registry / @plannotator/opencode / 0.27.1
@plannotator/opencode@0.27.1
Plannotator plugin for OpenCode - interactive plan review with visual annotation
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is not malicious, but the install-time mutation of an AI-agent command directory warrants a warning under the lifecycle policy. The observed behavior is first-party, package-aligned extension setup rather than an unconsented broad control-surface hijack.
Static reason
One or more suspicious static signals were detected.
Trigger
npm install; subsequently an OpenCode planning agent invokes submit_plan.
Impact
Expands an AI-agent host's available commands and workflow surface, but no concrete malicious chain was confirmed.
Mechanism
first-party OpenCode command setup and guarded plan-review integration
AI rationale
This is not malicious, but the install-time mutation of an AI-agent command directory warrants a warning under the lifecycle policy. The observed behavior is first-party, package-aligned extension setup rather than an unconsented broad control-surface hijack.
Evidence
package.jsondist/server.jsREADME.mdcommands/plannotator-annotate.mdcommands/plannotator-last.mdcommands/plannotator-review.mdcommands/*.md${XDG_CONFIG_HOME:-$HOME/.config}/opencode/commands/
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- postinstall creates OpenCode command directory and copies this package's command Markdown into it.
- Plugin registers a submit_plan tool that can alter the host agent's plan-review workflow.
Evidence against
- Install hook only copies bundled command definitions; it does not download, execute, or modify arbitrary payloads.
- CLI bridge uses spawn with shell disabled and is activated during plan review, not installation.
- No credential harvesting, exfiltration, destructive project-file behavior, or covert persistence was found in inspected sources.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggedpackage.jsonView file
•scripts.postinstall = mkdir -p ${XDG_CONFIG_HOME:-$HOME/.config}/opencode/commands && cp ./commands/*.md ${XDG_CONFIG_HOME:-$HOME/.config}/opencode/commands/ 2>/dev/null || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = mkdir -p ${XDG_CONFIG_HOME:-$HOME/.config}/opencode/commands && cp ./commands/*.md ${XDG_CONFIG_HOME:-$HOME/.config}/opencode/commands/ 2>/dev/null || true
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/server.jsView file
1124if (existsSync5(builtPath)) {
L1125: return await import(pathToFileURL(builtPath).href);
L1126: }
Medium
Dynamic Require
Findings
1 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/server.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/embedded.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @plannotator/opencode@0.27.1.
See all versions of @plannotator/opencode for other recorded verdicts.
- Review the evidence and your use of @plannotator/opencode@0.27.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.