registry / @leo.gimp/opencode-usage-bar / 2.0.1

@leo.gimp/opencode-usage-bar@2.0.1

OpenCode Go subscription usage bars for the opencode v2 TUI - 5h/weekly/monthly windows, /limit popup

AI Security Review

scanned 11d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Install automatically registers this package as an OpenCode TUI plugin by writing the user's OpenCode cli.json plugins list and copying plugin files into the OpenCode config directory. The usage client later reads the local OpenCode Go key and calls the official usage API.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall, or running the opencode-usage-bar bin, executes scripts/install.mjs.

Impact

OpenCode loads this third-party plugin after install without a separate consent step. The plugin can read the local OpenCode Go credential and query subscription usage at the official endpoint.

Mechanism

The script copies dist into the OpenCode config usage-bar directory and writes or updates the plugins array in cli.json so OpenCode loads that path. A legacy tui.json entry is rewritten only when it already refers to usage-bar.

AI rationale

Postinstall is first-party setup of this package's own OpenCode plugin: it copies its files and adds its path to OpenCode cli.json rather than hijacking a foreign agent surface or exfiltrating secrets. The usage key is forwarded only to the fixed official OpenCode Go usage URL, so the install-time control-surface write is a warning, not a publish block.

Evidence

package.jsonscripts/install.mjsdist/usage.ts~/.config/opencode/cli.json~/.config/opencode/usage-bar~/.config/opencode/tui.json~/.local/share/opencode/opencode.db~/.local/share/opencode/auth.json

Network endpoints1

@leo.gimp/opencode-usage-bar@2.0.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code