Loading npm security reports…

@paytaca/opencode-plugin@0.2.2: AI-agent control-surface risk | LPM Firewall

registry / @paytaca/opencode-plugin / 0.2.2

@paytaca/opencode-plugin@0.2.2

OpenCode plugin for Paytaca AI - AI inference provider powered by Bitcoin Cash micropayments

AI Security Review

scanned 5h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation silently alters OpenCode and consumer-project dependency state, removes lockfiles, and may change the global CLI. Runtime startup repeats dependency, cache, and global skill mutations.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation triggers postinstall; loading the OpenCode plugin triggers self-healing and skill installation.

Impact

It can override the user's selected package version and disrupt dependency integrity while extending the OpenCode control surface without a user command.

Mechanism

Automatic persistence through agent configuration, lockfile deletion, cache clearing, and global command changes.

Policy narrative

On npm installation, the postinstall script searches global and current OpenCode/project scopes, pins this plugin to its own version, deletes lockfiles, and may link or globally install a CLI. When the plugin loads, it queries the registry for a newer version, again changes dependency pins, deletes lockfiles and caches, and copies a skill into a global OpenCode directory. These unprompted mutations establish control over foreign agent and project state.

Rationale

The package has a concrete automatic lifecycle path that broadly mutates OpenCode and consumer project control surfaces, rather than performing transparent package-local setup. This meets the install-hook abuse block boundary.

Evidence

package.jsonscripts/postinstall.jsdist/selfheal.jsdist/index.js~/.config/opencode/package.json

Source & flagged code

24 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/paytaca.jsView file

2const path = require('path'); L3: const { spawn } = require('child_process'); L4:

High

Child Process

Package source references child process execution.

bin/paytaca.jsView on unpkg · L2

•matchType = normalized_sha256 matchedPackage = @paytaca/opencode-plugin@0.2.1 matchedPath = bin/paytaca.js matchedIdentity = npm:[redacted]:0.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/paytaca.jsView on unpkg

1#!/usr/bin/env node L2: const path = require('path'); L3: const { spawn } = require('child_process');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/paytaca.jsView on unpkg · L1

scripts/postinstall.jsView file

114// npm runs lifecycle scripts with cwd = the package install dir, so L115: // consider both `<cwd>/.opencode` and `<cwd>` itself as project scopes. L116: const cfgDir = path.join( ... L122: const configDirs = []; L123: for (const d of [cfgDir, path.join(cwd, '.opencode'), cwd]) { L124: if (isInside(d, pkgRoot)) continue; ... L140: json.dependencies = deps; L141: fs.writeFileSync(file, JSON.stringify(json, null, 2) + '\n'); L142: log(`Pinned ${PACKAGE_NAME} to ${own} in ${file}`); ... L168: if (!binDir) throw new Error('Could not determine global bin directory'); L169: fs.mkdirSync(binDir, { recursive: true }); L170:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L114

•matchType = previous_version_dangerous_delta matchedPackage = @paytaca/opencode-plugin@0.2.0 matchedIdentity = npm:[redacted]:0.2.0 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/postinstall.jsView on unpkg

172// Windows can't run shebang'd .js files, and symlinking requires admin / L173: // Developer Mode. Ship a .cmd shim (used by cmd.exe and PowerShell) plus a L174: // POSIX-style wrapper so Git-Bash / MSYS users get a working `paytaca` too.

High

dist/proxy.jsView file

•matchType = normalized_sha256 matchedPackage = @paytaca/opencode-plugin@0.2.1 matchedPath = dist/proxy.js matchedIdentity = npm:[redacted]:0.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/proxy.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = ec8b6e18a516c8be signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @paytaca/opencode-plugin@0.2.1 matchedPath = dist/proxy.js matchedIdentity = npm:[redacted]:0.2.1 similarity = 1.000 shingleOverlap = 9 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/proxy.jsView on unpkg

45const crypto = __importStar(require("crypto")); L46: const child_process_1 = require("child_process"); L47: const config_1 = require("./config"); ... L51: try { L52: const paytacaCliPkg = require.resolve('paytaca-cli/package.json'); L53: return path.resolve(path.dirname(paytacaCliPkg), 'bin', 'paytaca.js'); ... L55: catch { } L56: const localPaytaca = path.join(__dirname, '..', 'node_modules', '.bin', 'paytaca'); L57: if (fs.existsSync(localPaytaca)) { ... L83: try { L84: const which = process.platform === 'win32' ? 'where' : 'which'; L85: const result = (0, child_process_1.execSync)(`${which} paytaca`, { encoding: 'utf8' }).trim().split('\n')[0];

