registry / @paytaca/opencode-plugin / 0.1.11

@paytaca/opencode-plugin@0.1.11

⚠ Under review

OpenCode plugin for Paytaca AI - AI inference provider powered by Bitcoin Cash micropayments

Static Scan Results

scanned 26d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 95.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 101 KB of source, external domains: api.paytaca.ai

Source & flagged code

6 flagged

bin/paytaca.jsView file

Lines 1-15javascript

1#!/usr/bin/env node

2const path = require('path');

3const { spawn } = require('child_process');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/paytaca.jsView on unpkg · L1

High

Child Process

Package source references child process execution.

bin/paytaca.jsView on unpkg · L2

5const paytacaCliPkg = require.resolve('paytaca-cli/package.json');

6const binScript = path.resolve(path.dirname(paytacaCliPkg), 'bin', 'paytaca.js');

8const child = spawn(process.execPath, [binScript, ...process.argv.slice(2)], {

9 stdio: 'inherit'

10});

12child.on('exit', (code) => {

13 process.exit(code ?? 0);

14});

dist/bundled/proxy.jsView file

Lines 1-36javascript

1"use strict";

2// This file contains the bundled proxy script as a string

3// It gets written to ~/.opencode-paytaca/proxy.js at runtime

4Object.defineProperty(exports, "__esModule", { value: true });

5exports.PROXY_SCRIPT_CONTENT = void 0

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @paytaca/opencode-plugin@0.1.13 matchedIdentity = npm:[redacted]:0.1.13 similarity = 0.889 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

6 flagged · loading source

bin/paytaca.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code