registry / AI-agent control-surface risk / @nemoobc/opencode-termux

@nemoobc/opencode-termux

opencode CLI native untuk Termux/Android tanpa proot — membundel loader musl + binary opencode resmi (upstream opencode-ai)

This report shows the evidence for @nemoobc/opencode-termux@1.20.11. 6 of 18 known versions are blocked or flagged. The newest version, 1.20.20, is allowed. See all versions.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The automatic lifecycle hook mutates a global OpenCode agent configuration and deploys high-capability autonomous agent definitions. This is a concrete unconsented AI-agent control-surface takeover, despite platform gating and package-aligned download endpoints.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall on Android, or a forced installation.

Impact

Future OpenCode use can load package-supplied agents with shell, file-write, edit, and task capabilities.

Mechanism

Postinstall copies bundled AI-agent files into the user's OpenCode configuration directory.

Policy narrative

The package runs install.mjs automatically after npm installation. On Android it creates the user's global OpenCode configuration directory and copies all shipped agent and command files there, overwriting colliding agent names. One deployed primary agent is configured with shell, write, edit, and task capabilities for autonomous workflows. This is an unconsented install-time mutation of a separate AI-agent control surface, so later OpenCode sessions may execute package-provided instructions with those capabilities.

AI rationale

Evidence

package.jsoninstall.mjsagents/autodev.md$HOME/.config/opencode/agent$HOME/.config/opencode/command$HOME/.config/opencode/opencode.json/data/data/com.termux/files/usr/etc/resolv.conf/data/data/com.termux/files/usr/etc/hosts

Network endpoints2

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

The npm postinstall hook automatically runs the installer.
On Android, the installer creates the user's global OpenCode configuration directory and copies bundled agents and commands into it, overwriting same-named files.
A copied primary agent is granted shell, file-write, edit, and task capabilities and directs autonomous work without asking.
The package also installs a default OpenCode configuration when one is absent.

Evidence against

The lifecycle installer exits on non-Android platforms unless forced.
Network downloads are limited to npm and Alpine endpoints, and the upstream binary archive is checked against registry SHA-512 metadata.
No source code was found that collects or exfiltrates credentials or environment secrets.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

12 flagged

package.jsonView file

Lines 1-30json

2 "name": "@nemoobc/opencode-termux",

3 "version": "1.20.11",

4 "description": "opencode CLI native untuk Termux/Android tanpa proot \u2014 membundel loader musl + binary opencode resmi (upstream opencode-ai)",

5 "type": "module",

6 "bin": {

7 "opencode-termux": "./bin/opencode-termux.js"

8 },

9 "scripts": {

10 "postinstall": "node install.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 "test": "node test/run.mjs",

12 "test:e2e": "node test/run.mjs --e2e",

13 "lint": "echo 'No linter configured'",

14 "typecheck": "tsc --noEmit",

15 "build": "tsc"

16 },

17 "keywords": [

18 "opencode",

19 "termux",

20 "android",

21 "cli",

22 "ai"

23 ],

24 "license": "MIT",

25 "engines": {

26 "node": ">=18"

27 },

28 "files": [

29 "bin",

30 "install.mjs",

bin/opencode-termux.tsView file

Lines 1-21typescript

1#!/usr/bin/env node

2import { spawnSync } from "child_process"

3import fs from "fs"

High

Child Process

Package source references child process execution.

bin/opencode-termux.tsView on unpkg · L1

4import path from "path"

5import

bin/opencode-termux.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. bin/opencode-termux.js: if (!fs.existsSync(rc)) fs.writeFileSync(rc, "nameserver 1.1.1.1\nnameserver 8.8.8.8\n") if (!fs.existsSync(hh)) fs.writeFileSync(hh, "127.0.0.1 localhost\n") const latest = await (await fetch("https://registry.npmjs.org/opencode-ai/latest")).json() fs.writeFileSync(path.join(root, "package.json"), JSON.stringify(PKG, null, 2) + "\n") const r = spawnSync(process.execPath, ["-e", "fetch('https://registry.npmjs.org/-/ping').then(r=>{if(!r.ok)process.exit(1)})"], {

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

bin/opencode-termux.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @nemoobc/opencode-termux@1.20.7 matchedPath = bin/opencode-termux.js matchedIdentity = npm:[redacted]:1.20.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/opencode-termux.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 2f796703aa085ce3 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @nemoobc/opencode-termux@1.20.7 matchedPath = bin/opencode-termux.js matchedIdentity = npm:[redacted]:1.20.7 similarity = 1.000 shingleOverlap = 7 summary = package final verdict is malicious

install.mjsView file

Lines 6-46javascript

6 * Target: Termux (android/arm64). Override uji: OCX_ARCH=x64 OCX_FORCE=1

7 */

8import fs from "fs"

9import

prebuilt/ld-musl-aarch64-termux.soView file

•path = prebuilt/ld-musl-aarch64-termux.so kind = native_binary sizeBytes = 969056 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilt/ld-musl-aarch64-termux.soView on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/opencode-termux.tsView file

1#!/usr/bin/env node L2: import { spawnSync } from "child_process" L3: import fs from "fs"

High

Child Process

Package source references child process execution.

bin/opencode-termux.tsView on unpkg · L1

Findings

1 Critical10 High5 Medium4 Low

CriticalAi Agent Control Hijackinstall.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/opencode-termux.ts

HighShell

HighSame File Env Network Executionbin/opencode-termux.ts

HighEntrypoint Foreign Package Code Overwritebin/opencode-termux.js

HighSandbox Evasion Gated Capabilitybin/opencode-termux.ts

HighKnown Malware Source Similaritybin/opencode-termux.js

HighKnown Malware Source Similaritybin/opencode-termux.ts

HighKnown Malware Source Similarityinstall.mjs

HighKnown Malware Source Fingerprint Signaturebin/opencode-termux.js

Affected versions and remediation

This report applies to @nemoobc/opencode-termux@1.20.11.

The versions list below shows the verdict for each recorded version.

Avoid installing @nemoobc/opencode-termux@1.20.11. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-15 23:41:48.116Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

18 known versions

1.20.20latestClean—AllowPublishedOct 19, 2026, 2:39 AM 1.20.19Clean—AllowPublishedOct 1, 2026, 4:09 AM 1.20.18Clean—AllowPublishedSep 22, 2026, 3:57 PM 1.20.17SuspiciousAgent extension lifecycle riskWarnPublishedSep 22, 2026, 10:35 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Behavioral surface

Source & flagged code

Related packages

Other AI-agent control-surface risk packages