registry / @plannotator/opencode / 0.26.1
@plannotator/opencode@0.26.1
Plannotator plugin for OpenCode - interactive plan review with visual annotation
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection confirms an unconsented install-time OpenCode extension registration, which warrants warning under the stated lifecycle policy. The observed network and process features are command-driven and package-aligned; no malicious chain was established.
Static reason
One or more suspicious static signals were detected.
Trigger
npm postinstall; later OpenCode Plannotator command/plugin use
Impact
Persistent command registration and agent workflow/permission changes within OpenCode.
Mechanism
first-party OpenCode extension registration and plan-review workflow integration
AI rationale
Source inspection confirms an unconsented install-time OpenCode extension registration, which warrants warning under the stated lifecycle policy. The observed network and process features are command-driven and package-aligned; no malicious chain was established.
Evidence
package.jsondist/index.jsdist/server.jsdist/embedded.jscommands/plannotator-annotate.mdcommands/plannotator-review.mdcommands/plannotator-last.md${XDG_CONFIG_HOME:-$HOME/.config}/opencode/commands/
Network endpoints1
r.jina.ai/
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- package.json postinstall copies command files into OpenCode's user config.
- dist/index.js rewrites OpenCode workflow/tool permissions at plugin runtime.
- dist/embedded.js reads global AI-agent skill directories and can launch configured agent CLIs.
Evidence against
- postinstall only installs this package's three named OpenCode command markdown files.
- No lifecycle code fetches, executes, or drops a remote payload.
- Network fetches are user-invoked URL annotation; Jina use is explicit and supports JINA_API_KEY.
- CLI spawns use argument arrays with shell:false in dist/server.js.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggedpackage.jsonView file
•scripts.postinstall = mkdir -p ${XDG_CONFIG_HOME:-$HOME/.config}/opencode/commands && cp ./commands/*.md ${XDG_CONFIG_HOME:-$HOME/.config}/opencode/commands/ 2>/dev/null || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = mkdir -p ${XDG_CONFIG_HOME:-$HOME/.config}/opencode/commands && cp ./commands/*.md ${XDG_CONFIG_HOME:-$HOME/.config}/opencode/commands/ 2>/dev/null || true
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/server.jsView file
1118if (existsSync5(builtPath)) {
L1119: return await import(pathToFileURL(builtPath).href);
L1120: }
Medium
Dynamic Require
Findings
1 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/server.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/embedded.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @plannotator/opencode@0.26.1.
See all versions of @plannotator/opencode for other recorded verdicts.
- Review the evidence and your use of @plannotator/opencode@0.26.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.