registry / @nemoobc/opencode-termux / 1.20.15
@nemoobc/opencode-termux@1.20.15
opencode CLI native untuk Termux/Android tanpa proot — membundel binary opencode resmi (upstream opencode 2.2.0) + patch ELF biar jalan native
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe inspected lifecycle and launcher behavior supports the package’s stated Termux CLI purpose: install upstream runtime components, prepare local DNS configuration, and run the bundled CLI. Network access and execution are package-aligned, and no concrete attack behavior was found.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Package installation runs the postinstall script; invoking the launcher runs the CLI, and the explicit update command runs the installer again.
Impact
The inspected behavior supplies the package’s intended CLI functionality; no concrete malicious effect was established.
Mechanism
The installer retrieves the upstream binary and supporting Alpine libraries, then builds a local vendor directory. The launcher invokes that binary and forwards user arguments.
AI rationale
The inspected lifecycle and launcher behavior supports the package’s stated Termux CLI purpose: install upstream runtime components, prepare local DNS configuration, and run the bundled CLI. Network access and execution are package-aligned, and no concrete attack behavior was found.
Evidence
vendor//data/data/com.termux/files/usr/etc/resolv.conf/data/data/com.termux/files/usr/etc/hosts
Network endpoints3
opencode.aidl-cdn.alpinelinux.orgregistry.npmjs.org
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes the Termux launcher and runs install.mjs after installation.
- The launcher dispatches user commands to its bundled opencode binary and provides explicit update, doctor, and version commands.
- The installer downloads the upstream opencode binary from opencode.ai; this matches the package’s CLI wrapper purpose.
- The installer checks the downloaded archive and extracts it into its build directory.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node install.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/opencode-termux.jsView file
•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
bin/opencode-termux.js:
const res = await fetch(`https://registry.npmjs.org/${reg}/latest`)
if (!fs.existsSync(rc)) fs.writeFileSync(rc, "nameserver 1.1.1.1\nnameserver 8.8.8.8\n")
if (!fs.existsSync(hh)) fs.writeFileSync(hh, "127.0.0.1 localhost\n")
fs.writeFileSync(path.join(root, "package.json"), JSON.stringify(PKG, null, 2) + "\n")
const r = spawnSync(process.execPath, ["-e", "fetch('https://registry.npmjs.org/-/ping').then(r=>{if(!r.ok)process.exit(1)})"], {
Findings
4 High5 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighEntrypoint Foreign Package Code Overwritebin/opencode-termux.js
HighSandbox Evasion Gated Capabilitybin/opencode-termux.js
HighPrevious Version Dangerous Deltabin/opencode-termux.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binaryprebuilt/ld-musl-aarch64-termux.so
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @nemoobc/opencode-termux@1.20.15.
See all versions of @nemoobc/opencode-termux for other recorded verdicts.
- Review the evidence and your use of @nemoobc/opencode-termux@1.20.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.