registry / @nemoobc/opencode-termux / 1.18.22

@nemoobc/opencode-termux@1.18.22

Superseded - gunakan versi >= 1.19.1

opencode CLI native untuk Termux/Android tanpa proot — membundel loader musl + binary opencode resmi (upstream opencode-ai)

AI Security Review

scanned 13d ago · by lpm-firewall-ai

At postinstall on Android, the package fetches a mutable upstream native executable and executes it for a smoke test. No integrity pin or signature verification protects that remote payload.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall on Android/Termux, or explicit CLI use when vendor files are absent

Impact

A compromised or substituted upstream artifact can run during installation.

Mechanism

downloads and executes a mutable upstream native binary

Rationale

The reviewed source establishes an install-time unverified remote-native-payload chain but no concrete malicious action. Treat it as a staged payload carrier and warn rather than block.

Evidence

package.jsoninstall.mjsbin/opencode.js.buildvendorvendor/opencodevendor/ld-musl.so

Network endpoints4

registry.npmjs.org/opencode-ai/latestregistry.npmjs.org/opencode-linux-${ARCH}-musl/-/opencode-linux-${ARCH}-musl-${V}.tgzdl-cdn.alpinelinux.org/alpine/${AV}/releases/${A}/alpine-minirootfs-${AL}-${A}.tar.gzdl-cdn.alpinelinux.org/alpine/${AV}/main/${A}/${f}

@nemoobc/opencode-termux@1.18.22

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code