Loading npm security reports…

@paytaca/opencode-plugin@0.3.0: AI-agent control-surface risk | LPM Firewall

registry / @paytaca/opencode-plugin / 0.3.0

@paytaca/opencode-plugin@0.3.0

OpenCode plugin for Paytaca AI - AI inference provider powered by Bitcoin Cash micropayments

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Automatic installation mutates OpenCode and consumer-project dependency state to pin this package and remove competing versions. Runtime code repeats this mutation after checking the npm registry.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing the package runs postinstall; loading it in OpenCode runs its self-healing logic.

Impact

It can silently control which plugin release OpenCode resolves and disrupt normal dependency integrity and updates.

Mechanism

Lifecycle-driven OpenCode configuration, lockfile, cache, and global-command mutation.

Policy narrative

On installation, the package automatically pins its own version in OpenCode and current-project manifests, removes lockfiles, deletes cached copies of other releases, and may alter the global command path. When loaded, it checks the npm registry and repeats dependency, lockfile, and cache changes for a newer release. These unconsented mutations affect external AI-agent and project control surfaces rather than only package-owned files.

Rationale

This is concrete unconsented postinstall mutation of broad OpenCode and consumer-project control surfaces, reinforced by runtime self-update behavior. The package-aligned endpoints and payment purpose do not justify replacing dependency selections or deleting integrity lockfiles.

Evidence

package.jsonscripts/postinstall.jsdist/selfheal.jsdist/index.js~/.config/opencode/package.json<cwd>/.opencode/package.json

Source & flagged code

20 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/paytaca.jsView file

2const path = require('path'); L3: const { spawn } = require('child_process'); L4:

High

Child Process

Package source references child process execution.

bin/paytaca.jsView on unpkg · L2

•matchType = normalized_sha256 matchedPackage = @paytaca/opencode-plugin@0.2.2 matchedPath = bin/paytaca.js matchedIdentity = npm:[redacted]:0.2.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/paytaca.jsView on unpkg

1#!/usr/bin/env node L2: const path = require('path'); L3: const { spawn } = require('child_process');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/paytaca.jsView on unpkg · L1

scripts/postinstall.jsView file

114// npm runs lifecycle scripts with cwd = the package install dir, so L115: // consider both `<cwd>/.opencode` and `<cwd>` itself as project scopes. L116: const cfgDir = path.join( ... L122: const configDirs = []; L123: for (const d of [cfgDir, path.join(cwd, '.opencode'), cwd]) { L124: if (isInside(d, pkgRoot)) continue; ... L140: json.dependencies = deps; L141: fs.writeFileSync(file, JSON.stringify(json, null, 2) + '\n'); L142: log(`Pinned ${PACKAGE_NAME} to ${own} in ${file}`); ... L168: if (!binDir) throw new Error('Could not determine global bin directory'); L169: fs.mkdirSync(binDir, { recursive: true }); L170:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L114

172// Windows can't run shebang'd .js files, and symlinking requires admin / L173: // Developer Mode. Ship a .cmd shim (used by cmd.exe and PowerShell) plus a L174: // POSIX-style wrapper so Git-Bash / MSYS users get a working `paytaca` too.

High

Shell

Package source references shell execution.

scripts/postinstall.jsView on unpkg · L172

213try { L214: execSync('npm install -g paytaca-cli', { stdio: 'inherit' }); L215: asdfReshim();

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.jsView on unpkg · L213

dist/proxy.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @paytaca/opencode-plugin@0.2.0 matchedIdentity = npm:[redacted]:0.2.0 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/proxy.jsView on unpkg

45const crypto = __importStar(require("crypto")); L46: const child_process_1 = require("child_process"); L47: const config_1 = require("./config"); ... L51: try { L52: const paytacaCliPkg = require.resolve('paytaca-cli/package.json'); L53: return path.resolve(path.dirname(paytacaCliPkg), 'bin', 'paytaca.js'); ... L55: catch { } L56: const localPaytaca = path.join(__dirname, '..', 'node_modules', '.bin', 'paytaca'); L57: if (fs.existsSync(localPaytaca)) { ... L83: try { L84: const which = process.platform === 'win32' ? 'where' : 'which'; L85: const result = (0, child_process_1.execSync)(`${which} paytaca`, { encoding: 'utf8' }).trim().split('\n')[0];

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/proxy.jsView on unpkg · L45

dist/bundled/mcp.jsView file

22L23: const http = require('http'); L24: const https = require('https'); L25: const { spawn } = require('child_process'); L26: const fs = require('fs'); ... L29: L30: const CONFIG_DIR = process.env.PAYTACA_CONFIG_DIR || path.join(os.homedir(), '.opencode-paytaca'); L31: const PAYTACA_CMD = process.env.PAYTACA_CMD || 'paytaca';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bundled/mcp.jsView on unpkg · L22

22Cross-file remote execution chain: dist/bundled/mcp.js spawns dist/config.js; helper contains network access plus dynamic code execution. L22: L23: const http = require('http'); L24: const https = require('https'); L25: const { spawn } = require('child_process'); L26: const fs = require('fs'); ... L29: L30: const CONFIG_DIR = process.env.PAYTACA_CONFIG_DIR || path.join(os.homedir(), '.opencode-paytaca'); L31: const PAYTACA_CMD = process.env.PAYTACA_CMD || 'paytaca'; ... L44: const timestamp = new Date().toISOString(); L45: logStream.write(timestamp + ' [MCP] ' + message + '\\n'); L46: } ... L50: try {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bundled/mcp.jsView on unpkg · L22

