Loading npm security reports…

@paytaca/opencode-plugin@0.2.1: AI-agent control-surface risk | LPM Firewall

registry / @paytaca/opencode-plugin / 0.2.1

@paytaca/opencode-plugin@0.2.1

OpenCode plugin for Paytaca AI - AI inference provider powered by Bitcoin Cash micropayments

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation automatically mutates OpenCode and project dependency state. Plugin startup also installs a global skill and drives future updates by removing version controls.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall and OpenCode plugin startup.

Impact

It can alter the consumer's AI-agent extension state and force future package resolution without a separate user command.

Mechanism

Automatic agent configuration mutation and update-control persistence.

Policy narrative

On installation, the postinstall script searches OpenCode and current-project scopes, pins this package's version in their manifests, and deletes lockfiles that preserve another version. When loaded, the plugin copies a skill into a global OpenCode skills directory and registers an executable MCP server. It also queries the npm registry and, when a newer release exists, again rewrites dependency specifications and removes lockfiles and caches. These automatic changes control a broad AI-agent extension surface and the release selected later.

Rationale

This package performs unconsented postinstall mutation of OpenCode and consumer-project dependency control files, then reinforces it at runtime with automatic global skill installation and update-state deletion. The payment safeguards do not neutralize the separate lifecycle control-surface behavior.

Evidence

package.jsonscripts/postinstall.jsdist/index.jsdist/selfheal.js~/.config/opencode/package.json.opencode/package.json

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/paytaca.jsView file

2const path = require('path'); L3: const { spawn } = require('child_process'); L4:

High

Child Process

Package source references child process execution.

bin/paytaca.jsView on unpkg · L2

1#!/usr/bin/env node L2: const path = require('path'); L3: const { spawn } = require('child_process');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/paytaca.jsView on unpkg · L1

scripts/postinstall.jsView file

114// npm runs lifecycle scripts with cwd = the package install dir, so L115: // consider both `<cwd>/.opencode` and `<cwd>` itself as project scopes. L116: const cfgDir = path.join( ... L122: const configDirs = []; L123: for (const d of [cfgDir, path.join(cwd, '.opencode'), cwd]) { L124: if (isInside(d, pkgRoot)) continue; ... L140: json.dependencies = deps; L141: fs.writeFileSync(file, JSON.stringify(json, null, 2) + '\n'); L142: log(`Pinned ${PACKAGE_NAME} to ${own} in ${file}`); ... L168: if (!binDir) throw new Error('Could not determine global bin directory'); L169: fs.mkdirSync(binDir, { recursive: true }); L170:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L114

172// Windows can't run shebang'd .js files, and symlinking requires admin / L173: // Developer Mode. Ship a .cmd shim (used by cmd.exe and PowerShell) plus a L174: // POSIX-style wrapper so Git-Bash / MSYS users get a working `paytaca` too.

High

Shell

Package source references shell execution.

scripts/postinstall.jsView on unpkg · L172

213try { L214: execSync('npm install -g paytaca-cli', { stdio: 'inherit' }); L215: asdfReshim();

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.jsView on unpkg · L213

dist/proxy.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @paytaca/opencode-plugin@0.1.16 matchedIdentity = npm:[redacted]:0.1.16 similarity = 0.700 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/proxy.jsView on unpkg

45const crypto = __importStar(require("crypto")); L46: const child_process_1 = require("child_process"); L47: const config_1 = require("./config"); ... L51: try { L52: const paytacaCliPkg = require.resolve('paytaca-cli/package.json'); L53: return path.resolve(path.dirname(paytacaCliPkg), 'bin', 'paytaca.js'); ... L55: catch { } L56: const localPaytaca = path.join(__dirname, '..', 'node_modules', '.bin', 'paytaca'); L57: if (fs.existsSync(localPaytaca)) { ... L83: try { L84: const which = process.platform === 'win32' ? 'where' : 'which'; L85: const result = (0, child_process_1.execSync)(`${which} paytaca`, { encoding: 'utf8' }).trim().split('\n')[0];

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/proxy.jsView on unpkg · L45

dist/bundled/mcp.jsView file

22L23: const http = require('http'); L24: const https = require('https'); L25: const { spawn } = require('child_process'); L26: const fs = require('fs'); ... L29: L30: const CONFIG_DIR = process.env.PAYTACA_CONFIG_DIR || path.join(os.homedir(), '.opencode-paytaca'); L31: const PAYTACA_CMD = process.env.PAYTACA_CMD || 'paytaca';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bundled/mcp.jsView on unpkg · L22

22Cross-file remote execution chain: dist/bundled/mcp.js spawns dist/config.js; helper contains network access plus dynamic code execution. L22: L23: const http = require('http'); L24: const https = require('https'); L25: const { spawn } = require('child_process'); L26: const fs = require('fs'); ... L29: L30: const CONFIG_DIR = process.env.PAYTACA_CONFIG_DIR || path.join(os.homedir(), '.opencode-paytaca'); L31: const PAYTACA_CMD = process.env.PAYTACA_CMD || 'paytaca'; ... L40: const timestamp = new Date().toISOString(); L41: logStream.write(timestamp + ' [MCP] ' + message + '\\n'); L42: } ... L46: try {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bundled/mcp.jsView on unpkg · L22

•matchType = token_shingles matchedPackage = upshift-sdk@8.20.1 matchedPath = lib/core/analytics/constants.js matchedIdentity = npm:dXBzaGlmdC1zZGs:8.20.1 similarity = 0.950 shingleOverlap = 19 summary = source token shingles overlapped finalized malicious source

dist/bundled/proxy.js#virtual:normalized:round1View file

210const djangoReq = REQUester.request(options, (djangoRes) => { L211: // Response started; clear the connect/first-byte timeout so slow streams aren"t killed.\n if (!timeoutCleared) {\n djangoReq.clearTimeout();\n timeoutCleared = true;\... L212: var pendingPayload = pendingPayments.get(walletHash);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bundled/proxy.js#virtual:normalized:round1View on unpkg · L210

210Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js -> dist/proxy.js -> dist/bundled/proxy.js L210: const djangoReq = REQUester.request(options, (djangoRes) => { L211: // Response started; clear the connect/first-byte timeout so slow streams aren"t killed.\n if (!timeoutCleared) {\n djangoReq.clearTimeout();\n timeoutCleared = true;\... L212: var pendingPayload = pendingPayments.get(walletHash);

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/bundled/proxy.js#virtual:normalized:round1View on unpkg · L210

dist/bundled/proxy.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: "use strict"; object.defineproperty(exports, "__esmodule", { value: true }); exports.proxy_script_content = void 0; exports.proxy_script_content = `#!/usr/bin/env node /** * paytaca ai proxy * * sits between opencode and the django backend. * - auto-starts by opencode plugin * - on 402, returns sse typewriter loading sequence + synthetic payment prompt * - stores pending payments; handles "yes"/"no" approval internally * - uses only node.js built-in modules * * usage: node proxy.js [backend_url] [proxy_port] * example: node proxy.js https://api.paytaca.ai 8001 */ cons

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/bundled/proxy.jsView on unpkg

•matchType = token_shingles matchedPackage = upshift-sdk@8.20.1 matchedPath = lib/core/analytics/constants.js matchedIdentity = npm:dXBzaGlmdC1zZGs:8.20.1 similarity = 0.950 shingleOverlap = 19 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bundled/proxy.jsView on unpkg

Source & flagged code

16 flagged

package.jsonView file

Lines 2-42json

2 "name": "@paytaca/opencode-plugin",

3 "version": "0.2.1",

4 "description": "OpenCode plugin for Paytaca AI - AI inference provider powered by Bitcoin Cash micropayments",

5 "main": "dist/index.js",

6 "types": "dist/index.d.ts",

7 "bin": {

8 "paytaca": "./bin/paytaca.js"

9 },

10 "engines": {

11 "node": ">=20.0.0"

12 },

13 "files": [

14 "dist/",

15 "bin/",

16 "scripts/",

17 "README.md"

18 ],

19 "scripts": {

20 "build": "tsc",

21 "prepare": "npm run build && node scripts/sync-cache.js",

22 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L22

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L22

23 },

24 "keywords": [

25 "opencode",

26 "plugin",

27 "paytaca",

28 "bch",

29 "ai",

30 "provider"

31 ],

32 "author": "Paytaca",

33 "license": "MIT",

34 "dependencies": {

35 "@opencode-ai/plugin": "^1.17.8",

36 "paytaca-cli": "^0.4.1"

37 },

38 "devDependencies": {

39 "@types/node": "^20.0.0",

40 "typescript": "^5.0.0"

41 },

42 "peerDependencies": {

bin/paytaca.jsView file

Lines 1-15javascript

1#!/usr/bin/env node

2const path = require('path');

3const { spawn } = require('child_process');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/paytaca.jsView on unpkg · L1

scripts/postinstall.jsView file

Lines 152-192javascript

152 if (fs.readFileSync(file, 'utf8').indexOf(PACKAGE_NAME) === -1) continue;

153 fs.rmSync(file, { force: true });

154 log

dist/proxy.jsView file

Lines 25-65javascript

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result

dist/bundled/mcp.jsView file

Lines 2-42javascript

2// This file contains the bundled MCP server script as a string

3// It gets written to ~/.opencode-paytaca/mcp-server.js at runtime

4Object.defineProperty(exports, "__esModule", { value: true });

5exports.MCP_SERVER_CONTENT = void 0;

6exports

dist/bundled/proxy.js#virtual:normalized:round1View file

210const djangoReq = REQUester.request(options, (djangoRes) => { L211: // Response started; clear the connect/first-byte timeout so slow streams aren"t killed.\n if (!timeoutCleared) {\n djangoReq.clearTimeout();\n timeoutCleared = true;\... L212: var pendingPayload = pendingPayments.get(walletHash);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bundled/proxy.js#virtual:normalized:round1View on unpkg · L210

210Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js -> dist/proxy.js -> dist/bundled/proxy.js L210: const djangoReq = REQUester.request(options, (djangoRes) => { L211: // Response started; clear the connect/first-byte timeout so slow streams aren"t killed.\n if (!timeoutCleared) {\n djangoReq.clearTimeout();\n timeoutCleared = true;\... L212: var pendingPayload = pendingPayments.get(walletHash);

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/bundled/proxy.js#virtual:normalized:round1View on unpkg · L210

dist/bundled/proxy.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: "use strict"; object.defineproperty(exports, "__esmodule", { value: true }); exports.proxy_script_content = void 0; exports.proxy_script_content = `#!/usr/bin/env node /** * paytaca ai proxy * * sits between opencode and the django backend. * - auto-starts by opencode plugin * - on 402, returns sse typewriter loading sequence + synthetic payment prompt * - stores pending payments; handles "yes"/"no" approval internally * - uses only node.js built-in modules * * usage: node proxy.js [backend_url] [proxy_port] * example: node proxy.js https://api.paytaca.ai 8001 */ cons

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/bundled/proxy.jsView on unpkg

•matchType = token_shingles matchedPackage = upshift-sdk@8.20.1 matchedPath = lib/core/analytics/constants.js matchedIdentity = npm:dXBzaGlmdC1zZGs:8.20.1 similarity = 0.950 shingleOverlap = 19 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bundled/proxy.jsView on unpkg