registry / @postman-cse/opencode-cse-tools / 0.28.1

@postman-cse/opencode-cse-tools@0.28.1

Superseded by @postman-cse/opencode-cse-tools@0.29.0; cached installs may still resolve this version.

OpenCode plugin for Postman CSE Tools: injects the local cse MCP server in every directory, syncs the CSE skill set into the global OpenCode skills dir, and provisions the signed cse-toold daemon. Install globally and it just works, no per-project config.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 15 file(s), 169 KB of source, external domains: 127.0.0.1, api.linear.app, auth.openai.com

Source & flagged code

6 flagged

index.jsView file

Lines 12-52javascript

12// ~/.config/opencode/opencode.json

13// { "$schema": "https://opencode.ai/config.json",

14// "plugin": ["@postman-cse/opencode-cse-tools"] }

15//

16// What it does on load:

17// 1. `config` hook -- injects the local `cse` remote MCP server

18// (http://127.0.0.1:9901/mcp) and allows the cse-* / prep skills, so the

19// daemon's tools are available regardless of the working directory.

20// No bearer headers: credentials stay in okta-aio + the daemon keychain.

21// 2. On first init -- syncs the bundled skill set into the global OpenCode

22// skills dir (~/.config/opencode/skills) so the native `skill` tool lists

23// them. Guarded by a version stamp so it only recopies on upgrade.

24// 3. On session.created -- provisions the signed cse-toold daemon

25// (LaunchAgent + auth-maintenance loop) via the bundled binary, the same

26// provisioning the Claude/Codex/Factory SessionStart hooks perform.

28import { createRequire } from "node:module"

29import { fileURLToPath } from "node:url"

30import fs from "node:fs"

31import os from "node:os"

32import path from "node:path"

33import { spawn } from "node:child_process"

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L32

35const require = createRequire(import.meta.url)

36const HERE = path.dirname(fileURLToPath(import.meta.url))

37const MCP_URL = "http://127.0.0.1:9901/mcp"

39function globalConfigDir() {

40 // Mirror OpenCode's own resolution: OPENCODE_CONFIG_DIR wins, else XDG, else

41 // ~/.config/opencode.

42 if (process.env.OPENCODE_CONFIG_DIR) return process.env.OPENCODE_CONFIG_DIR

43 const xdg = process.env.XDG_CONFIG_HOME

44 const base = xdg && xdg.trim() ? xdg : path.join(os.homedir(), ".config")

45 return path.join(base, "opencode")

46}

48function pkgVersion() {

49 try {

50 return require("./package.json").version || "0.0.0"

51 } catch {

52 return "0.0.0"

Lines 93-133javascript

93 } catch {

94 /* fall through and recopy */

95 }

97 for (const name of fs.readdirSync(bundled)) {

98 const src = path.join(bundled, name)

99 if (!fs.statSync(src).isDirectory

skills/cse-sweep/scripts/lib/cse-tools.mjsView file

Lines 147-187javascript

147

148export async function dispatchCseQuery(code, { deadlineMs, allowedTools, personSubjects } = {}) {

149 if (typeof code !== "string" || !code.trim()) {

skills/cse-linear-jsp/scripts/linear-jsp.mjsView file

Lines 1-40javascript

1#!/usr/bin/env node

2// cse-linear-jsp helper — Linear GraphQL CRUD + Salesforce sync for the Top-100 JSP motion.

3// Auth: LINEAR_API_KEY env (CI) or macOS keychain item 'cse-linear-api-key' (laptop). SF via authed 'sf' CLI.

4// CI env overrides: JSP_MAP_FILE (map path). sf-sync flags: --account <name>, --dry-run, --frozen-map.

5// No deps; Node >= 18.

7import { execFileSync } from "node:child_process";

8import { readFileSync, readdirSync, writeFileSync, mkdirSync, existsSync, appendFileSync } from "node:fs";

agents/shared/skill-bootstrap.shView file

•path = agents/shared/sk[redacted] kind = build_helper sizeBytes = 2319 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

agents/shared/skill-bootstrap.shView on unpkg

skills/cse-sweep/scripts/lib/nav-loop.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @postman-cse/opencode-cse-tools@0.27.0 matchedIdentity = npm:[redacted]:0.27.0 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

skills/cse-sweep/scripts/lib/nav-loop.mjsView on unpkg

Source & flagged code

6 flagged · loading source

index.jsView file

32import path from "node:path" L33: import { spawn } from "node:child_process" L34:

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L32

113package = @postman-cse/opencode-cse-tools; repositoryIdentity = cse-tools; dependency = @postman-cse/cse-toold L113: try { L114: const { resolveCoreBinary } = require("@postman-cse/cse-toold") L115: return resolveCoreBinary()

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

index.jsView on unpkg · L113

skills/cse-sweep/scripts/lib/cse-tools.mjsView file

167// eslint-disable-next-line no-new-func L168: const fn = new Function("tools", "Promise", "JSON", "Math", "Date", "Object", "Array", "String", "Number", "Boolean", L169: `return (async () => {\n${code}\n})()`);

Low

Eval

Package source references a known benign dynamic code generation pattern.

skills/cse-sweep/scripts/lib/cse-tools.mjsView on unpkg · L167

skills/cse-linear-jsp/scripts/linear-jsp.mjsView file

20function apiKey() { L21: if (process.env.LINEAR_API_KEY) return process.env.LINEAR_API_KEY.trim(); L22: try { L23: return execFileSync("security", ["find-generic-password", "-s", "cse-linear-api-key", "-w"], { encoding: "utf8" }).trim(); L24: } catch { ... L33: try { L34: r = await fetch("https://api.linear.app/graphql", { L35: method: "POST",

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

skills/cse-linear-jsp/scripts/linear-jsp.mjsView on unpkg · L20

agents/shared/skill-bootstrap.shView file

•path = agents/shared/sk[redacted] kind = build_helper sizeBytes = 2319 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

agents/shared/skill-bootstrap.shView on unpkg

skills/cse-sweep/scripts/lib/nav-loop.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

skills/cse-sweep/scripts/lib/nav-loop.mjsView on unpkg

Findings

5 High4 Medium7 Low

HighChild Processindex.js

HighShell

HighSame File Env Network Executionskills/cse-linear-jsp/scripts/linear-jsp.mjs

HighCopied Package Dependency Bridgeindex.js

HighPrevious Version Dangerous Deltaskills/cse-sweep/scripts/lib/nav-loop.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperagents/shared/skill-bootstrap.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalskills/cse-sweep/scripts/lib/cse-tools.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License