@hallaxius/nim-booster
OpenCode plugin that supercharges NVIDIA NIM providers — health-score key rotation, adaptive throttling, and automatic proxy rotation via webshare.io.
This report shows the evidence for @hallaxius/nim-booster@1.1.1. 4 of 7 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic inspection confirms install-time writes to OpenCode control-surface configs; under the firewall policy this is blocking behavior even though the implementation otherwise appears package-aligned and documented. No separate exfiltration or destructive payload was found. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.
Decision evidence
public snapshot- package.json postinstall runs `node dist/bin.js init` and `init-project` automatically
- dist/bin.js dispatches install-time `init` to `updateOpenCodeConfigs` and `init-project` to `writeProjectBoosterConfig`
- dist/config-installer.js writes OpenCode `opencode.json` and `tui.json` plugin entries for `@hallaxius/nim-booster`
- dist/config-installer.js creates default `nim-booster/config.json` and project `booster.jsonc` without an explicit user CLI invocation
- dist/proxy/store.js contacts `https://proxy.webshare.io/api/v2/proxy/list/` only when proxy features are configured
- No child_process, eval, dynamic code loading, or obfuscated payload found in inspected dist files
- Network access is package-aligned Webshare proxy API and gated by configured token/proxy use
- No evidence of credential exfiltration; tokens/keys are stored locally for the plugin feature
- README documents the postinstall OpenCode config modification behavior
Source & flagged code
2 flagged · loading sourceInstall-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to @hallaxius/nim-booster@1.1.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing @hallaxius/nim-booster@1.1.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.