Loading npm security reports…

@nemoobc/opencode-termux@1.20.7: AI-agent control-surface risk | LPM Firewall

registry / @nemoobc/opencode-termux / 1.20.7

@nemoobc/opencode-termux@1.20.7

opencode CLI native untuk Termux/Android tanpa proot — membundel loader musl + binary opencode resmi (upstream opencode-ai)

AI Security Review

scanned 26d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall mutates the user's global OpenCode agent and command control surface. It installs package-supplied, tool-enabled autonomous agents without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Installing the package on Android, including an automatic npm postinstall.

Impact

Subsequent OpenCode use can expose package-supplied agents and commands with write, shell, and task capabilities across user projects.

Mechanism

Global AI-agent configuration injection through lifecycle file copies.

Policy narrative

On npm installation, the package runs install.mjs. On Android it creates the user's global OpenCode configuration directories and copies all bundled agents and commands into them; it also creates a default OpenCode configuration when absent. One installed agent enables write, edit, shell, and task capabilities and instructs autonomous work without asking. This is an unconsented lifecycle mutation of a broad, foreign AI-agent control surface.

AI rationale

The automatic global OpenCode control-surface write is concrete and is coupled to package-supplied agents with privileged capabilities. Integrity checking of one downloaded binary does not mitigate that lifecycle control-surface injection.

Evidence

package.jsoninstall.mjsagents/autodev.md~/.config/opencode/agent/*~/.config/opencode/command/*~/.config/opencode/opencode.jsonvendor/*

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/opencode-termux.tsView file

1#!/usr/bin/env node L2: import { spawnSync } from "child_process" L3: import fs from "fs"

High

Child Process

Package source references child process execution.

bin/opencode-termux.tsView on unpkg · L1

61console.log(`[opencode-termux] memperbarui bundle (paket v${PKG.version})…`) L62: const env = { ...process.env } L63: delete env.LD_PRELOAD L64: delete env.LD_PRELOAD_32BIT L65: const r = spawnSync(process.execPath, [path.join(root, "install.mjs")], { L66: stdio: "inherit", ... L73: try { L74: const latest = await (await fetch("https://registry.npmjs.org/opencode-ai/latest")).json() as { version: string } L75: if (latest.version && latest.version !== PKG.opencodeUpstream) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/opencode-termux.tsView on unpkg · L61

1#!/usr/bin/env node L2: import { spawnSync } from "child_process" L3: import fs from "fs" ... L6: L7: const __dirname = path.dirname(fileURLToPath(import.meta.url)) L8: const root = path.join(__dirname, "..") ... L11: const bin = path.join(vendor, "opencode") L12: const PKG = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8")) as { version: string; opencodeUpstream: string } L13: const PREFIX = process.env.TERMUX_PREFIX || "/data/data/com.termux/files/usr" L14: ... L73: try { L74: const latest = await (await fetch("https://registry.npmjs.org/opencode-ai/latest")).json() as { version: string }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/opencode-termux.tsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @nemoobc/opencode-termux@1.20.10 matchedPath = bin/opencode-termux.ts matchedIdentity = npm:[redacted]:1.20.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/opencode-termux.tsView on unpkg

bin/opencode-termux.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. bin/opencode-termux.js: if (!fs.existsSync(rc)) fs.writeFileSync(rc, "nameserver 1.1.1.1\nnameserver 8.8.8.8\n") if (!fs.existsSync(hh)) fs.writeFileSync(hh, "127.0.0.1 localhost\n") const latest = await (await fetch("https://registry.npmjs.org/opencode-ai/latest")).json() fs.writeFileSync(path.join(root, "package.json"), JSON.stringify(PKG, null, 2) + "\n") const r = spawnSync(process.execPath, ["-e", "fetch('https://registry.npmjs.org/-/ping').then(r=>{if(!r.ok)process.exit(1)})"], {

