG_DIR/agents/*.md by default.
- dist/index.js exposes optima_qa_chrome_command that runs user-supplied JS via new Function against Playwright/CDP browser sessions.
- dist/index.js can start configured ClickUp webhook listeners and call https://api.clickup.com/api/v2 endpoints with configured tokens.
- dist/index.js uses child_process execFile for git/systemctl, but only in workflow repair/migration/QA autostart paths.
Evidence against
- package.json has no install/preinstall/postinstall/prepare lifecycle execution for consumers.
- README.md describes an OpenCode workflow plugin that installs agents and ClickUp/QA tools; suspicious primitives are aligned with that purpose.
- Network calls require plugin configuration/tool use, not install-time or import-time exfiltration.
- No credential harvesting loop or hardcoded attacker endpoint found; ClickUp token is read for ClickUp API authorization.
- sanitize_cli.js is a bundled CLI wrapper; scripts/optima-sanitize-host.js only dynamically imports source or dist CLI.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourcedist/index.jsView file
9385import path5 from "node:path";
L9386: import { execFileSync } from "node:child_process";
L9387: function toGitPath(worktree, targetPath) {
High
14728if (!script.trim()) return { ok: false, error: "script_required" };
L14729: const fn = new Function("page", "context", "browser", "artifactsDir", `return (async () => {
L14730: ${script}
...
L14736: }
L14737: async function withQaBrowser({ provider = DEFAULT_QA_PROVIDER, cdpUrl = "", clickupTaskId = "", startUrl = "https://chatgpt.com/" } = {}, callback) {
L14738: const chromium = await loadPlaywrightChromium();
L14739: const browser = await chromium.connectOverCDP(normalizeCdpUrl(cdpUrl), {
L14740: timeout: Number(process.env.OPTIMA_QA_PLAYWRIGHT_CONNECT_TIMEOUT_MS || DEFAULT_QA_PLAYWRIGHT_CONNECT_TIMEOUT_MS)
L14741: });
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L1472814172const browser = {};
L14173: const fn = new Function("cdp", "target", "artifactsDir", "command", "page", "context", "browser", `return (async () => {
L14174: ${script}
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/index.jsView on unpkg · L14172scripts/optima-sanitize-host.jsView file
9const cliPath = fs.existsSync(sourceCli) ? sourceCli : distCli;
L10: const { main } = await import(cliPath);
L11:
Medium
Dynamic Require
Package source references dynamic require/import behavior.
scripts/optima-sanitize-host.jsView on unpkg · L9dist/sanitize_cli.jsView file
2592Cross-file remote execution chain: dist/sanitize_cli.js spawns dist/index.js; helper contains network access plus dynamic code execution.
L2592: if (typeof node_buffer.Buffer === "function") {
L2593: return node_buffer.Buffer.from(src, "base64");
L2594: } else if (typeof atob === "function") {
...
L5197: yield* this.next(token);
L5198: yield* this.end(forceDoc, endOffset);
L5199: }
...
L5201: *next(token) {
L5202: if (node_process.env.LOG_STREAM)
L5203: console.dir(token, { depth: null });
...
L7491: // WTF!
L7492: // https://git-scm.com/docs/gitignore
L7493: // changes in [2.22.1](https://git-scm.com/docs/gitignore/2.22.1)
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/sanitize_cli.jsView on unpkg · L2592Findings
4 High3 Medium6 Low
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighCross File Remote Execution Contextdist/sanitize_cli.js
MediumDynamic Requirescripts/optima-sanitize-host.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEvaldist/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License