registry / @softize/opus / 11.1.0

@softize/opus@11.1.0

End-to-end action protocol for TypeScript. Single package with subpath exports (core + adapters).

AI Security Review

scanned 18d ago · by lpm-firewall-ai

Installing the package automatically modifies the consuming repository's AI-agent configuration and Git hooks. No network endpoint is involved in this install-time behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall during installation in a project that lists @softize/opus as a dependency.

Impact

A dependency installation changes broad AI-agent control surfaces and repository execution hooks without an explicit setup command from the user.

Mechanism

The lifecycle script calls initialization, which materializes skills under .agents and .claude, registers a Claude Stop command hook, and configures repository Git hooks.

Attack narrative

The package manifest runs its postinstall automatically. For a consuming project, that path initializes the repository and materializes package-supplied agent skills, a Claude command hook, Claude settings, and Git hook configuration. This is an unconsented install-time mutation of broad AI-agent and repository control surfaces.

AI rationale

This is concrete install-hook abuse: an npm postinstall reaches package code that writes AI-agent configuration and execution hooks into the consumer repository. The absence of observed network exfiltration does not remove the unconsented control-surface mutation.

Evidence

package.jsonbin/lib/postinstall.mjsbin/lib/init.mjsbin/lib/materialize.mjs.agents/skills.claude/skills.claude/hooks/opus-check-on-stop.mjs.claude/settings.json.githooks/pre-push.d/opus.githooks/pre-push

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

The manifest automatically runs a postinstall program.
The postinstall invokes project initialization for any consumer declaring this package.
Initialization calls the setup materializer at the repository root.
The materializer copies package skills into both generic agent and Claude skill directories, installs a Claude hook, and writes a command hook into Claude settings.
The setup also changes the repository-local Git hook path and removes exclusions for agent artifacts.

Evidence against

No package-controlled network request or credential-exfiltration sink was found in the inspected lifecycle path.
The materializer preserves conflicting or edited managed files rather than overwriting them.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 175 file(s), 1.02 MB of source, external domains: exemplo.com.br, registry.softize.com.br

Source & flagged code

9 flagged

package.jsonView file

Lines 327-356json

327 "jsonwebtoken": "^9.0.2",

328 "kysely": "^0.27.0",

329 "node-cron": "^3.0.3",

330 "pg": "^8.13.0",

331 "pino": "^9.5.0",

332 "react": "^19.0.0",

333 "react-dom": "^19.0.0",

334 "react-hook-form": "^7.54.0",

335 "tsx": "^4.19.0",

336 "vite": "^6.0.0",

337 "vitest": "^2.1.0",

338 "zod": "^3.24.0"

339 },

340 "repository": {

341 "type": "git",

342 "url": "git+https://github.com/softize-dev/opus.git",

343 "directory": "packages/opus"

344 },

345 "homepage": "https://opus.softize.com.br",

346 "scripts": {

347 "postinstall": "node ./bin/lib/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L347

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L347

348 "typecheck": "tsc --noEmit",

349 "test": "vitest run",

350 "test:watch": "vitest",

351 "test:cov": "vitest run --coverage",

352 "registry:up": "npx -y verdaccio --config ~/.config/verdaccio/config.yaml",

353 "release": "bash ./scripts/release.sh",

354 "release:local": "bash ./scripts/release.sh --local"

355 }

356}

src/ui/docs/markdown.tsxView file

Lines 39-79tsx

39 scope,

40 previewClassName,

41}: {

42 code: string

43 scope: Record<string, unknown>

44 previewClassName?: string

45}): React.ReactElement {

46 const result = React.useMemo

bin/lib/db-migrate-runner.mjsView file

Lines 24-64javascript

25function emit(obj) {

26 process.stdout.write(`\n${JSON.stringify(obj)}\n`)

27}

bin/lib/init.mjsView file

Lines 1-21javascript

1/** opus setup: aplica o marcador per-app e os artefatos Opus rastreáveis no repo. */

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/lib/init.mjsView on unpkg · L1

3import { promises as fs } from "node:fs";

4import { tmpdir } from "node:os";

5import

CHANGELOG.mdView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 101

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

CHANGELOG.mdView on unpkg

bin/lib/db.mjsView file

•matchType = normalized_sha256 matchedPackage = @softize/opus@11.1.1 matchedPath = bin/lib/db.mjs matchedIdentity = npm:QHNvZnRpemUvb3B1cw:11.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/db.mjsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @softize/opus@18.0.1 matchedIdentity = npm:QHNvZnRpemUvb3B1cw:18.0.1 similarity = 0.450 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/lib/db.mjsView on unpkg

bin/lib/gen.mjsView file

•matchType = normalized_sha256 matchedPackage = @softize/opus@11.1.1 matchedPath = bin/lib/gen.mjs matchedIdentity = npm:QHNvZnRpemUvb3B1cw:11.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/gen.mjsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/lib/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/lib/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/ui/docs/markdown.tsxView file

59) L60: const fn = new Function(...entries.map(([k]) => k), js) L61: const args = entries.map(([, v]) => v)

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/ui/docs/markdown.tsxView on unpkg · L59

bin/lib/db-migrate-runner.mjsView file

44L45: const mod = await import(pathToFileURL(path.resolve(configPath)).href) L46: const config = mod.default ?? mod

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lib/db-migrate-runner.mjsView on unpkg · L44

bin/lib/init.mjsView file

1Install-time code directly mutates a foreign AI-agent control surface: L244: } else if (!twConfig) { L245: await fs.writeFile( L246: path.join(projectDir, "tailwind.config.js"), ... L324: if (!(await exists(markerPath)) || (await fs.readFile(markerPath, "utf8")) !== marker) { L325: await fs.writeFile(markerPath, marker); L326: (prev === null ? created : synced).push(MARKER); ... L329: // Remove somente o bloco legado que o próprio setup antigo declarava como gerenciado. L330: const claudePath = path.join(projectDir, "CLAUDE.md"); L331: if (await exists(claudePath)) { ... L334: if (next !== cur) { L335: await fs.writeFile(claudePath, next); L336: synced.push("CLAUDE.md (bloco legado removido)"); Write operation from bin/lib/init.mjs: L244: } else if (!twConfig) { L245: await fs.writeFile( L

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/lib/init.mjsView on unpkg · L1

CHANGELOG.mdView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 101

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

CHANGELOG.mdView on unpkg

bin/lib/db.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/db.mjsView on unpkg

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/lib/db.mjsView on unpkg

bin/lib/gen.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/gen.mjsView on unpkg

Findings

1 Critical5 High5 Medium5 Low

CriticalAi Agent Control Hijackbin/lib/init.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighSemantic Analysis LimitedCHANGELOG.md

HighKnown Malware Source Similaritybin/lib/db.mjs

HighKnown Malware Source Similaritybin/lib/gen.mjs

HighPrevious Version Dangerous Deltabin/lib/db.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/lib/db-migrate-runner.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalsrc/ui/docs/markdown.tsx

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @softize/opus@11.1.0.

See version security history for other recorded verdicts.

Avoid installing @softize/opus@11.1.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-20 08:43:47.011Z (UTC).