registry / @plannotator/opencode / 0.28.39
@plannotator/opencode@0.28.39
Plannotator plugin for OpenCode - interactive plan review with visual annotation
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe reviewed lifecycle code only copies the package’s command and skill assets, and the flagged token-bearing requests target a loopback Inbox service. The download-and-run string is an installation suggestion shown when the CLI is missing, not an automatically executed command.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
OpenCode loads the plugin; the postinstall hook runs when an installer permits lifecycle scripts.
Impact
The observed behavior supports the package’s stated integration; no automatic transmission to an external collector was found.
Mechanism
The hook copies package command stubs and a skill into OpenCode’s config directory. Runtime Inbox requests use a token from a local registry and target 127.0.0.1.
AI rationale
The reviewed lifecycle code only copies the package’s command and skill assets, and the flagged token-bearing requests target a loopback Inbox service. The download-and-run string is an installation suggestion shown when the CLI is missing, not an automatically executed command.
Evidence
${XDG_CONFIG_HOME:-~/.config}/opencode/commands/*.md${XDG_CONFIG_HOME:-~/.config}/opencode/skills/plannotator/SKILL.md
Network endpoints1
127.0.0.1
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes OpenCode plugin entry points for its two supported host versions.
- The postinstall hook copies the package’s command stubs and skill into OpenCode’s config directory.
- The flagged credential-bearing request sends to a loopback address and uses a token read from the local Inbox registry.
- Plugin setup registers OpenCode commands and optional Inbox tools; no external credential receiver was identified.
Evidence against
- The package runs a postinstall hook that writes files outside the package directory when installed under node_modules.
- The plugin uses local filesystem and process environment data to configure its OpenCode and Inbox integrations.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetry
Source & flagged code
6 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdiagram-engine/engine.jsView file
1function gc(e,t){for(var n=0;n<t.length;n++){const r=t[n];if(typeof r!="string"&&!Array.isArray(r)){for(const o in r)if(o!=="default"&&!(o in e)){const s=Object.getOwnPropertyDescr...
L2: `);let n=t.length;for(;n>0&&(t[n-1]??"").trim()==="";)n-=1;let r=1;for(;r<=n&&(t[r-1]??"").trim()==="";)r+=1;return n===0||r>n?null:[r,n]}function Rc(e){for(const t of e.split(`
Medium
Findings
1 Critical2 High6 Medium7 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighPrevious Version Dangerous Deltadist/server.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirediagram-engine/engine.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filediagram-engine/mermaid.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @plannotator/opencode@0.28.39.
See all versions of @plannotator/opencode for other recorded verdicts.
- Review the evidence and your use of @plannotator/opencode@0.28.39 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.