•matchType = normalized_sha256 matchedPackage = @paytaca/opencode-plugin@0.2.2 matchedPath = dist/bundled/mcp.js matchedIdentity = npm:[redacted]:0.2.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

dist/bundled/proxy.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: "use strict"; object.defineproperty(exports, "__esmodule", { value: true }); exports.proxy_script_content = void 0; exports.proxy_script_content = `#!/usr/bin/env node /** * paytaca ai proxy * * sits between opencode and the django backend. * - auto-starts by opencode plugin * - on 402, returns sse typewriter loading sequence + synthetic payment prompt * - stores pending payments; handles "yes"/"no" approval internally * - uses only node.js built-in modules * * usage: node proxy.js [backend_url] [proxy_port] * example: node proxy.js https://api.paytaca.ai 8001 */ cons

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/bundled/proxy.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @paytaca/opencode-plugin@0.2.2 matchedPath = dist/bundled/mcp.js matchedIdentity = npm:[redacted]:0.2.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bundled/proxy.jsView on unpkg

dist/wallet.jsView file

•matchType = normalized_sha256 matchedPackage = @paytaca/opencode-plugin@0.2.2 matchedPath = dist/wallet.js matchedIdentity = npm:[redacted]:0.2.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/wallet.jsView on unpkg

dist/config.jsView file

•matchType = normalized_sha256 matchedPackage = @paytaca/opencode-plugin@0.2.2 matchedPath = dist/config.js matchedIdentity = npm:[redacted]:0.2.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config.jsView on unpkg

dist/index.jsView file

•matchType = normalized_sha256 matchedPackage = @paytaca/opencode-plugin@0.2.2 matchedPath = dist/index.js matchedIdentity = npm:[redacted]:0.2.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

dist/selfheal.jsView file

•matchType = normalized_sha256 matchedPackage = @paytaca/opencode-plugin@0.2.2 matchedPath = dist/selfheal.js matchedIdentity = npm:[redacted]:0.2.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/selfheal.jsView on unpkg

Source & flagged code

20 flagged

package.jsonView file

Lines 2-42json

2 "name": "@paytaca/opencode-plugin",

3 "version": "0.3.0",

4 "description": "OpenCode plugin for Paytaca AI - AI inference provider powered by Bitcoin Cash micropayments",

5 "main": "dist/index.js",

6 "types": "dist/index.d.ts",

7 "bin": {

8 "paytaca": "./bin/paytaca.js"

9 },

10 "engines": {

11 "node": ">=20.0.0"

12 },

13 "files": [

14 "dist/",

15 "bin/",

16 "scripts/",

17 "README.md"

18 ],

19 "scripts": {

20 "build": "tsc",

21 "prepare": "npm run build && node scripts/sync-cache.js",

22 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L22

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L22

23 },

24 "keywords": [

25 "opencode",

26 "plugin",

27 "paytaca",

28 "bch",

29 "ai",

30 "provider"

31 ],

32 "author": "Paytaca",

33 "license": "MIT",

34 "dependencies": {

35 "@opencode-ai/plugin": "^1.17.8",

36 "paytaca-cli": "^0.5.0"

37 },

38 "devDependencies": {

39 "@types/node": "^20.0.0",

40 "typescript": "^5.0.0"

41 },

42 "peerDependencies": {

bin/paytaca.jsView file

Lines 1-15javascript

1#!/usr/bin/env node

2const path = require('path');

3const { spawn } = require('child_process');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/paytaca.jsView on unpkg · L1

scripts/postinstall.jsView file

Lines 94-134javascript

94 );

95 try {

96 for (const entry of fs.readdirSync(cacheBase)) {

97 if (entry.indexOf('opencode-plugin') ===

dist/proxy.jsView file

Lines 25-65javascript

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result

dist/bundled/mcp.jsView file

Lines 2-42javascript

2// This file contains the bundled MCP server script as a string

3// It gets written to ~/.opencode-paytaca/mcp-server.js at runtime

4Object.defineProperty(exports, "__esModule", { value: true });

5exports.MCP_SERVER_CONTENT = void 0;

6exports

dist/bundled/proxy.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: "use strict"; object.defineproperty(exports, "__esmodule", { value: true }); exports.proxy_script_content = void 0; exports.proxy_script_content = `#!/usr/bin/env node /** * paytaca ai proxy * * sits between opencode and the django backend. * - auto-starts by opencode plugin * - on 402, returns sse typewriter loading sequence + synthetic payment prompt * - stores pending payments; handles "yes"/"no" approval internally * - uses only node.js built-in modules * * usage: node proxy.js [backend_url] [proxy_port] * example: node proxy.js https://api.paytaca.ai 8001 */ cons

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/bundled/proxy.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @paytaca/opencode-plugin@0.2.2 matchedPath = dist/bundled/mcp.js matchedIdentity = npm:[redacted]:0.2.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bundled/proxy.jsView on unpkg

dist/wallet.jsView file

•matchType = normalized_sha256 matchedPackage = @paytaca/opencode-plugin@0.2.2 matchedPath = dist/wallet.js matchedIdentity = npm:[redacted]:0.2.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/wallet.jsView on unpkg

dist/config.jsView file

•matchType = normalized_sha256 matchedPackage = @paytaca/opencode-plugin@0.2.2 matchedPath = dist/config.js matchedIdentity = npm:[redacted]:0.2.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config.jsView on unpkg

dist/index.jsView file

•matchType = normalized_sha256 matchedPackage = @paytaca/opencode-plugin@0.2.2 matchedPath = dist/index.js matchedIdentity = npm:[redacted]:0.2.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

dist/selfheal.jsView file

•matchType = normalized_sha256 matchedPackage = @paytaca/opencode-plugin@0.2.2 matchedPath = dist/selfheal.js matchedIdentity = npm:[redacted]:0.2.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/selfheal.jsView on unpkg