registry  /  @leohenon/ocv  /  1.17.12-ocv.4.4

@leohenon/ocv@1.17.12-ocv.4.4

ocv (OpenCode fork with vim keybindings).

AI Security Review

scanned 16d ago · by lpm-firewall-ai

The package installs a native ocv binary during npm postinstall and later runs it through the ocv CLI wrapper. This is a normal binary-distribution pattern, but no checksum is enforced.

Static reason
One or more suspicious static signals were detected.
Trigger
npm install runs postinstall; user runs ocv CLI
Impact
Executes downloaded release binary for the advertised CLI; no confirmed malicious behavior in package source
Mechanism
download-and-execute package-aligned native binary
Rationale
Static inspection confirms an install-time binary download and CLI execution wrapper, but the behavior matches the package purpose and points to the declared upstream release host. No source evidence of exfiltration, persistence, destructive actions, or unconsented control-surface mutation was found.
Evidence
package.jsonpostinstall.cjsbin/ocvREADME.mdbin/.ocvbin/.ocv.exe
Network endpoints1
github.com/leohenon/opencode-vim/releases/download

Decision evidence

public snapshot
AI called this Clean at 86.0% confidence as Benign with medium false-positive risk.
Evidence for block
  • package.json defines postinstall: node ./postinstall.cjs
  • postinstall.cjs downloads platform binary with fetch() and writes bin/.ocv
  • bin/ocv executes bin/.ocv, or user-specified OCV_BIN_PATH when invoked
Evidence against
  • Network URL is package-aligned GitHub releases for leohenon/opencode-vim
  • No credential, env, home-directory, or project-file harvesting found
  • No persistence, destructive behavior, reviewer prompt injection, or AI-agent control writes found
  • child_process use is limited to platform probes and CLI binary execution
  • No hidden extra package files beyond package.json, postinstall.cjs, bin/ocv, README.md, LICENSE
Behavioral surface
Source
ChildProcessEnvironmentVarsFilesystemNetwork
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 3.59 KB of source, external domains: github.com

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = node ./postinstall.cjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node ./postinstall.cjs
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High3 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowUrl Strings