registry / @paytaca/opencode-plugin / 0.2.1

@paytaca/opencode-plugin@0.2.1

OpenCode plugin for Paytaca AI - AI inference provider powered by Bitcoin Cash micropayments

AI Security Review

scanned 5h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation automatically mutates OpenCode and project dependency state. Plugin startup also installs a global skill and drives future updates by removing version controls.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall and OpenCode plugin startup.

Impact

It can alter the consumer's AI-agent extension state and force future package resolution without a separate user command.

Mechanism

Automatic agent configuration mutation and update-control persistence.

Policy narrative

On installation, the postinstall script searches OpenCode and current-project scopes, pins this package's version in their manifests, and deletes lockfiles that preserve another version. When loaded, the plugin copies a skill into a global OpenCode skills directory and registers an executable MCP server. It also queries the npm registry and, when a newer release exists, again rewrites dependency specifications and removes lockfiles and caches. These automatic changes control a broad AI-agent extension surface and the release selected later.

Rationale

This package performs unconsented postinstall mutation of OpenCode and consumer-project dependency control files, then reinforces it at runtime with automatic global skill installation and update-state deletion. The payment safeguards do not neutralize the separate lifecycle control-surface behavior.

Evidence

package.jsonscripts/postinstall.jsdist/index.jsdist/selfheal.js~/.config/opencode/package.json.opencode/package.jsonpackage-lock.jsonbun.lock~/.config/opencode/skills/paytaca-wallet/SKILL.md

Network endpoints1

registry.npmjs.org

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

The manifest runs a postinstall script automatically.
Postinstall rewrites OpenCode/project dependency manifests and deletes matching lockfiles.
Plugin startup installs a global OpenCode skill and registers a local MCP command.
Startup checks the npm registry and removes pins, lockfiles, and caches to force an update path.

Evidence against

The package names the Paytaca CLI as a normal dependency rather than depending on itself.
Its MCP payment permissions default to asking the user before send and purchase actions.
No source evidence showed secret harvesting or an unrelated exfiltration endpoint.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 13 file(s), 153 KB of source, external domains: api.paytaca.ai, registry.npmjs.org

Source & flagged code

16 flagged

package.jsonView file

Lines 2-42json

2 "name": "@paytaca/opencode-plugin",

3 "version": "0.2.1",

4 "description": "OpenCode plugin for Paytaca AI - AI inference provider powered by Bitcoin Cash micropayments",

5 "main": "dist/index.js",

6 "types": "dist/index.d.ts",

7 "bin": {

8 "paytaca": "./bin/paytaca.js"

9 },

10 "engines": {

11 "node": ">=20.0.0"

12 },

13 "files": [

14 "dist/",

15 "bin/",

16 "scripts/",

17 "README.md"

18 ],

19 "scripts": {

20 "build": "tsc",

21 "prepare": "npm run build && node scripts/sync-cache.js",

22 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L22

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L22

23 },

24 "keywords": [

25 "opencode",

26 "plugin",

27 "paytaca",

28 "bch",

29 "ai",

30 "provider"

31 ],

32 "author": "Paytaca",

33 "license": "MIT",

34 "dependencies": {

35 "@opencode-ai/plugin": "^1.17.8",

36 "paytaca-cli": "^0.4.1"

37 },

38 "devDependencies": {

39 "@types/node": "^20.0.0",

40 "typescript": "^5.0.0"

41 },

42 "peerDependencies": {

bin/paytaca.jsView file

Lines 1-15javascript

1#!/usr/bin/env node

2const path = require('path');

3const { spawn } = require('child_process');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/paytaca.jsView on unpkg · L1

scripts/postinstall.jsView file

Lines 152-192javascript

152 if (fs.readFileSync(file, 'utf8').indexOf(PACKAGE_NAME) === -1) continue;

153 fs.rmSync(file, { force: true });

154 log

dist/proxy.jsView file

Lines 25-65javascript

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result

dist/bundled/mcp.jsView file

Lines 2-42javascript

2// This file contains the bundled MCP server script as a string

3// It gets written to ~/.opencode-paytaca/mcp-server.js at runtime

4Object.defineProperty(exports, "__esModule", { value: true });

5exports.MCP_SERVER_CONTENT = void 0;

6exports

dist/bundled/proxy.js#virtual:normalized:round1View file

210const djangoReq = REQUester.request(options, (djangoRes) => { L211: // Response started; clear the connect/first-byte timeout so slow streams aren"t killed.\n if (!timeoutCleared) {\n djangoReq.clearTimeout();\n timeoutCleared = true;\... L212: var pendingPayload = pendingPayments.get(walletHash);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bundled/proxy.js#virtual:normalized:round1View on unpkg · L210

210Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js -> dist/proxy.js -> dist/bundled/proxy.js L210: const djangoReq = REQUester.request(options, (djangoRes) => { L211: // Response started; clear the connect/first-byte timeout so slow streams aren"t killed.\n if (!timeoutCleared) {\n djangoReq.clearTimeout();\n timeoutCleared = true;\... L212: var pendingPayload = pendingPayments.get(walletHash);

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/bundled/proxy.js#virtual:normalized:round1View on unpkg · L210

dist/bundled/proxy.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: "use strict"; object.defineproperty(exports, "__esmodule", { value: true }); exports.proxy_script_content = void 0; exports.proxy_script_content = `#!/usr/bin/env node /** * paytaca ai proxy * * sits between opencode and the django backend. * - auto-starts by opencode plugin * - on 402, returns sse typewriter loading sequence + synthetic payment prompt * - stores pending payments; handles "yes"/"no" approval internally * - uses only node.js built-in modules * * usage: node proxy.js [backend_url] [proxy_port] * example: node proxy.js https://api.paytaca.ai 8001 */ cons