Low

dist/bundled/mcp.jsView file

22L23: const http = require('http'); L24: const https = require('https'); L25: const { spawn } = require('child_process'); L26: const fs = require('fs'); ... L29: L30: const CONFIG_DIR = process.env.PAYTACA_CONFIG_DIR || path.join(os.homedir(), '.opencode-paytaca'); L31: const PAYTACA_CMD = process.env.PAYTACA_CMD || 'paytaca';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bundled/mcp.jsView on unpkg · L22

22Cross-file remote execution chain: dist/bundled/mcp.js spawns dist/config.js; helper contains network access plus dynamic code execution. L22: L23: const http = require('http'); L24: const https = require('https'); L25: const { spawn } = require('child_process'); L26: const fs = require('fs'); ... L29: L30: const CONFIG_DIR = process.env.PAYTACA_CONFIG_DIR || path.join(os.homedir(), '.opencode-paytaca'); L31: const PAYTACA_CMD = process.env.PAYTACA_CMD || 'paytaca'; ... L44: const timestamp = new Date().toISOString(); L45: logStream.write(timestamp + ' [MCP] ' + message + '\\n'); L46: } ... L50: try {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bundled/mcp.jsView on unpkg · L22

•matchType = normalized_sha256 matchedPackage = @paytaca/opencode-plugin@0.2.1 matchedPath = dist/bundled/mcp.js matchedIdentity = npm:[redacted]:0.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

dist/bundled/proxy.js#virtual:normalized:round1View file

210const djangoReq = REQUester.request(options, (djangoRes) => { L211: // Response started; clear the connect/first-byte timeout so slow streams aren"t killed.\n if (!timeoutCleared) {\n djangoReq.clearTimeout();\n timeoutCleared = true;\... L212: var pendingPayload = pendingPayments.get(walletHash);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bundled/proxy.js#virtual:normalized:round1View on unpkg · L210

210Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js -> dist/proxy.js -> dist/bundled/proxy.js L210: const djangoReq = REQUester.request(options, (djangoRes) => { L211: // Response started; clear the connect/first-byte timeout so slow streams aren"t killed.\n if (!timeoutCleared) {\n djangoReq.clearTimeout();\n timeoutCleared = true;\... L212: var pendingPayload = pendingPayments.get(walletHash);

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/bundled/proxy.js#virtual:normalized:round1View on unpkg · L210

dist/bundled/proxy.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: "use strict"; object.defineproperty(exports, "__esmodule", { value: true }); exports.proxy_script_content = void 0; exports.proxy_script_content = `#!/usr/bin/env node /** * paytaca ai proxy * * sits between opencode and the django backend. * - auto-starts by opencode plugin * - on 402, returns sse typewriter loading sequence + synthetic payment prompt * - stores pending payments; handles "yes"/"no" approval internally * - uses only node.js built-in modules * * usage: node proxy.js [backend_url] [proxy_port] * example: node proxy.js https://api.paytaca.ai 8001 */ cons

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/bundled/proxy.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @paytaca/opencode-plugin@0.2.1 matchedPath = dist/bundled/mcp.js matchedIdentity = npm:[redacted]:0.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bundled/proxy.jsView on unpkg

dist/wallet.jsView file

•matchType = normalized_sha256 matchedPackage = @paytaca/opencode-plugin@0.2.1 matchedPath = dist/wallet.js matchedIdentity = npm:[redacted]:0.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/wallet.jsView on unpkg

dist/config.jsView file

•matchType = normalized_sha256 matchedPackage = @paytaca/opencode-plugin@0.2.1 matchedPath = dist/config.js matchedIdentity = npm:[redacted]:0.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config.jsView on unpkg

dist/index.jsView file

•matchType = normalized_sha256 matchedPackage = @paytaca/opencode-plugin@0.2.1 matchedPath = dist/index.js matchedIdentity = npm:[redacted]:0.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

dist/selfheal.jsView file

•matchType = normalized_sha256 matchedPackage = @paytaca/opencode-plugin@0.2.1 matchedPath = dist/selfheal.js matchedIdentity = npm:[redacted]:0.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/selfheal.jsView on unpkg