Loading npm security reports…

@kkcode-app/opencode@1.0.7: Suspicious npm security report (Warn) | LPM Firewall

registry / @kkcode-app/opencode / 1.0.7

@kkcode-app/opencode@1.0.7

Connect OpenCode to KKCode and send actionable iPhone notifications.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 64.9 KB of source, external domains: api.kkcode.app

Source & flagged code

2 flagged

dist/service.jsView file

Lines 1-21javascript

1/**

2 * [INPUT]: 依赖 node:fs/promises、node:child_process、node:path、node:os

3 * [OUTPUT]: 对外提供 installService、uninstallService、stopService、restartService、serviceStatus

High

Child Process

Package source references child process execution.

dist/service.jsView on unpkg · L1

4 * [POS]: cli 的后台服务管理器，被 index.ts 的 --install/--uninstall/--stop/--restart/--status 调用

5 * macOS → launchd LaunchAgent (kickstart -k 重启), Linux → systemd user service (restart)

6 * 生成 /bin/sh wrapper 脚本动态解析 node，避免硬编码 node 路径

7 * [PROTOCOL]: 变更时更新此头部，然后检查 CLAUDE.md

8 */

9import { spawnSync } from "node:child_process";

10import { mkdir, readFile, rm, writeFile } from "node:fs/promises";

11import { homedir, platform } from "node:os";

12import { dirname, join } from "node:path";

13import { fileURLToPath } from "node:url";

14const SERVICE_NAME = "kkcode-tunnel";

15const LABEL = "app.kkcode.tunnel";

16const LOG_DIR = join(homedir(), ".config", "kkcode", "tunnel");

17const LOG_FILE = join(LOG_DIR, "tunnel.log");

18function detectServiceManager() {

19 const plat = platform();

20 if (plat === "darwin")

21 return "launchd";

Lines 176-216javascript

176 const envPath = process.env.PATH ?? `/usr/local/bin:/usr/bin:/bin`;

177 return { scriptPath, envPath };

178}

179// ── public API ─────────────────────────────────────────────────

180export async function installService(

Source & flagged code

2 flagged · loading source

dist/service.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code