registry / @tera-system/core / 0.2.2
@tera-system/core@0.2.2
INTERNAL (personal edition) - not a licensed product. Commercial clients must use @tera-system/pro. This package requires authorization and will be restricted.
Tera System OpenCode Plugin — governance core, 20 agents, 11 commands, distribution tools (personal edition)
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe postinstall hook automatically installs first-party OpenCode extensions and may enable local MCP commands through an example configuration. This meets the warning category for package-owned agent extension setup, but the inspected code does not support a malicious verdict.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
npm runs the package's postinstall hook.
Impact
The workspace gains first-party agent extensions and configuration that can launch the listed MCP packages in later OpenCode sessions. This is a lifecycle setup risk, but inspected source does not establish a concrete malicious attack.
Mechanism
The installer uses the consuming workspace as its target, copies package-owned agent and command files, and installs the example OpenCode configuration when that configuration is absent. The example enables MCP commands launched with npx.
AI rationale
The postinstall hook automatically installs first-party OpenCode extensions and may enable local MCP commands through an example configuration. This meets the warning category for package-owned agent extension setup, but the inspected code does not support a malicious verdict.
Evidence
package.jsonscripts/install.jsopencode.tera.example.jsonagents/commands/.opencode/opencode.json
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json runs scripts/install.js automatically during postinstall.
- The installer targets npm's INIT_CWD when available, so it can write into the consuming workspace.
- The installer copies this package's agent and command files into the workspace's .opencode directories.
- It installs the example OpenCode configuration when the workspace does not already have that configuration.
- The example configuration enables local MCP commands launched through npx for @playwright/mcp and mcp-server-semgrep.
- For differing destination files, the installer overwrites only files recorded as package-owned.
Evidence against
- The behavior is first-party extension setup; the shipped primary agent requires approval for shell access.
- The installer preserves differing files that it does not record as package-owned.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemShell
HighEntropyStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/install.jsView file
10* - Never overwrites a file it does not own.
L11: * - Tracks ownership via `.opencode/tera-core.manifest.json`.
L12: * - Only updates files it owns, always keeping a backup first.
L13: * - Idempotent: re-running is safe; identical files are skipped.
L14: * - Never touches an existing user `opencode.json`.
L15: *
...
L65: function copyFile(src, dest) {
L66: fs.mkdirSync(path.dirname(dest), { recursive: true });
L67: fs.copyFileSync(src, dest);
L68: }
...
L70: function loadOwnership(target) {
L71: const p = path.join(target, ".opencode", MANIFEST_NAME);
Findings
1 Critical3 High4 Medium5 Low
CriticalAi Agent Control Hijackscripts/install.js
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similarityscripts/build.mjs
HighPrevious Version Dangerous Deltascripts/build.mjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumShips Build Helpertools/tera-fetch.ps1
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @tera-system/core@0.2.2.
See all versions of @tera-system/core for other recorded verdicts.
- Review the evidence and your use of @tera-system/core@0.2.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.