Loading npm security reports…

@igovet/opencode-tui-tunnel@0.3.3: Suspicious npm security report | LPM Firewall

registry / @igovet/opencode-tui-tunnel / 0.3.3

@igovet/opencode-tui-tunnel@0.3.3

Web terminal multiplexer for opencode TUI sessions — access your opencode processes from any browser

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Launching a V2 session writes this package's OpenCode notification plugin into the selected project's `.opencode/plugins` directory. The plugin sends limited OpenCode event metadata to the package's local tunnel service. Server startup also performs a package-scoped registry update check and may schedule a global self-update.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

User runs the CLI and creates an OpenCode V2 session; server startup triggers update handling.

Impact

The project gains an event-notification plugin; an enabled default self-update can replace the global package with a newer registry version.

Mechanism

First-party OpenCode plugin deployment, local event forwarding, and package-scoped self-update.

Rationale

No concrete malicious chain was found, and scanner claims of credential exfiltration are not supported by the inspected payloads. The explicit project-level agent plugin deployment and default automatic self-update warrant a warning under the firewall policy.

Evidence

package.jsondist/cli/bin.jsdist/server/index.jsdist/assets/opencode-tui-notify.jsdist/assets/opencode2-plugins/opencode2-tui-notify.jsdist/assets/opencode2-plugins/opencode2-tui-config.json.opencode/plugins/opencode2-tui-notify.js.opencode/plugins/opencode2-tui-config.json

Network endpoints

Source & flagged code

9 flagged · loading source

dist/server/index.jsView file

133}); L134: import { execFile as execFile2 } from "child_process"; L135: import { existsSync as existsSync4, mkdirSync as mkdirSync5, readdirSync as readdirSync2, statSync } from "fs";

High

Child Process

Package source references child process execution.

dist/server/index.jsView on unpkg · L133

3164const escapedDir = needsQuoting ? `"${dirPart.replace(/"/g, '\\"')}"` : dirPart; L3165: const remoteCmd = `bash -c 'find ${escapedDir} -mindepth 1 -maxdepth 1 -type d 2>/dev/null'`; L3166: console.log(

High

Shell

Package source references shell execution.

dist/server/index.jsView on unpkg · L3164

dist/cli/bin.jsView file

85vapidPublicKey: "", L86: vapidPrivateKey: "" L87: }, ... L96: function getConfigDir() { L97: return join(homedir(), ".config", "opencode-tui-tunnel"); L98: } ... L117: const raw = readFileSync(configPath, "utf8"); L118: const parsed = JSON.parse(raw); L119: return mergeDefaults(defaults, parsed); ... L153: }); L154: import { execFile as execFile2 } from "child_process"; L155: import { existsSync as existsSync5, mkdirSync as mkdirSync6, readdirSync as readdirSync2, statSync } from "fs";

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli/bin.jsView on unpkg · L85

85Trigger-reachable chain: manifest.bin -> dist/cli/bin.js L85: vapidPublicKey: "", L86: vapidPrivateKey: "" L87: }, ... L96: function getConfigDir() { L97: return join(homedir(), ".config", "opencode-tui-tunnel"); L98: } ... L117: const raw = readFileSync(configPath, "utf8"); L118: const parsed = JSON.parse(raw); L119: return mergeDefaults(defaults, parsed); ... L153: }); L154: import { execFile as execFile2 } from "child_process"; L155: import { existsSync as existsSync5, mkdirSync as mkdirSync6, readdirSync as readdirSync2, statSync } from "fs";

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli/bin.jsView on unpkg · L85

•matchType = previous_version_dangerous_delta matchedPackage = @igovet/opencode-tui-tunnel@0.3.2 matchedIdentity = npm:[redacted]:0.3.2 similarity = 0.700 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/bin.jsView on unpkg

85Detached bundled service listener: dist/cli/bin.js launches a Node helper and exposes a broad-bound HTTP listener. L85: vapidPublicKey: "", L86: vapidPrivateKey: "" L87: }, ... L96: function getConfigDir() { L97: return join(homedir(), ".config", "opencode-tui-tunnel"); L98: } ... L117: const raw = readFileSync(configPath, "utf8"); L118: const parsed = JSON.parse(raw); L119: return mergeDefaults(defaults, parsed); ... L153: }); L154: import { execFile as execFile2 } from "child_process"; L155: import { existsSync as existsSync5, mkdirSync as mkdirSync6, readdirSync as readdirSync2, statSync } from "fs";

