Loading npm security reports…

@paytaca/opencode-plugin@0.3.2: Malicious npm security report | LPM Firewall

registry / @paytaca/opencode-plugin / 0.3.2

@paytaca/opencode-plugin@0.3.2

OpenCode plugin for Paytaca AI - AI inference provider powered by Bitcoin Cash micropayments

AI Security Review

scanned 26d ago · by lpm-firewall-ai

Installation automatically modifies OpenCode-related project manifests, cache entries, and lockfiles. Loading the plugin also changes OpenCode authentication and globally installs a skill.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation runs postinstall; loading the OpenCode plugin runs its initialization.

Impact

It can override the consumer's selected package version, remove dependency locks, alter agent configuration, and install globally accessible agent capabilities without a separate user command.

Mechanism

Automatic consumer-project mutation, global CLI installation, and AI-agent configuration changes.

Attack narrative

On installation, postinstall calls selfPin without obtaining a separate user action. It searches OpenCode configuration and the current project, rewrites dependency declarations to this exact release, deletes relevant lockfiles, and removes other cached plugin versions. It also creates a global command shim or falls back to a global npm installation. When the plugin loads, it writes an OpenCode auth entry and copies a global skill from its dependency. These changes broaden persistence and remove normal version-selection and lockfile protections.

AI rationale

This is concrete unconsented postinstall mutation of consumer and AI-agent control surfaces, combined with cache deletion and global command installation. The behavior exceeds package-local setup and is designed to force and preserve this release.

Evidence

package.jsonscripts/postinstall.jsdist/index.js~/.cache/opencode/packages/@paytaca/*

Source & flagged code

21 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/paytaca.jsView file

2const path = require('path'); L3: const { spawn } = require('child_process'); L4:

High

Child Process

Package source references child process execution.

bin/paytaca.jsView on unpkg · L2

•matchType = normalized_sha256 matchedPackage = @paytaca/opencode-plugin@0.3.1 matchedPath = bin/paytaca.js matchedIdentity = npm:[redacted]:0.3.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/paytaca.jsView on unpkg

scripts/postinstall.jsView file

114// npm runs lifecycle scripts with cwd = the package install dir, so L115: // consider both `<cwd>/.opencode` and `<cwd>` itself as project scopes. L116: const cfgDir = path.join( ... L122: const configDirs = []; L123: for (const d of [cfgDir, path.join(cwd, '.opencode'), cwd]) { L124: if (isInside(d, pkgRoot)) continue; ... L140: json.dependencies = deps; L141: fs.writeFileSync(file, JSON.stringify(json, null, 2) + '\n'); L142: log(`Pinned ${PACKAGE_NAME} to ${own} in ${file}`); ... L168: if (!binDir) throw new Error('Could not determine global bin directory'); L169: fs.mkdirSync(binDir, { recursive: true }); L170:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L114

172// Windows can't run shebang'd .js files, and symlinking requires admin / L173: // Developer Mode. Ship a .cmd shim (used by cmd.exe and PowerShell) plus a L174: // POSIX-style wrapper so Git-Bash / MSYS users get a working `paytaca` too.

High

Shell

Package source references shell execution.

scripts/postinstall.jsView on unpkg · L172

213try { L214: execSync('npm install -g paytaca-cli', { stdio: 'inherit' }); L215: asdfReshim();

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.jsView on unpkg · L213

dist/proxy.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @paytaca/opencode-plugin@0.2.0 matchedIdentity = npm:[redacted]:0.2.0 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/proxy.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @paytaca/opencode-plugin@0.3.1 matchedPath = dist/proxy.js matchedIdentity = npm:[redacted]:0.3.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/proxy.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 2904aaf4dbe05506 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @paytaca/opencode-plugin@0.3.1 matchedPath = dist/proxy.js matchedIdentity = npm:[redacted]:0.3.1 similarity = 1.000 shingleOverlap = 10 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/proxy.jsView on unpkg

dist/bundled/proxy.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: "use strict"; object.defineproperty(exports, "__esmodule", { value: true }); exports.proxy_script_content = void 0; exports.proxy_script_content = `#!/usr/bin/env node /** * paytaca ai proxy * * sits between opencode and the django backend. * - auto-starts by opencode plugin * - on 402, returns sse typewriter loading sequence + synthetic payment prompt * - stores pending payments; handles "yes"/"no" approval internally * - uses only node.js built-in modules * * usage: node proxy.js [backend_url] [proxy_port] * example: node proxy.js https://api.paytaca.ai 8001 */ cons

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/bundled/proxy.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @paytaca/opencode-plugin@0.3.1 matchedPath = dist/bundled/mcp.js matchedIdentity = npm:[redacted]:0.3.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bundled/proxy.jsView on unpkg

dist/bundled/mcp.jsView file

22Cross-file remote execution chain: dist/bundled/mcp.js spawns dist/config.js; helper contains network access plus dynamic code execution. L22: L23: const http = require('http'); L24: const https = require('https'); L25: const { spawn } = require('child_process'); L26: const fs = require('fs'); ... L29: L30: const CONFIG_DIR = process.env.PAYTACA_CONFIG_DIR || path.join(os.homedir(), '.opencode-paytaca'); L31: const PAYTACA_CMD = process.env.PAYTACA_CMD || 'paytaca'; ... L44: const timestamp = new Date().toISOString(); L45: logStream.write(timestamp + ' [MCP] ' + message + '\\n'); L46: } ... L50: try {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bundled/mcp.jsView on unpkg · L22

