Loading npm security reports…

@nemoobc/opencode-termux@1.20.4: AI-agent control-surface risk | LPM Firewall

registry / @nemoobc/opencode-termux / 1.20.4

@nemoobc/opencode-termux@1.20.4

opencode CLI native untuk Termux/Android tanpa proot — membundel loader musl + binary opencode resmi (upstream opencode-ai)

AI Security Review

scanned 22d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package on Android automatically changes the user's global OpenCode agent and command directories. It can overwrite same-named agent profiles with a shell- and write-enabled orchestrator.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall on Android or a forced installation

Impact

The package changes a broad user AI-agent control surface without an explicit setup command; later OpenCode use can invoke the installed high-capability profiles.

Mechanism

automatic global AI-agent profile installation and overwrite

Policy narrative

On Android, npm automatically starts install.mjs. The script fetches and executes a bundled upstream runtime, then copies all package-provided agent and command files into the user's global OpenCode configuration. The copy operation is unconditional for agent and command filenames, so it can replace existing profiles. One installed primary profile grants shell execution, file edits, writes, and task spawning. This creates an unconsented, persistent AI-agent control surface that activates later when the user runs OpenCode.

AI rationale

The postinstall hook unconditionally deploys package-controlled, high-capability AI-agent profiles into a global user configuration directory. This is concrete unconsented install-time mutation of a broad AI-agent control surface.

Evidence

package.jsoninstall.mjsagents/orchestrator.mdcommands/orchestrator.mdconfig/opencode.json.build

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/opencode-termux.tsView file

1#!/usr/bin/env node L2: import { spawnSync } from "child_process" L3: import fs from "fs"

High

Child Process

Package source references child process execution.

bin/opencode-termux.tsView on unpkg · L1

61console.log(`[opencode-termux] memperbarui bundle (paket v${PKG.version})…`) L62: const env = { ...process.env } L63: delete env.LD_PRELOAD L64: delete env.LD_PRELOAD_32BIT L65: const r = spawnSync(process.execPath, [path.join(root, "install.mjs")], { L66: stdio: "inherit", ... L73: try { L74: const latest = await (await fetch("https://registry.npmjs.org/opencode-ai/latest")).json() as { version: string } L75: if (latest.version && latest.version !== PKG.opencodeUpstream) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/opencode-termux.tsView on unpkg · L61

1#!/usr/bin/env node L2: import { spawnSync } from "child_process" L3: import fs from "fs" ... L6: L7: const __dirname = path.dirname(fileURLToPath(import.meta.url)) L8: const root = path.join(__dirname, "..") ... L11: const bin = path.join(vendor, "opencode") L12: const PKG = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8")) as { version: string; opencodeUpstream: string } L13: const PREFIX = process.env.TERMUX_PREFIX || "/data/data/com.termux/files/usr" L14: ... L73: try { L74: const latest = await (await fetch("https://registry.npmjs.org/opencode-ai/latest")).json() as { version: string }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/opencode-termux.tsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @nemoobc/opencode-termux@1.20.11 matchedPath = bin/opencode-termux.ts matchedIdentity = npm:[redacted]:1.20.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/opencode-termux.tsView on unpkg

bin/opencode-termux.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. bin/opencode-termux.js: if (!fs.existsSync(rc)) fs.writeFileSync(rc, "nameserver 1.1.1.1\nnameserver 8.8.8.8\n") if (!fs.existsSync(hh)) fs.writeFileSync(hh, "127.0.0.1 localhost\n") const latest = await (await fetch("https://registry.npmjs.org/opencode-ai/latest")).json() fs.writeFileSync(path.join(root, "package.json"), JSON.stringify(PKG, null, 2) + "\n") const r = spawnSync(process.execPath, ["-e", "fetch('https://registry.npmjs.org/-/ping').then(r=>{if(!r.ok)process.exit(1)})"], {