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/cli/bin.jsView on unpkg · L85

85vapidPublicKey: "", L86: vapidPrivateKey: "" L87: }, ... L96: function getConfigDir() { L97: return join(homedir(), ".config", "opencode-tui-tunnel"); L98: } ... L117: const raw = readFileSync(configPath, "utf8"); L118: const parsed = JSON.parse(raw); L119: return mergeDefaults(defaults, parsed); ... L153: }); L154: import { execFile as execFile2 } from "child_process"; L155: import { existsSync as existsSync5, mkdirSync as mkdirSync6, readdirSync as readdirSync2, statSync } from "fs";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/bin.jsView on unpkg · L85

dist/assets/opencode-tui-notify.jsView file

1import { execFile } from 'node:child_process'; L2: import { basename } from 'node:path'; ... L4: L5: const NOTIFY_ENDPOINT = `${process.env.OPENCODE_TUI_TUNNEL_URL ?? 'http://127.0.0.1:4096'}/api/opencode-notify`; L6: const DEDUPE_WINDOW_MS = 1500;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/assets/opencode-tui-notify.jsView on unpkg · L1

dist/web/sounds/notification.mp3View file

•path = dist/web/sounds/notification.mp3 kind = high_entropy_blob sizeBytes = 34272 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/sounds/notification.mp3View on unpkg

Source & flagged code

9 flagged

dist/server/index.jsView file

Lines 113-153javascript

113}

114var CONFIG_VERSION;

115var init_config = __esm({

116 "src/config/index.ts"() {

117 "use strict";

118 CONFIG_VERSION = 3;

119 }

120});

121

122// src/sshfs/adapter.ts

123var adapter_exports = {};

124__export(adapter_exports, {

125 checkSshfsAvailable: () => checkSshfsAvailable,

126 cleanupAllMounts: () => cleanupAllMounts,

127 cleanupStaleMounts: () => cleanupStaleMounts,

128 getMountBaseDir: () => getMountBaseDir,

129 getMountPoint: () => getMountPoint,

130 isMountActive: () => isMountActive,

131 mountRemoteDirectory: () => mountRemoteDirectory,

132 unmountRemoteDirectory: () => unmountRemoteDirectory

133});

134import { execFile as execFile2 } from "child_process";

135import { existsSync as existsSync4, mkdirSync as mkdirSync5, readdirSync as readdirSync2, statSync } from "fs";

High

Child Process

Package source references child process execution.

dist/server/index.jsView on unpkg · L133

136import { homedir as homedir4 } from "os";

137import { join as join7 } from "path";

138import { promisify as promisify2 } from "util";

139function expandHomePath2(inputPath) {

140 if (inputPath === "~") {

141 return homedir4();

142 }

143 if (inputPath.startsWith("~/")) {

144 return join7(homedir4(), inputPath.slice(2));

145 }

146 return inputPath;

147}

148async function checkSshfsAvailable() {

149 try {

150 const { stdout } = await execFileAsync2("which", ["sshfs"]);

151 const path2 = stdout.trim();

152 if (path2.length > 0) {

153 return { available: true, path: path2 };

Lines 3144-3184javascript

3144 const trimmed = partial.trim();

3145 let dirPart;

3146 let prefixPart;

3147 if (trimmed.length === 0 || trimmed ===

dist/cli/bin.jsView file

Lines 65-105javascript

65 scrollbackLines: 5e3,

66 reconnectTokenTtlSeconds: 86400,

67 retainExitedSessionHours: 24

68 },

69 security: {

70 listenMode:

dist/assets/opencode-tui-notify.jsView file

Lines 1-21javascript

1import { execFile } from 'node:child_process';

2import { basename } from 'node:path';

3import { promisify } from 'node:util';

4

5const NOTIFY_ENDPOINT

dist/web/sounds/notification.mp3View file

•path = dist/web/sounds/notification.mp3 kind = high_entropy_blob sizeBytes = 34272 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/sounds/notification.mp3View on unpkg