registry / @nemoobc/opencode-termux / 1.20.19

@nemoobc/opencode-termux@1.20.19

opencode CLI native untuk Termux/Android tanpa proot — membundel binary opencode resmi (upstream opencode 2.2.0) + patch ELF biar jalan native

AI Security Review

scanned 13d ago · by lpm-firewall-ai

The automatic install behavior is consistent with setting up this Termux OpenCode package and is gated to Android unless explicitly forced. The configuration writes preserve existing user files, and the inspected launcher and installer did not establish a concrete attack surface warranting a warning or block.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Package installation runs postinstall; the launcher’s additional setup runs when the user invokes it.

Impact

These actions alter the Termux environment and may add a default OpenCode configuration, but inspected source showed no credential exfiltration or broad agent-control mutation.

Mechanism

The installer fetches the upstream binary and runtime libraries, creates missing Termux DNS files, and copies package-provided configuration only when no user configuration exists.

AI rationale

Evidence

package.jsoninstall.mjsbin/opencode-termux.js

Network endpoints3

opencode.aidl-cdn.alpinelinux.orgregistry.npmjs.org

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The postinstall hook runs the installer automatically.
The installer skips non-Android systems unless explicitly forced.
On Android, the installer downloads and assembles the OpenCode binary and Termux runtime libraries.
The installer copies a default OpenCode configuration only when the user has no existing configuration.
The launcher creates Termux DNS files if they are missing; no credential collection or unrelated agent-control mutation was identified.

Evidence against

The launcher requires the user to invoke it, and update is a separate command.
The installed default configuration contains only a model selection and key bindings.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 25.4 KB of source, external domains: dl-cdn.alpinelinux.org, opencode.ai, registry.npmjs.org

Source & flagged code

6 flagged

package.jsonView file

Lines 1-30json

2 "name": "@nemoobc/opencode-termux",

3 "version": "1.20.19",

4 "description": "opencode CLI native untuk Termux/Android tanpa proot \u2014 membundel binary opencode resmi (upstream opencode 2.2.0) + patch ELF biar jalan native",

5 "type": "module",

6 "bin": {

7 "opencode-termux": "./bin/opencode-termux.js"

8 },

9 "scripts": {

10 "postinstall": "node install.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 "test": "node test/run.mjs",

12 "test:e2e": "node test/run.mjs --e2e"

13 },

14 "keywords": [

15 "opencode",

16 "termux",

17 "android",

18 "cli",

Low

Suspicious Lifecycle Evidence

The postinstall hook runs the installer automatically.

package.jsonView on unpkg · L10

19 "ai"

20 ],

21 "license": "MIT",

22 "engines": {

23 "node": ">=18"

24 },

25 "files": [

26 "bin",

27 "install.mjs",

28 "lib",

29 "prebuilt",

30 "LICENSE",

bin/opencode-termux.jsView file

Lines 1-21javascript

1#!/data/data/com.termux/files/usr/bin/env node

2import { spawnSync } from "child_process"

3import fs from "fs"

4import path from "path"

5import { fileURLToPath } from "url"

prebuilt/ld-musl-aarch64-termux.soView file

•path = prebuilt/ld-musl-aarch64-termux.so kind = native_binary sizeBytes = 969056 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilt/ld-musl-aarch64-termux.soView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

10"postinstall": "node install.mjs", "test": "node test/run.mjs", "test:e2e": "node test/run.mjs --e2e" }, "keywords": [ "opencode", "termux", "android",

Low

Suspicious Lifecycle Evidence

The postinstall hook runs the installer automatically.

package.jsonView on unpkg · L10

bin/opencode-termux.jsView file

Findings

3 High4 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSandbox Evasion Gated Capabilitybin/opencode-termux.js

HighPrevious Version Dangerous Deltabin/opencode-termux.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumShips Native Binaryprebuilt/ld-musl-aarch64-termux.so

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

Affected versions and remediation

This report applies to @nemoobc/opencode-termux@1.20.19.

See all versions of @nemoobc/opencode-termux for other recorded verdicts.

Review the evidence and your use of @nemoobc/opencode-termux@1.20.19 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 23:05:36.903Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.