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

bin/opencode-termux.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @nemoobc/opencode-termux@1.20.11 matchedPath = bin/opencode-termux.js matchedIdentity = npm:[redacted]:1.20.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/opencode-termux.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 2f796703aa085ce3 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @nemoobc/opencode-termux@1.20.11 matchedPath = bin/opencode-termux.js matchedIdentity = npm:[redacted]:1.20.11 similarity = 1.000 shingleOverlap = 7 summary = package final verdict is malicious

install.mjsView file

26// Versi upstream: env > package.json > otomatis ambil terbaru dari registry L27: let V = process.env.OCX_UPSTREAM || pkgJson.opencodeUpstream L28: if (!V) { ... L46: const untar = (tgz, dest, members = []) => { L47: fs.mkdirSync(dest, { recursive: true }) L48: const run = m => execFileSync("tar", ["xzf", tgz, "-C", dest, ...m], { stdio: ["ignore", "ignore", "pipe"] }) ... L57: fs.rmSync(work, { recursive: true, force: true }) L58: fs.mkdirSync(work, { recursive: true }) L59: ... L98: // 2) libgcc + libstdc++ (versi terbaru yang tersedia di CDN) L99: const apkDir = `${work}/apk`; fs.mkdirSync(apkDir, { recursive: true }) L100: for (const name of ["libgcc", "libstdc%2B%2B"]) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install.mjsView on unpkg · L26

•matchType = normalized_sha256 matchedPackage = @nemoobc/opencode-termux@1.20.11 matchedPath = install.mjs matchedIdentity = npm:[redacted]:1.20.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

install.mjsView on unpkg

prebuilt/ld-musl-aarch64-termux.soView file

•path = prebuilt/ld-musl-aarch64-termux.so kind = native_binary sizeBytes = 969056 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilt/ld-musl-aarch64-termux.soView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 1-30json

1{

2 "name": "@nemoobc/opencode-termux",

3 "version": "1.20.4",

4 "description": "opencode CLI native untuk Termux/Android tanpa proot — membundel loader musl + binary opencode resmi (upstream opencode-ai)",

5 "type": "module",

6 "bin": {

7 "opencode-termux": "./bin/opencode-termux.js"

8 },

9 "scripts": {

10 "postinstall": "node install.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 "test": "node test/run.mjs",

12 "test:e2e": "node test/run.mjs --e2e",

13 "lint": "echo 'No linter configured'",

14 "typecheck": "tsc --noEmit",

15 "build": "tsc"

16 },

17 "keywords": [

18 "opencode",

19 "termux",

20 "android",

21 "cli",

22 "ai"

23 ],

24 "license": "MIT",

25 "engines": {

26 "node": ">=18"

27 },

28 "files": [

29 "bin",

30 "install.mjs",

bin/opencode-termux.tsView file

Lines 1-21typescript

1#!/usr/bin/env node

2import { spawnSync } from "child_process"

3import fs from "fs"

High

Child Process

Package source references child process execution.

bin/opencode-termux.tsView on unpkg · L1

4import path from "path"

5import

bin/opencode-termux.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. bin/opencode-termux.js: if (!fs.existsSync(rc)) fs.writeFileSync(rc, "nameserver 1.1.1.1\nnameserver 8.8.8.8\n") if (!fs.existsSync(hh)) fs.writeFileSync(hh, "127.0.0.1 localhost\n") const latest = await (await fetch("https://registry.npmjs.org/opencode-ai/latest")).json() fs.writeFileSync(path.join(root, "package.json"), JSON.stringify(PKG, null, 2) + "\n") const r = spawnSync(process.execPath, ["-e", "fetch('https://registry.npmjs.org/-/ping').then(r=>{if(!r.ok)process.exit(1)})"], {

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

bin/opencode-termux.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @nemoobc/opencode-termux@1.20.11 matchedPath = bin/opencode-termux.js matchedIdentity = npm:[redacted]:1.20.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/opencode-termux.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 2f796703aa085ce3 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @nemoobc/opencode-termux@1.20.11 matchedPath = bin/opencode-termux.js matchedIdentity = npm:[redacted]:1.20.11 similarity = 1.000 shingleOverlap = 7 summary = package final verdict is malicious

install.mjsView file

Lines 6-46javascript

6 * Target: Termux (android/arm64). Override uji: OCX_ARCH=x64 OCX_FORCE=1

7 */

8import fs from "fs"

9import

prebuilt/ld-musl-aarch64-termux.soView file

•path = prebuilt/ld-musl-aarch64-termux.so kind = native_binary sizeBytes = 969056 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilt/ld-musl-aarch64-termux.soView on unpkg