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/bundled/proxy.jsView on unpkg

•matchType = token_shingles matchedPackage = upshift-sdk@8.20.1 matchedPath = lib/core/analytics/constants.js matchedIdentity = npm:dXBzaGlmdC1zZGs:8.20.1 similarity = 0.950 shingleOverlap = 19 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bundled/proxy.jsView on unpkg

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/paytaca.jsView file

2const path = require('path'); L3: const { spawn } = require('child_process'); L4:

High

Child Process

Package source references child process execution.

bin/paytaca.jsView on unpkg · L2

1#!/usr/bin/env node L2: const path = require('path'); L3: const { spawn } = require('child_process');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/paytaca.jsView on unpkg · L1

scripts/postinstall.jsView file

114// npm runs lifecycle scripts with cwd = the package install dir, so L115: // consider both `<cwd>/.opencode` and `<cwd>` itself as project scopes. L116: const cfgDir = path.join( ... L122: const configDirs = []; L123: for (const d of [cfgDir, path.join(cwd, '.opencode'), cwd]) { L124: if (isInside(d, pkgRoot)) continue; ... L140: json.dependencies = deps; L141: fs.writeFileSync(file, JSON.stringify(json, null, 2) + '\n'); L142: log(`Pinned ${PACKAGE_NAME} to ${own} in ${file}`); ... L168: if (!binDir) throw new Error('Could not determine global bin directory'); L169: fs.mkdirSync(binDir, { recursive: true }); L170:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L114

172// Windows can't run shebang'd .js files, and symlinking requires admin / L173: // Developer Mode. Ship a .cmd shim (used by cmd.exe and PowerShell) plus a L174: // POSIX-style wrapper so Git-Bash / MSYS users get a working `paytaca` too.

High

Shell

Package source references shell execution.

scripts/postinstall.jsView on unpkg · L172

213try { L214: execSync('npm install -g paytaca-cli', { stdio: 'inherit' }); L215: asdfReshim();

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.jsView on unpkg · L213

dist/proxy.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @paytaca/opencode-plugin@0.1.16 matchedIdentity = npm:[redacted]:0.1.16 similarity = 0.700 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/proxy.jsView on unpkg

45const crypto = __importStar(require("crypto")); L46: const child_process_1 = require("child_process"); L47: const config_1 = require("./config"); ... L51: try { L52: const paytacaCliPkg = require.resolve('paytaca-cli/package.json'); L53: return path.resolve(path.dirname(paytacaCliPkg), 'bin', 'paytaca.js'); ... L55: catch { } L56: const localPaytaca = path.join(__dirname, '..', 'node_modules', '.bin', 'paytaca'); L57: if (fs.existsSync(localPaytaca)) { ... L83: try { L84: const which = process.platform === 'win32' ? 'where' : 'which'; L85: const result = (0, child_process_1.execSync)(`${which} paytaca`, { encoding: 'utf8' }).trim().split('\n')[0];

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/proxy.jsView on unpkg · L45

dist/bundled/mcp.jsView file

22L23: const http = require('http'); L24: const https = require('https'); L25: const { spawn } = require('child_process'); L26: const fs = require('fs'); ... L29: L30: const CONFIG_DIR = process.env.PAYTACA_CONFIG_DIR || path.join(os.homedir(), '.opencode-paytaca'); L31: const PAYTACA_CMD = process.env.PAYTACA_CMD || 'paytaca';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bundled/mcp.jsView on unpkg · L22

22Cross-file remote execution chain: dist/bundled/mcp.js spawns dist/config.js; helper contains network access plus dynamic code execution. L22: L23: const http = require('http'); L24: const https = require('https'); L25: const { spawn } = require('child_process'); L26: const fs = require('fs'); ... L29: L30: const CONFIG_DIR = process.env.PAYTACA_CONFIG_DIR || path.join(os.homedir(), '.opencode-paytaca'); L31: const PAYTACA_CMD = process.env.PAYTACA_CMD || 'paytaca'; ... L40: const timestamp = new Date().toISOString(); L41: logStream.write(timestamp + ' [MCP] ' + message + '\\n'); L42: } ... L46: try {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bundled/mcp.jsView on unpkg · L22

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bundled/mcp.jsView on unpkg

dist/bundled/proxy.js#virtual:normalized:round1View file

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bundled/proxy.js#virtual:normalized:round1View on unpkg · L210

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/bundled/proxy.js#virtual:normalized:round1View on unpkg · L210

dist/bundled/proxy.jsView file

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/bundled/proxy.jsView on unpkg

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bundled/proxy.jsView on unpkg

Findings

2 Critical11 High5 Medium6 Low

CriticalAi Agent Control Hijackscripts/postinstall.js

CriticalPrevious Version Dangerous Deltadist/proxy.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/paytaca.js

HighShellscripts/postinstall.js

HighSame File Env Network Executiondist/bundled/mcp.js

HighCommand Output Exfiltrationdist/bundled/proxy.js#virtual:normalized:round1

HighExternal Ai Agent Control Surface Mutationdist/bundled/proxy.js

HighCross File Remote Execution Contextdist/bundled/mcp.js

HighTrigger Reachable Command Output Exfiltrationdist/bundled/proxy.js#virtual:normalized:round1

HighRuntime Package Installscripts/postinstall.js

HighKnown Malware Source Similaritydist/bundled/mcp.js

HighKnown Malware Source Similaritydist/bundled/proxy.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/paytaca.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/proxy.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings