Loading npm security reports…

@dv.nghiem/flowdeck@0.7.0-alpha.5: AI-agent control-surface risk | LPM Firewall

registry / @dv.nghiem/flowdeck / 0.7.0-alpha.5

@dv.nghiem/flowdeck@0.7.0-alpha.5

FlowDeck — structured planning and execution workflows for OpenCode

AI Security Review

scanned 4d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall mutates the user's OpenCode control surface, then the loaded plugin injects enabled remote MCP integrations. It also obtains and executes/builds remote installer or Git source under install-time conditions.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation with lifecycle scripts enabled; subsequent OpenCode plugin load.

Impact

Activates a third-party agent plugin, changes default agent selection, and configures remote MCP channels that may receive configured API credentials.

Mechanism

unconsented OpenCode config mutation plus install-time remote code acquisition

Policy narrative

Installing the package runs postinstall.mjs without an explicit FlowDeck command. It creates or rewrites OpenCode's user configuration to enable the package and select its orchestrator. The lifecycle hook can clone Git source, install Rust via a downloaded installer, and compile/install fdx. When OpenCode loads the plugin, dist/index.js adds enabled remote MCP services, attaching Context7, Exa, and GitHub credentials when those environment variables exist.

Rationale

The package performs unconsented postinstall mutation of a foreign AI-agent configuration and enables external agent control channels. This meets the firewall blocking boundary even though some functionality is documented.

Evidence

package.jsonpostinstall.mjsdist/index.jsbin/flowdeck.js~/.config/opencode/opencode.json$OPENCODE_CONFIG_DIR/opencode.json~/.local/share/flowdeck~/.cargo/bin/fdx

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

3534import { homedir as homedir3 } from "os"; L3535: import { execFileSync } from "node:child_process"; L3536:

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L3534

1060patternName = generic_password severity = medium line = 1060 matchedText = const in...' };

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L1060

1117npx jest # jest L1118: npm test # package.json test script L1119: \`\`\` ... L1189: // ✅ OK L1190: const API_KEY = process.env.API_KEY; L1191: \`\`\` ... L1412: ✅ Correct citation format: L1413: - \`express@4.18\` — \`res.json()\` automatically sets Content-Type to application/json L1414: Source: https://expressjs.com/en/api.html#res.json L1415: ... L2268: function getGlobalConfigDir() { L2269: return process.env.OPENCODE_CONFIG_DIR || (process.env.XDG_CONFIG_HOME ? join2(process.env.XDG_CONFIG_HOME, "opencode") : join2(homedir(), ".config", "opencode"));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L1117

postinstall.mjsView file

2// Runs after `npm install @dv.nghiem/flowdeck` L3: // Only registers the plugin in opencode.json — agents/skills come from the npm package L4: L5: import { readFileSync, writeFileSync, existsSync, mkdirSync, unlinkSync, createWriteStream } from "node:fs"; L6: import { join, dirname } from "node:path"; ... L124: return ( L125: process.env.OPENCODE_CONFIG_DIR || L126: (process.env.XDG_CONFIG_HOME ... L156: try { L157: mkdirSync(dirname(FLOWDECK_INSTALL_DIR), { recursive: true }); L158: execSync(`git clone --depth 1 --quiet "${FLOWDECK_REPO_URL}" "${FLOWDECK_INSTALL_DIR}"`, { ... L375: const configDir = getOpenCodeConfigDir();

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

postinstall.mjsView on unpkg · L2

333"curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --no-modify-path", L334: { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"], shell: true, timeout: 300_000 } L335: );

High

Shell

Package source references shell execution.

postinstall.mjsView on unpkg · L333

8import { fileURLToPath } from "node:url"; L9: import { execSync, execFileSync } from "node:child_process"; L10: import { get as httpsGet } from "node:https"; L11: import { createInterface } from "node:readline"; ... L16: const FLOWDECK_REPO_URL = "https://github.com/DVNghiem/FlowDeck.git"; L17: const FLOWDECK_INSTALL_DIR = process.env.FLOWDECK_INSTALL_DIR || join(homedir(), ".local", "share", "flowdeck"); L18:

High

bin/flowdeck.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node import { readfilesync, writefilesync, existssync, mkdirsync } from "node:fs"; import { join, dirname } from "node:path"; import { homedir } from "node:os"; import { fileurltopath } from "node:url"; const __dirname = dirname(fileurltopath(import.meta.url)); const pkgroot = join(__dirname, ".."); const args = process.argv.slice(2); if (args.includes("--help") || args.includes("-h") || args.includes("help")) { console.log(` flowdeck — structured planning and execution workflows for opencode usage: npx @dv.nghiem/flowdeck install flowdeck globally (~/.config/open

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/flowdeck.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 11-51json

11 "import": "./dist/index.js"

12 }

13 },

14 "bin": {

15 "flowdeck": "./bin/flowdeck.js"

16 },

17 "files": [

18 "dist",

19 "bin",

20 "src/commands",

21 "src/rules",

22 "src/skills",

23 "docs",

24 "postinstall.mjs"

25 ],

26 "scripts": {

27 "clean": "rm -rf dist",

28 "build": "bun build src/index.ts --outdir dist --target node --format esm --external @opencode-ai/plugin --external @opencode-ai/sdk && tsc --emitDeclarationOnly --project tsconfig.build.json",

29 "build:fdx": "cargo install --path crates/fdx --quiet",

30 "check:fdx": "fdx --version",

31 "postinstall": "node postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 "prepublishOnly": "bun run clean && bun run build",

33 "test": "bun test",

34 "typecheck": "tsc --noEmit",

35 "validate:skills": "node scripts/validate-skills.mjs",

36 "validate:docs": "node scripts/validate-docs.mjs"

37 },

38 "keywords": [

39 "opencode",

40 "plugin",

41 "ai",

42 "workflow",

43 "planning"

44 ],

45 "author": "DVNghiem",

46 "license": "MIT",

47 "repository": {

48 "type": "git",

49 "url": "git+https://github.com/DVNghiem/FlowDeck.git"

50 },

51 "bugs": {

dist/index.jsView file

Lines 1040-1080javascript

1040 let mockDb: MockDatabase;

1041

1042 beforeEach(() => {

1043 mockDb = createMockDb();

1044 service = new

postinstall.mjsView file

Lines 1-28javascript

1// postinstall.mjs

2// Runs after `npm install @dv.nghiem/flowdeck`

3// Only registers the plugin in opencode.json — agents/skills come from the npm package

4

5import { readFileSync, writeFileSync, existsSync, mkdirSync, unlinkSync, createWriteStream } from "node:fs";

6import { join, dirname } from "node:path";

7import { homedir }

bin/flowdeck.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node import { readfilesync, writefilesync, existssync, mkdirsync } from "node:fs"; import { join, dirname } from "node:path"; import { homedir } from "node:os"; import { fileurltopath } from "node:url"; const __dirname = dirname(fileurltopath(import.meta.url)); const pkgroot = join(__dirname, ".."); const args = process.argv.slice(2); if (args.includes("--help") || args.includes("-h") || args.includes("help")) { console.log(` flowdeck — structured planning and execution workflows for opencode usage: npx @dv.nghiem/flowdeck install flowdeck globally (~/.config/open

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/flowdeck.jsView on unpkg