registry / @plannotator/opencode / 0.28.35
@plannotator/opencode@0.28.35
Plannotator plugin for OpenCode - interactive plan review with visual annotation
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe automatic install-time change to OpenCode configuration is a first-party agent extension setup, so it warrants a warning. The inspected credential path is a local Inbox bridge and does not establish external exfiltration.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A package manager runs postinstall for an installed package under node_modules; an environment setting can also force the copy.
Impact
OpenCode gains package-provided commands and skill content after installation.
Mechanism
The hook copies package command markdown files and the Plannotator skill into OpenCode’s user configuration directory.
AI rationale
The automatic install-time change to OpenCode configuration is a first-party agent extension setup, so it warrants a warning. The inspected credential path is a local Inbox bridge and does not establish external exfiltration.
Evidence
package.jsonscripts/postinstall.cjs~/.config/opencode/commands/*.md~/.config/opencode/skills/plannotator/SKILL.md
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest runs scripts/postinstall.cjs as a postinstall hook.
- The hook copies this package’s command files and skill into the user’s OpenCode configuration; it normally does so for installed packages under node_modules.
- The flagged bearer token flow reads the local Inbox registry and sends requests to 127.0.0.1; the inspected path does not show an external recipient.
Evidence against
- The copied files are package-owned command and skill assets, and the hook has an environment override to skip copying.
- The inspected credential flow uses a loopback address and a token read from the local Inbox registry.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
5 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdiagram-engine/engine.jsView file
1function mc(e,t){for(var n=0;n<t.length;n++){const r=t[n];if(typeof r!="string"&&!Array.isArray(r)){for(const o in r)if(o!=="default"&&!(o in e)){const s=Object.getOwnPropertyDescr...
L2: `);let n=t.length;for(;n>0&&(t[n-1]??"").trim()==="";)n-=1;let r=1;for(;r<=n&&(t[r-1]??"").trim()==="";)r+=1;return n===0||r>n?null:[r,n]}function _c(e){for(const t of e.split(`
Medium
Findings
1 Critical1 High6 Medium7 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirediagram-engine/engine.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filediagram-engine/mermaid.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @plannotator/opencode@0.28.35.
See all versions of @plannotator/opencode for other recorded verdicts.
- Review the evidence and your use of @plannotator/opencode@0.28.35 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.