registry / @plannotator/opencode / 0.28.33
@plannotator/opencode@0.28.33
Plannotator plugin for OpenCode - interactive plan review with visual annotation
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe install hook automatically writes package-owned OpenCode integration files, which warrants a warning for agent extension lifecycle risk. The inspected runtime credential flow is authenticated loopback communication and does not establish exfiltration or malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A package-manager installation that runs the postinstall lifecycle script.
Impact
The install can add or replace package-named OpenCode commands and skill files. No external credential exposure was established; the inspected token request is loopback-only.
Mechanism
The script detects an installed package under node_modules, then copies command files and the Plannotator skill into the OpenCode config directory.
AI rationale
The install hook automatically writes package-owned OpenCode integration files, which warrants a warning for agent extension lifecycle risk. The inspected runtime credential flow is authenticated loopback communication and does not establish exfiltration or malicious behavior.
Evidence
package.jsonscripts/postinstall.cjs
Network endpoints1
127.0.0.1
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest runs the postinstall copier automatically when the package manager runs lifecycle scripts.
- The postinstall script copies package command stubs and a skill into the OpenCode config directory for installed packages.
- The flagged runtime request reads a local registry and sends its bearer token to a loopback address.
- The bundled diagram-engine files contain rendering and state-management code; no external credential transfer is established by the inspected excerpts.
Evidence against
- The install-time config write is limited to this package’s OpenCode commands and skill, and the script supports an explicit environment override to skip copying.
- The inspected credential transport targets 127.0.0.1 and uses a token read from the local registry; it does not establish external credential exfiltration.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Source & flagged code
5 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdiagram-engine/engine.jsView file
1function mc(e,t){for(var n=0;n<t.length;n++){const r=t[n];if(typeof r!="string"&&!Array.isArray(r)){for(const o in r)if(o!=="default"&&!(o in e)){const s=Object.getOwnPropertyDescr...
L2: `);let n=t.length;for(;n>0&&(t[n-1]??"").trim()==="";)n-=1;let r=1;for(;r<=n&&(t[r-1]??"").trim()==="";)r+=1;return n===0||r>n?null:[r,n]}function _c(e){for(const t of e.split(`
Medium
Findings
1 Critical1 High6 Medium7 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirediagram-engine/engine.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filediagram-engine/mermaid.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @plannotator/opencode@0.28.33.
See all versions of @plannotator/opencode for other recorded verdicts.
- Review the evidence and your use of @plannotator/opencode@0.28.33 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.