@paytaca/opencode-plugin

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

npm installation triggers postinstall; loading the OpenCode plugin triggers the runtime update and MCP setup.

The package can override consumer version selection, delete lockfiles, cause future installs to resolve its chosen release, and add an executable agent integration without a user command.

Automatic mutation of foreign OpenCode configuration, dependency state, global command paths, and agent command registration.

A normal npm install invokes postinstall, which identifies global and project OpenCode scopes, pins this package into their package files, deletes lockfiles, and creates a global command or attempts a global npm install. On later plugin loading, it contacts the registry for a newer version and again rewrites OpenCode dependency state and removes stale caches and lockfiles. The same runtime modifies OpenCode authentication data and registers an enabled local MCP process. These are unconsented changes to consumer and agent control surfaces, enabling the package to steer its own future resolution and execution.

This is malicious install-hook abuse: an automatic lifecycle hook broadly alters foreign OpenCode/project state and global tooling, while runtime code reinforces the package's upgrade and agent execution path. The behavior is source-confirmed and does not require a self-dependency chain to present a concrete supply-chain risk.