Loading npm security reports…

@nemoobc/opencode-termux@1.20.8: AI-agent control-surface risk | LPM Firewall

registry / @nemoobc/opencode-termux / 1.20.8

@nemoobc/opencode-termux@1.20.8

opencode CLI native untuk Termux/Android tanpa proot — membundel loader musl + binary opencode resmi (upstream opencode-ai)

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically changes the user's OpenCode agent and command directories. It also downloads native runtime components and runs them during installation on Android.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation on Android or a forced installation.

Impact

A package installation can alter a separate AI-agent control surface and make its bundled agents and commands available without an explicit user setup action.

Mechanism

Postinstall copies bundled AI-agent extensions into the user's shared OpenCode configuration and installs remote native components.

Policy narrative

The npm postinstall hook invokes install.mjs automatically. On Android it creates the user's ~/.config/opencode directory and copies all package-supplied agent and command files into the shared OpenCode extension locations; these copies are not guarded against existing extension files. It then optionally installs a default configuration. The same automatic hook downloads native components and executes a smoke test. This is an unconsented install-time mutation of a broad AI-agent control surface.

Rationale

The automatic postinstall hook changes a foreign shared AI-agent configuration by installing bundled agents and commands. That meets the blocking policy even though the source does not show credential exfiltration.

Evidence

package.jsoninstall.mjsagentscommandsconfig/opencode.json~/.config/opencode/agent~/.config/opencode/command~/.config/opencode/opencode.json

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/opencode-termux.tsView file

1#!/usr/bin/env node L2: import { spawnSync } from "child_process" L3: import fs from "fs"

High

Child Process

Package source references child process execution.

bin/opencode-termux.tsView on unpkg · L1

61console.log(`[opencode-termux] memperbarui bundle (paket v${PKG.version})…`) L62: const env = { ...process.env } L63: delete env.LD_PRELOAD L64: delete env.LD_PRELOAD_32BIT L65: const r = spawnSync(process.execPath, [path.join(root, "install.mjs")], { L66: stdio: "inherit", ... L73: try { L74: const latest = await (await fetch("https://registry.npmjs.org/opencode-ai/latest")).json() as { version: string } L75: if (latest.version && latest.version !== PKG.opencodeUpstream) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/opencode-termux.tsView on unpkg · L61

1#!/usr/bin/env node L2: import { spawnSync } from "child_process" L3: import fs from "fs" ... L6: L7: const __dirname = path.dirname(fileURLToPath(import.meta.url)) L8: const root = path.join(__dirname, "..") ... L11: const bin = path.join(vendor, "opencode") L12: const PKG = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8")) as { version: string; opencodeUpstream: string } L13: const PREFIX = process.env.TERMUX_PREFIX || "/data/data/com.termux/files/usr" L14: ... L73: try { L74: const latest = await (await fetch("https://registry.npmjs.org/opencode-ai/latest")).json() as { version: string }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/opencode-termux.tsView on unpkg · L1

bin/opencode-termux.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. bin/opencode-termux.js: if (!fs.existsSync(rc)) fs.writeFileSync(rc, "nameserver 1.1.1.1\nnameserver 8.8.8.8\n") if (!fs.existsSync(hh)) fs.writeFileSync(hh, "127.0.0.1 localhost\n") const latest = await (await fetch("https://registry.npmjs.org/opencode-ai/latest")).json() fs.writeFileSync(path.join(root, "package.json"), JSON.stringify(PKG, null, 2) + "\n") const r = spawnSync(process.execPath, ["-e", "fetch('https://registry.npmjs.org/-/ping').then(r=>{if(!r.ok)process.exit(1)})"], {

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

bin/opencode-termux.jsView on unpkg

install.mjsView file

26// Versi upstream: env > package.json > otomatis ambil terbaru dari registry L27: let V = process.env.OCX_UPSTREAM || pkgJson.opencodeUpstream L28: if (!V) { ... L46: const untar = (tgz, dest, members = []) => { L47: fs.mkdirSync(dest, { recursive: true }) L48: const run = m => execFileSync("tar", ["xzf", tgz, "-C", dest, ...m], { stdio: ["ignore", "ignore", "pipe"] }) ... L57: fs.rmSync(work, { recursive: true, force: true }) L58: fs.mkdirSync(work, { recursive: true }) L59: ... L98: // 2) libgcc + libstdc++ (versi terbaru yang tersedia di CDN) L99: const apkDir = `${work}/apk`; fs.mkdirSync(apkDir, { recursive: true }) L100: for (const name of ["libgcc", "libstdc%2B%2B"]) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install.mjsView on unpkg · L26

prebuilt/ld-musl-aarch64-termux.soView file

•path = prebuilt/ld-musl-aarch64-termux.so kind = native_binary sizeBytes = 969056 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilt/ld-musl-aarch64-termux.soView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 1-30json

1{

2 "name": "@nemoobc/opencode-termux",

3 "version": "1.20.8",

4 "description": "opencode CLI native untuk Termux/Android tanpa proot \u2014 membundel loader musl + binary opencode resmi (upstream opencode-ai)",

5 "type": "module",

6 "bin": {

7 "opencode-termux": "./bin/opencode-termux.js"

8 },

9 "scripts": {

10 "postinstall": "node install.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 "test": "node test/run.mjs",

12 "test:e2e": "node test/run.mjs --e2e",

13 "lint": "echo 'No linter configured'",

14 "typecheck": "tsc --noEmit",

15 "build": "tsc"

16 },

17 "keywords": [

18 "opencode",

19 "termux",

20 "android",

21 "cli",

22 "ai"

23 ],

24 "license": "MIT",

25 "engines": {

26 "node": ">=18"

27 },

28 "files": [

29 "bin",

30 "install.mjs",

bin/opencode-termux.tsView file

Lines 1-21typescript

1#!/usr/bin/env node

2import { spawnSync } from "child_process"

3import fs from "fs"

High

Child Process

Package source references child process execution.

bin/opencode-termux.tsView on unpkg · L1

4import path from "path"

5import

bin/opencode-termux.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. bin/opencode-termux.js: if (!fs.existsSync(rc)) fs.writeFileSync(rc, "nameserver 1.1.1.1\nnameserver 8.8.8.8\n") if (!fs.existsSync(hh)) fs.writeFileSync(hh, "127.0.0.1 localhost\n") const latest = await (await fetch("https://registry.npmjs.org/opencode-ai/latest")).json() fs.writeFileSync(path.join(root, "package.json"), JSON.stringify(PKG, null, 2) + "\n") const r = spawnSync(process.execPath, ["-e", "fetch('https://registry.npmjs.org/-/ping').then(r=>{if(!r.ok)process.exit(1)})"], {

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

bin/opencode-termux.jsView on unpkg

install.mjsView file

Lines 6-46javascript

6 * Target: Termux (android/arm64). Override uji: OCX_ARCH=x64 OCX_FORCE=1

7 */

8import fs from "fs"

9import

prebuilt/ld-musl-aarch64-termux.soView file

•path = prebuilt/ld-musl-aarch64-termux.so kind = native_binary sizeBytes = 969056 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilt/ld-musl-aarch64-termux.soView on unpkg