•matchType = normalized_sha256 matchedPackage = @paytaca/opencode-plugin@0.3.1 matchedPath = dist/bundled/mcp.js matchedIdentity = npm:[redacted]:0.3.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bundled/mcp.jsView on unpkg

dist/bundled/proxy.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/bundled/proxy.js#virtual:normalized:round1View on unpkg

dist/wallet.jsView file

•matchType = normalized_sha256 matchedPackage = @paytaca/opencode-plugin@0.3.1 matchedPath = dist/wallet.js matchedIdentity = npm:[redacted]:0.3.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/wallet.jsView on unpkg

dist/config.jsView file

•matchType = normalized_sha256 matchedPackage = @paytaca/opencode-plugin@0.3.1 matchedPath = dist/config.js matchedIdentity = npm:[redacted]:0.3.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config.jsView on unpkg

dist/index.jsView file

•matchType = normalized_sha256 matchedPackage = @paytaca/opencode-plugin@0.3.1 matchedPath = dist/index.js matchedIdentity = npm:[redacted]:0.3.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

dist/selfheal.jsView file

•matchType = normalized_sha256 matchedPackage = @paytaca/opencode-plugin@0.3.1 matchedPath = dist/selfheal.js matchedIdentity = npm:[redacted]:0.3.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/selfheal.jsView on unpkg

Lines 152-233javascript

152 if (fs.readFileSync(file, 'utf8').indexOf(PACKAGE_NAME) === -1) continue;

153 fs.rmSync(file, { force: true });

154 log(`Removed stale ${lock} in ${dir} (regenerates on next install)`);

155 } catch {}

156 }

157 }

158 } catch {}

159}

160

161// `opts.platform`/`opts.binDir` let tests drive the Windows/unix branches

162// deterministically; in production they default to the running platform and a

163// resolved global bin directory.

164async function linkGlobally(cliBin, opts) {

165 opts = opts || {};

166 const win = opts.platform ? opts.platform === 'win32' : IS_WIN;

167 const binDir = opts.binDir || globalBinDir();

168 if (!binDir) throw new Error('Could not determine global bin directory');

169 fs.mkdirSync(binDir, { recursive: true });

170

171 if (win) {

172 // Windows can't run shebang'd .js files, and symlinking requires admin /

173 // Developer Mode. Ship a .cmd shim (used by cmd.exe and PowerShell) plus a

174 // POSIX-style wrapper so Git-Bash / MSYS users get a working `paytaca` too.

High

Shell

Package source references shell execution.

scripts/postinstall.jsView on unpkg · L172

175 const cmdFile = path.join(binDir, 'paytaca.cmd');

176 fs.writeFileSync(cmdFile, '@echo off\r\nnode "' + cliBin + '" %*\r\n', 'utf8');

177 try {

178 const shFile = path.join(binDir, 'paytaca');

179 fs.writeFileSync(shFile, '#!/bin/sh\nexec node "' + cliBin + '" "$@"\n', 'utf8');

180 fs.chmodSync(shFile, '755');

181 } catch {}

182 return cmdFile;

183 }

184

185 const link = path.join(binDir, 'paytaca');

186 if (fs.existsSync(link) || fs.lstatSync(link, { throwIfNoEntry: false })) {

187 const st = fs.lstatSync(link, { throwIfNoEntry: false });

188 if (st && !st.isSymbolicLink()) throw new Error(`${link} exists and is not a symlink`);

189 fs.unlinkSync(link);

190 }

191 fs.symlinkSync(cliBin, link);

192 asdfReshim();

193 return link;

194}

195

196async function main() {

197 if (process.env.PAYTACA_PLUGIN_SKIP_POSTINSTALL) return;

198 selfPin();

199 if (which('paytaca') && runPaytacaVersion()) return;

200

201 const cliBin = resolveLocalCliBin();

202 if (!cliBin) {

203 log('paytaca-cli not found locally; skipping global link.');

204 return;

205 }

206

207 try {

208 const link = await linkGlobally(cliBin);

209 log(`Linked paytaca -> ${link}`);

210 } catch (err) {

211 log(`Could not link paytaca globally (${err.message}).`);

212 log('Falling back to: npm install -g paytaca-cli');

213 try {

214 execSync('npm install -g paytaca-cli', { stdio: 'inherit' });

215 asdfReshim();

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.jsView on unpkg · L213

216 } catch {

217 log('Auto-install failed. Run manually: npm install -g paytaca-cli');

218 }

219 }

220}

221

222// Export helpers for tests. When run as a script (npm postinstall), main()

223// executes; when required by a test, only the functions are exposed.

224if (require.main === module) {

225 main().catch(() => {});

226}

227

228module.exports = {

229 which,

230 runPaytacaVersion,

231 resolveLocalCliBin,

232 globalBinDir,

233 asdfReshim,