Loading npm security reports…

@nemoobc/opencode-termux@1.20.5: AI-agent control-surface risk | LPM Firewall

registry / @nemoobc/opencode-termux / 1.20.5

@nemoobc/opencode-termux@1.20.5

opencode CLI native untuk Termux/Android tanpa proot — membundel loader musl + binary opencode resmi (upstream opencode-ai)

AI Security Review

scanned 22d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation mutates the user's broad OpenCode control surface by adding package-provided agents, commands, and a default configuration. One installed agent is granted shell and file-modification capabilities.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation invokes the postinstall hook.

Impact

Package-defined autonomous agents become available in the user's OpenCode environment and can act on later projects with shell and write access.

Mechanism

Automatic copying of agent-control files into $HOME/.config/opencode.

Policy narrative

On installation, npm runs install.mjs. The hook writes package-owned agent and command files into the user's shared OpenCode configuration directory, rather than keeping them inside this package. It also creates a default configuration if absent. The supplied AUTODEV agent is granted shell, edit, write, and task capabilities, so a later OpenCode invocation can execute package-authored autonomous behavior against unrelated user projects. This is an unconsented postinstall mutation of a broad AI-agent control surface.

AI rationale

The automatic postinstall hook installs privileged package-authored agents into a foreign shared AI-agent configuration directory. This meets the blocking policy for unconsented lifecycle mutation of a broad agent control surface.

Evidence

package.jsoninstall.mjsagents/autodev.mdcommands/*.mdconfig/opencode.json$HOME/.config/opencode/agent/*

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/opencode-termux.tsView file

1#!/usr/bin/env node L2: import { spawnSync } from "child_process" L3: import fs from "fs"

High

Child Process

Package source references child process execution.

bin/opencode-termux.tsView on unpkg · L1

61console.log(`[opencode-termux] memperbarui bundle (paket v${PKG.version})…`) L62: const env = { ...process.env } L63: delete env.LD_PRELOAD L64: delete env.LD_PRELOAD_32BIT L65: const r = spawnSync(process.execPath, [path.join(root, "install.mjs")], { L66: stdio: "inherit", ... L73: try { L74: const latest = await (await fetch("https://registry.npmjs.org/opencode-ai/latest")).json() as { version: string } L75: if (latest.version && latest.version !== PKG.opencodeUpstream) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/opencode-termux.tsView on unpkg · L61

1#!/usr/bin/env node L2: import { spawnSync } from "child_process" L3: import fs from "fs" ... L6: L7: const __dirname = path.dirname(fileURLToPath(import.meta.url)) L8: const root = path.join(__dirname, "..") ... L11: const bin = path.join(vendor, "opencode") L12: const PKG = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8")) as { version: string; opencodeUpstream: string } L13: const PREFIX = process.env.TERMUX_PREFIX || "/data/data/com.termux/files/usr" L14: ... L73: try { L74: const latest = await (await fetch("https://registry.npmjs.org/opencode-ai/latest")).json() as { version: string }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/opencode-termux.tsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @nemoobc/opencode-termux@1.20.11 matchedPath = bin/opencode-termux.ts matchedIdentity = npm:[redacted]:1.20.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/opencode-termux.tsView on unpkg

bin/opencode-termux.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. bin/opencode-termux.js: if (!fs.existsSync(rc)) fs.writeFileSync(rc, "nameserver 1.1.1.1\nnameserver 8.8.8.8\n") if (!fs.existsSync(hh)) fs.writeFileSync(hh, "127.0.0.1 localhost\n") const latest = await (await fetch("https://registry.npmjs.org/opencode-ai/latest")).json() fs.writeFileSync(path.join(root, "package.json"), JSON.stringify(PKG, null, 2) + "\n") const r = spawnSync(process.execPath, ["-e", "fetch('https://registry.npmjs.org/-/ping').then(r=>{if(!r.ok)process.exit(1)})"], {

