registry / @tera-system/core / 0.1.5

@tera-system/core@0.1.5

Tera System OpenCode Plugin — governance core, 20 agents, 10 commands, distribution tools

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. On npm postinstall, the package configures a project-local OpenCode extension and enables two npx-fetched MCP tools. It also performs vendor license verification when a license key is present.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation of the package

Impact

Modifies the target workspace's .opencode control surface; later OpenCode use can run the configured MCP commands.

Mechanism

postinstall project-local agent configuration and license API verification

Rationale

This is a guarded but automatic AI-agent extension lifecycle mutation, so it warrants a warning. The inspected source does not establish malware or a broad/foreign control-surface takeover.

Evidence

package.jsonscripts/install.jsopencode.tera.example.json.opencode/agents/*.opencode/commands/*.opencode/opencode.json.opencode/opencode.tera.example.json.opencode/tera-core.manifest.json.tera/license.state.jsontera-system/*tools/*project-control/*

Network endpoints1

teranoo.com/api/license/verify

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

npm postinstall runs the installer automatically.
Installer writes agent commands/configuration into the install target's .opencode directory.
Installed OpenCode config enables MCP commands through npx.
Postinstall sends a supplied license key to the vendor license API.

Evidence against

Writes are project-local and ownership-aware; unowned conflicting files are retained.
No destructive shell execution, credential harvesting, or remote payload execution was found.
The remote request is a bounded license-verification POST to a package-aligned endpoint.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 14 file(s), 38.2 KB of source, external domains: teranoo.com, www.w3.org

Source & flagged code

5 flagged

package.jsonView file

Lines 4-38json

4 "description": "Tera System OpenCode Plugin — governance core, 20 agents, 10 commands, distribution tools",

5 "license": "SEE LICENSE IN LICENSE.md",

6 "type": "module",

7 "engines": {

8 "node": ">=18"

9 },

10 "files": [

11 "agents",

12 "commands",

13 "core",

14 "tools",

15 "scripts",

16 "MANIFEST.json",

17 "opencode.tera.example.json",

18 "WELCOME.md",

19 "README.md",

20 "LICENSE.md",

21 "RELEASES.md"

22 ],

23 "scripts": {

24 "postinstall": "node scripts/install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 },

26 "keywords": [

27 "opencode",

28 "plugin",

29 "tera",

30 "governance",

31 "agents",

32 "component"

33 ],

34 "publishConfig": {

35 "access": "public"

36 }

37}

scripts/install.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2/**

3 * @tera/core installer

4 * --------------------------------------------------------------

5 * NON-DESTRUCTIVE + OWNERSHIP-AWARE installer for the Tera System

6 * OpenCode Plugin component.

7 *

8 * Rules:

9 * - Never deletes anything.

10 * - Never overwrites a file it does not own.

11 * - Tracks ownership via `.opencode/tera-core.manifest.json`.

12 * - Only updates files it owns, always keeping a backup first.

13 * - Idempotent: re-running is safe; identical files are skipped.

14 * - Never touches an existing user `opencode.json`.

15 *

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install.jsView on unpkg · L10

16 * Target resolution (first match wins):

17 * 1. `--target <dir>` argument

18 * 2. `TERA_TARGET_DIR` environment variable

19 * 3. `INIT_CWD` (set by npm for lifecycle scripts)

20 * 4. current working directory

21 */

22import { createHash } from "node:crypto";

23import fs from "node:fs";

24import path from "node:path";

25import { fileURLToPath } from "node:url";

26import { assessLicenseState, readLicenseState, writeLicenseState } from "./lib/license.mjs";

28const __dirname = path.dirname(fileURLToPath(import.meta.url));

29const PKG_ROOT = path.resolve(__dirname, "..");

30const MANIFEST_NAME = "tera-core.manifest.json";

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. scripts/install.js: function copyFile(src, dest) { fs.copyFileSync(src, dest); fs.copyFileSync(destFile, bak); fs.copyFileSync(srcFile, destFile); copyFile(srcFile, destFile); copyFile(configSrc, configDest); copyFile(configSrc, exampleDest); copyFile(f, d);

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

scripts/install.jsView on unpkg

tools/tera-fetch.ps1View file

•path = tools/tera-fetch.ps1 kind = build_helper sizeBytes = 6816 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tools/tera-fetch.ps1View on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/install.jsView file

10* - Never overwrites a file it does not own. L11: * - Tracks ownership via `.opencode/tera-core.manifest.json`. L12: * - Only updates files it owns, always keeping a backup first. L13: * - Idempotent: re-running is safe; identical files are skipped. L14: * - Never touches an existing user `opencode.json`. L15: * ... L65: function copyFile(src, dest) { L66: fs.mkdirSync(path.dirname(dest), { recursive: true }); L67: fs.copyFileSync(src, dest); L68: } ... L70: function loadOwnership(target) { L71: const p = path.join(target, ".opencode", MANIFEST_NAME);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install.jsView on unpkg · L10

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

scripts/install.jsView on unpkg

tools/tera-fetch.ps1View file

•path = tools/tera-fetch.ps1 kind = build_helper sizeBytes = 6816 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tools/tera-fetch.ps1View on unpkg

Findings

1 Critical2 High5 Medium5 Low

CriticalAi Agent Control Hijackscripts/install.js

HighInstall Time Lifecycle Scriptspackage.json

HighEntrypoint Foreign Package Code Overwritescripts/install.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertools/tera-fetch.ps1

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License