registry / @plannotator/opencode / 0.26.4
@plannotator/opencode@0.26.4
Plannotator plugin for OpenCode - interactive plan review with visual annotation
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection confirms a package-aligned OpenCode plan-review integration with an automatic command-copy hook and runtime permission configuration. These are non-malicious but warrant a warning under the extension-lifecycle policy.
Static reason
One or more suspicious static signals were detected.
Trigger
npm postinstall; then OpenCode loads the configured plugin or the user invokes its review commands.
Impact
Changes the OpenCode command/control surface for this extension and can process user-selected plan or URL content; no malicious execution or exfiltration chain was confirmed.
Mechanism
OpenCode extension setup, plan-review tooling, and optional share/URL annotation.
AI rationale
Source inspection confirms a package-aligned OpenCode plan-review integration with an automatic command-copy hook and runtime permission configuration. These are non-malicious but warrant a warning under the extension-lifecycle policy.
Evidence
package.jsondist/index.jsdist/server.jsdist/embedded.jscommands/plannotator-review.mdREADME.md${XDG_CONFIG_HOME:-$HOME/.config}/opencode/commands/commands/plannotator-annotate.mdcommands/plannotator-last.md${PLANNOTATOR_DATA_DIR:-$HOME/.plannotator}/active/<project>/_active-plan.md
Network endpoints4
share.plannotator.aiplannotator-paste.plannotator.workers.devr.jina.ai/api.github.com/repos/backnotprop/plannotator/releases/latest
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- package.json postinstall copies command files into the user's OpenCode commands directory.
- dist/index.js config hook enables submit_plan and modifies OpenCode agent permissions.
- dist/server.js spawns a user-configurable plannotator CLI during review actions.
- dist/embedded.js includes optional sharing and URL-fetch features.
Evidence against
- No preinstall hook, obfuscated payload, eval, or shell-enabled spawn found.
- postinstall only copies this package's three documented command markdown files.
- CLI spawn uses argument arrays with shell:false and is activated by review commands.
- Network features are package-aligned review/share functionality; Jina key is only sent to r.jina.ai when URL annotation is invoked.
- No credential harvesting, secret-file reads, destructive filesystem behavior, or foreign agent-config writes found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
4 flaggedpackage.jsonView file
•scripts.postinstall = mkdir -p ${XDG_CONFIG_HOME:-$HOME/.config}/opencode/commands && cp ./commands/*.md ${XDG_CONFIG_HOME:-$HOME/.config}/opencode/commands/ 2>/dev/null || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = mkdir -p ${XDG_CONFIG_HOME:-$HOME/.config}/opencode/commands && cp ./commands/*.md ${XDG_CONFIG_HOME:-$HOME/.config}/opencode/commands/ 2>/dev/null || true
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/server.jsView file
1119if (existsSync5(builtPath)) {
L1120: return await import(pathToFileURL(builtPath).href);
L1121: }
Medium
Dynamic Require
Findings
1 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/server.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/embedded.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @plannotator/opencode@0.26.4.
See all versions of @plannotator/opencode for other recorded verdicts.
- Review the evidence and your use of @plannotator/opencode@0.26.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.