registry / @plannotator/opencode / 0.28.34
@plannotator/opencode@0.28.34
Plannotator plugin for OpenCode - interactive plan review with visual annotation
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe source confirms automatic install-time setup of package-owned OpenCode assets, a guarded first-party extension lifecycle risk. The credential-related scanner matches resolve to a loopback RPC token exchange, and no concrete attack behavior was identified in the inspected excerpts.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A package manager runs the postinstall hook for an installed package.
Impact
OpenCode loads the installed commands and skill from the user config, changing its available agent instructions and commands.
Mechanism
The hook copies command markdown files and a skill file into the OpenCode config directory; the default guard allows this when the package path is under node_modules.
AI rationale
The source confirms automatic install-time setup of package-owned OpenCode assets, a guarded first-party extension lifecycle risk. The credential-related scanner matches resolve to a loopback RPC token exchange, and no concrete attack behavior was identified in the inspected excerpts.
Evidence
package.jsonscripts/postinstall.cjs
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json runs scripts/postinstall.cjs as an install lifecycle hook.
- The hook copies this package’s command files and skill into the user’s OpenCode config when the package is installed under node_modules; an environment variable can force or disable the copy.
- The registry-token references belong to a localhost RPC bridge that reads a local registry and sends its token to 127.0.0.1.
Evidence against
- The install-time files are the package’s own OpenCode commands and skill, consistent with setting up this plugin.
- The inspected token transport targets a loopback address, with no external credential recipient shown in those source excerpts.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetry
Source & flagged code
6 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdiagram-engine/engine.jsView file
1function mc(e,t){for(var n=0;n<t.length;n++){const r=t[n];if(typeof r!="string"&&!Array.isArray(r)){for(const o in r)if(o!=="default"&&!(o in e)){const s=Object.getOwnPropertyDescr...
L2: `);let n=t.length;for(;n>0&&(t[n-1]??"").trim()==="";)n-=1;let r=1;for(;r<=n&&(t[r-1]??"").trim()==="";)r+=1;return n===0||r>n?null:[r,n]}function _c(e){for(const t of e.split(`
Medium
Findings
1 Critical2 High6 Medium7 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighPrevious Version Dangerous Deltadist/server.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirediagram-engine/engine.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filediagram-engine/mermaid.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @plannotator/opencode@0.28.34.
See all versions of @plannotator/opencode for other recorded verdicts.
- Review the evidence and your use of @plannotator/opencode@0.28.34 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.