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

bin/opencode-termux.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @nemoobc/opencode-termux@1.20.10 matchedPath = bin/opencode-termux.js matchedIdentity = npm:[redacted]:1.20.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/opencode-termux.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 2f796703aa085ce3 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @nemoobc/opencode-termux@1.20.10 matchedPath = bin/opencode-termux.js matchedIdentity = npm:[redacted]:1.20.10 similarity = 1.000 shingleOverlap = 7 summary = package final verdict is malicious

install.mjsView file

26// Versi upstream: env > package.json > otomatis ambil terbaru dari registry L27: let V = process.env.OCX_UPSTREAM || pkgJson.opencodeUpstream L28: if (!V) { ... L46: const untar = (tgz, dest, members = []) => { L47: fs.mkdirSync(dest, { recursive: true }) L48: const run = m => execFileSync("tar", ["xzf", tgz, "-C", dest, ...m], { stdio: ["ignore", "ignore", "pipe"] }) ... L57: fs.rmSync(work, { recursive: true, force: true }) L58: fs.mkdirSync(work, { recursive: true }) L59: ... L98: // 2) libgcc + libstdc++ (versi terbaru yang tersedia di CDN) L99: const apkDir = `${work}/apk`; fs.mkdirSync(apkDir, { recursive: true }) L100: for (const name of ["libgcc", "libstdc%2B%2B"]) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install.mjsView on unpkg · L26

•matchType = normalized_sha256 matchedPackage = @nemoobc/opencode-termux@1.20.10 matchedPath = install.mjs matchedIdentity = npm:[redacted]:1.20.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

install.mjsView on unpkg

prebuilt/ld-musl-aarch64-termux.soView file

•path = prebuilt/ld-musl-aarch64-termux.so kind = native_binary sizeBytes = 969056 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilt/ld-musl-aarch64-termux.soView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 1-30json

1{

2 "name": "@nemoobc/opencode-termux",

3 "version": "1.20.7",

4 "description": "opencode CLI native untuk Termux/Android tanpa proot \u2014 membundel loader musl + binary opencode resmi (upstream opencode-ai)",

5 "type": "module",

6 "bin": {

7 "opencode-termux": "./bin/opencode-termux.js"

8 },

9 "scripts": {

10 "postinstall": "node install.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 "test": "node test/run.mjs",

12 "test:e2e": "node test/run.mjs --e2e",

13 "lint": "echo 'No linter configured'",

14 "typecheck": "tsc --noEmit",

15 "build": "tsc"

16 },

17 "keywords": [

18 "opencode",

19 "termux",

20 "android",

21 "cli",

22 "ai"

23 ],

24 "license": "MIT",

25 "engines": {

26 "node": ">=18"

27 },

28 "files": [

29 "bin",

30 "install.mjs",

bin/opencode-termux.tsView file

Lines 1-21typescript

1#!/usr/bin/env node

2import { spawnSync } from "child_process"

3import fs from "fs"

High

Child Process

Package source references child process execution.

bin/opencode-termux.tsView on unpkg · L1

4import path from "path"

5import

bin/opencode-termux.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. bin/opencode-termux.js: if (!fs.existsSync(rc)) fs.writeFileSync(rc, "nameserver 1.1.1.1\nnameserver 8.8.8.8\n") if (!fs.existsSync(hh)) fs.writeFileSync(hh, "127.0.0.1 localhost\n") const latest = await (await fetch("https://registry.npmjs.org/opencode-ai/latest")).json() fs.writeFileSync(path.join(root, "package.json"), JSON.stringify(PKG, null, 2) + "\n") const r = spawnSync(process.execPath, ["-e", "fetch('https://registry.npmjs.org/-/ping').then(r=>{if(!r.ok)process.exit(1)})"], {

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

bin/opencode-termux.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @nemoobc/opencode-termux@1.20.10 matchedPath = bin/opencode-termux.js matchedIdentity = npm:[redacted]:1.20.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/opencode-termux.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 2f796703aa085ce3 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @nemoobc/opencode-termux@1.20.10 matchedPath = bin/opencode-termux.js matchedIdentity = npm:[redacted]:1.20.10 similarity = 1.000 shingleOverlap = 7 summary = package final verdict is malicious

install.mjsView file

Lines 6-46javascript

6 * Target: Termux (android/arm64). Override uji: OCX_ARCH=x64 OCX_FORCE=1

7 */

8import fs from "fs"

9import

prebuilt/ld-musl-aarch64-termux.soView file

•path = prebuilt/ld-musl-aarch64-termux.so kind = native_binary sizeBytes = 969056 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilt/ld-musl-aarch64-termux.soView on unpkg