registry / @paytaca/opencode-plugin / 0.1.7

@paytaca/opencode-plugin@0.1.7

OpenCode plugin for Paytaca AI - AI inference provider powered by Bitcoin Cash micropayments

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 81.2 KB of source, external domains: api.paytaca.ai

Source & flagged code

3 flagged

bin/paytaca.jsView file

Lines 1-15javascript

1#!/usr/bin/env node

2const path = require('path');

3const { spawn } = require('child_process');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/paytaca.jsView on unpkg · L1

High

Child Process

Package source references child process execution.

bin/paytaca.jsView on unpkg · L2

5const paytacaCliPkg = require.resolve('paytaca-cli/package.json');

6const binScript = path.resolve(path.dirname(paytacaCliPkg), 'bin', 'paytaca.js');

8const child = spawn(process.execPath, [binScript, ...process.argv.slice(2)], {

9 stdio: 'inherit'

10});

12child.on('exit', (code) => {

13 process.exit(code ?? 0);

14});

dist/bundled/proxy.jsView file

Lines 1-36javascript

1"use strict";

2// This file contains the bundled proxy script as a string

3// It gets written to ~/.opencode-paytaca/proxy.js at runtime

4Object.defineProperty(exports, "__esModule", { value: true });

5exports.PROXY_SCRIPT_CONTENT = void 0

Source & flagged code

3 flagged · loading source

bin/paytaca.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code