registry / @soyjuanpiece/jpcode / 1.0.0

@soyjuanpiece/jpcode@1.0.0

JpCode — la CLI de opencode con identidad visual propia: banner JPCODE, tema claude, /cost, /memory y layout adaptativo. Motor opencode real, solo rediseñado por fuera.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation automatically changes the user's OpenCode agent configuration. No network activity was identified in the inspected installer.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall execution.

Impact

It persistently causes OpenCode to load this package's plugin without an explicit user command.

Mechanism

The installer adds a file-based plugin entry and writes the OpenCode TUI configuration.

Policy narrative

The npm postinstall hook invokes the installer. It locates the user's OpenCode TUI configuration, adds the package plugin path, and saves the configuration. This is an automatic mutation of a separate AI-agent control surface during installation.

AI rationale

The package performs an unconsented postinstall write to a user's OpenCode configuration, causing a package-supplied plugin to load. This meets the install-time AI-agent control-surface mutation blocking policy.

Evidence

package.jsonbin/install-plugin.mjsopencode/tui.json

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.

Evidence for policy risk

The package automatically runs an installer after npm installation.

@soyjuanpiece/jpcode@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code