registry / @plannotator/opencode / 0.28.20
@plannotator/opencode@0.28.20
Plannotator plugin for OpenCode - interactive plan review with visual annotation
AI Security Review
scanned 21d ago · by lpm-firewall-aiThe install hook automatically mutates the user’s OpenCode configuration by installing package-owned commands and a skill. This matches first-party agent extension setup, which warrants a warning but does not establish malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
A package manager runs the postinstall hook for an installed package under node_modules; the hook can be disabled with its environment override.
Impact
The user’s global OpenCode configuration gains or updates Plannotator commands and a skill.
Mechanism
The hook copies package command markdown files and the Plannotator skill into the user’s OpenCode config directory, replacing same-named files when copied.
AI rationale
The install hook automatically mutates the user’s OpenCode configuration by installing package-owned commands and a skill. This matches first-party agent extension setup, which warrants a warning but does not establish malicious behavior.
Evidence
package.jsonscripts/postinstall.cjscommands/plannotator-annotate.mdcommands/plannotator-review.mdskills/plannotator/SKILL.mdcommands/plannotator-last.md
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest runs scripts/postinstall.cjs during postinstall.
- For an installed package under node_modules, the hook copies files into the user’s OpenCode config directory unless explicitly disabled by its environment override.
- The hook copies command markdown files and the Plannotator skill into OpenCode’s config, replacing same-named files when copied.
- The installed command files invoke Plannotator annotation and review actions.
Evidence against
- The inspected hook copies this package’s own command and skill files; the reviewed behavior did not establish credential transfer or a malicious payload.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/server.jsView file
5732if (existsSync9(builtPath)) {
L5733: return await import(pathToFileURL(builtPath).href);
L5734: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/server.jsView on unpkg · L5732Findings
1 High6 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/server.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/embedded.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @plannotator/opencode@0.28.20.
See all versions of @plannotator/opencode for other recorded verdicts.
- Review the evidence and your use of @plannotator/opencode@0.28.20 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.