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

bin/opencode-termux.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @nemoobc/opencode-termux@1.20.11 matchedPath = bin/opencode-termux.js matchedIdentity = npm:[redacted]:1.20.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/opencode-termux.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 2f796703aa085ce3 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @nemoobc/opencode-termux@1.20.11 matchedPath = bin/opencode-termux.js matchedIdentity = npm:[redacted]:1.20.11 similarity = 1.000 shingleOverlap = 7 summary = package final verdict is malicious

install.mjsView file

26// Versi upstream: env > package.json > otomatis ambil terbaru dari registry L27: let V = process.env.OCX_UPSTREAM || pkgJson.opencodeUpstream L28: if (!V) { ... L46: const untar = (tgz, dest, members = []) => { L47: fs.mkdirSync(dest, { recursive: true }) L48: const run = m => execFileSync("tar", ["xzf", tgz, "-C", dest, ...m], { stdio: ["ignore", "ignore", "pipe"] }) ... L57: fs.rmSync(work, { recursive: true, force: true }) L58: fs.mkdirSync(work, { recursive: true }) L59: ... L98: // 2) libgcc + libstdc++ (versi terbaru yang tersedia di CDN) L99: const apkDir = `${work}/apk`; fs.mkdirSync(apkDir, { recursive: true }) L100: for (const name of ["libgcc", "libstdc%2B%2B"]) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install.mjsView on unpkg · L26

•matchType = normalized_sha256 matchedPackage = @nemoobc/opencode-termux@1.20.11 matchedPath = install.mjs matchedIdentity = npm:[redacted]:1.20.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

install.mjsView on unpkg

prebuilt/ld-musl-aarch64-termux.soView file

•path = prebuilt/ld-musl-aarch64-termux.so kind = native_binary sizeBytes = 969056 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilt/ld-musl-aarch64-termux.soView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 1-30json

1{

2 "name": "@nemoobc/opencode-termux",

3 "version": "1.20.5",

4 "description": "opencode CLI native untuk Termux/Android tanpa proot \u2014 membundel loader musl + binary opencode resmi (upstream opencode-ai)",

5 "type": "module",

6 "bin": {

7 "opencode-termux": "./bin/opencode-termux.js"

8 },

9 "scripts": {

10 "postinstall": "node install.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 "test": "node test/run.mjs",

12 "test:e2e": "node test/run.mjs --e2e",

13 "lint": "echo 'No linter configured'",

14 "typecheck": "tsc --noEmit",

15 "build": "tsc"

16 },

17 "keywords": [

18 "opencode",

19 "termux",

20 "android",

21 "cli",

22 "ai"

23 ],

24 "license": "MIT",

25 "engines": {

26 "node": ">=18"

27 },

28 "files": [

29 "bin",

30 "install.mjs",

bin/opencode-termux.tsView file

Lines 1-21typescript

1#!/usr/bin/env node

2import { spawnSync } from "child_process"

3import fs from "fs"

High

Child Process

Package source references child process execution.

bin/opencode-termux.tsView on unpkg · L1

4import path from "path"

5import

bin/opencode-termux.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. bin/opencode-termux.js: if (!fs.existsSync(rc)) fs.writeFileSync(rc, "nameserver 1.1.1.1\nnameserver 8.8.8.8\n") if (!fs.existsSync(hh)) fs.writeFileSync(hh, "127.0.0.1 localhost\n") const latest = await (await fetch("https://registry.npmjs.org/opencode-ai/latest")).json() fs.writeFileSync(path.join(root, "package.json"), JSON.stringify(PKG, null, 2) + "\n") const r = spawnSync(process.execPath, ["-e", "fetch('https://registry.npmjs.org/-/ping').then(r=>{if(!r.ok)process.exit(1)})"], {

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

bin/opencode-termux.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @nemoobc/opencode-termux@1.20.11 matchedPath = bin/opencode-termux.js matchedIdentity = npm:[redacted]:1.20.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/opencode-termux.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 2f796703aa085ce3 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @nemoobc/opencode-termux@1.20.11 matchedPath = bin/opencode-termux.js matchedIdentity = npm:[redacted]:1.20.11 similarity = 1.000 shingleOverlap = 7 summary = package final verdict is malicious

install.mjsView file

Lines 6-46javascript

6 * Target: Termux (android/arm64). Override uji: OCX_ARCH=x64 OCX_FORCE=1

7 */

8import fs from "fs"

9import

prebuilt/ld-musl-aarch64-termux.soView file

•path = prebuilt/ld-musl-aarch64-termux.so kind = native_binary sizeBytes = 969056 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilt/ld-musl-aarch64-termux.soView on unpkg