Loading npm security reports…
OpenCode plugin for Paytaca AI - AI inference provider powered by Bitcoin Cash micropayments
LPM treats this as warn-only first-party agent extension lifecycle risk. On OpenCode plugin load, it alters OpenCode configuration, deploys a global skill, creates/uses a wallet, and launches a local payment proxy. Installation also attempts a global CLI shim/install.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references dynamic require/import behavior.
bin/paytaca.jsView on unpkg · L1Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/bundled/proxy.jsView on unpkgSource spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/bundled/proxy.jsView on unpkg · L16This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
scripts/postinstall.jsView on unpkgPackage source invokes a package manager install command at runtime.
scripts/postinstall.jsView on unpkg · L91Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/bundled/proxy.jsView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkg · L22Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L22Package source references dynamic require/import behavior.
bin/paytaca.jsView on unpkg · L1Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/bundled/proxy.jsView on unpkg · L16Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/bundled/proxy.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/bundled/proxy.jsView on unpkgPackage source invokes a package manager install command at runtime.
scripts/postinstall.jsView on unpkg · L91This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
scripts/postinstall.jsView on unpkg