registry / @nemoobc/opencode-termux / 1.20.18

@nemoobc/opencode-termux@1.20.18

opencode CLI native untuk Termux/Android tanpa proot — membundel binary opencode resmi (upstream opencode 2.2.0) + patch ELF biar jalan native

AI Security Review

scanned 13d ago · by lpm-firewall-ai

Source inspection found an install hook that downloads and assembles the CLI bundle, and a launcher that performs Termux setup and starts it on invocation. The observed behavior is package-aligned and no concrete malicious behavior was identified.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Package installation runs the postinstall hook; launcher actions occur when the user invokes the command.

Impact

These actions support installing and running the Termux CLI; no credential theft, unrelated project mutation, or hidden execution chain was established.

Mechanism

The installer downloads upstream binary and Alpine components into its vendor directory. The launcher creates DNS files only if absent and starts the bundled executable.

AI rationale

Evidence

install.mjsbin/opencode-termux.jspackage.json

Network endpoints3

opencode.aidl-cdn.alpinelinux.orgregistry.npmjs.org

Decision evidence

public snapshot

AI called this Clean at 89.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest's postinstall runs the package's installer.
The installer downloads the configured upstream binary and performs gzip and size checks; it also fetches supporting Alpine components.
The launcher writes DNS configuration only when the files are absent, then runs its bundled CLI when invoked.

Evidence against

The inspected network and file operations align with installing and running the Termux CLI; no credential collection or unrelated control-surface mutation was identified.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 23.2 KB of source, external domains: dl-cdn.alpinelinux.org, opencode.ai, registry.npmjs.org

Source & flagged code

6 flagged

package.jsonView file

•scripts.postinstall = node install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/opencode-termux.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. bin/opencode-termux.js: const res = await fetch(`https://registry.npmjs.org/${reg}/latest`) if (!fs.existsSync(rc)) fs.writeFileSync(rc, "nameserver 1.1.1.1\nnameserver 8.8.8.8\n") if (!fs.existsSync(hh)) fs.writeFileSync(hh, "127.0.0.1 localhost\n") fs.writeFileSync(path.join(root, "package.json"), JSON.stringify(PKG, null, 2) + "\n") const r = spawnSync(process.execPath, ["-e", "fetch('https://registry.npmjs.org/-/ping').then(r=>{if(!r.ok)process.exit(1)})"], {

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

bin/opencode-termux.jsView on unpkg

1#!/usr/bin/env node L2: import { spawnSync } from "child_process" L3: import fs from "fs" ... L6: L7: const __dirname = path.dirname(fileURLToPath(import.meta.url)) L8: const root = path.join(__dirname, "..") ... L11: const bin = path.join(vendor, "opencode") L12: const PKG = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8")) L13: const PREFIX = process.env.TERMUX_PREFIX || "/data/data/com.termux/files/usr" L14: ... L48: const reg = PKG.opencodeUpstream?.startsWith("2.") ? "@opencode/cli" : "opencode-ai" L49: const res = await fetch(`https://registry.npmjs.org/${reg}/latest`)

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/opencode-termux.jsView on unpkg · L1

•matchType = previous_version_dangerous_delta matchedPackage = @nemoobc/opencode-termux@1.20.9 matchedIdentity = npm:[redacted]:1.20.9 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/opencode-termux.jsView on unpkg

prebuilt/ld-musl-aarch64-termux.soView file

•path = prebuilt/ld-musl-aarch64-termux.so kind = native_binary sizeBytes = 969056 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilt/ld-musl-aarch64-termux.soView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/opencode-termux.jsView file

Findings

4 High5 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighEntrypoint Foreign Package Code Overwritebin/opencode-termux.js

HighSandbox Evasion Gated Capabilitybin/opencode-termux.js

HighPrevious Version Dangerous Deltabin/opencode-termux.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binaryprebuilt/ld-musl-aarch64-termux.so

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @nemoobc/opencode-termux@1.20.18.

See all versions of @nemoobc/opencode-termux for other recorded verdicts.

Review the evidence and your use of @nemoobc/opencode-termux@1.20.18 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 23:05:05.477Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.