Loading npm security reports…

@tera-system/pro@0.2.15: AI-agent control-surface risk | LPM Firewall

registry / @tera-system/pro / 0.2.15

@tera-system/pro@0.2.15

Tera System Pro — commercial edition (thin): system files are fetched from teranoo.com as a signed bundle; enforced license gate + heartbeat

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Npm postinstall changes the consumer project's OpenCode control surface and retrieves a remote payload. The payload writer permits server-supplied assets throughout the project root.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Installing the package with npm runs postinstall.

Impact

A publisher-controlled server can deliver files into the project and enable AI-agent MCP commands without an explicit setup command.

Mechanism

Postinstall remote bundle deployment and OpenCode MCP configuration.

Policy narrative

On npm installation, postinstall runs scripts/install.js. It creates .opencode/opencode.json when absent, enabling MCP tools that invoke npx, then downloads a publisher-signed bundle from teranoo.com. The bundle application maps its assets group to the project root and writes supplied files there. Signature verification does not constrain a malicious publisher's signed payload. This is unconsented install-time mutation of an AI-agent control surface combined with remote project modification.

Rationale

The automatic installer both provisions OpenCode MCP configuration and applies remotely delivered content into the consumer project. This is a concrete unconsented postinstall AI-agent control-surface attack path.

Evidence

package.jsonscripts/install.jsscripts/lib/bundle.mjsopencode.tera.example.json.opencode/opencode.json.opencode/agents/.opencode/commands/

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/install.jsView file

10* - Never overwrites a file it does not own. L11: * - Tracks ownership via `.opencode/tera.manifest.json`. L12: * - Only updates files it owns, always keeping a backup first. L13: * - Idempotent: re-running is safe; identical files are skipped. L14: * - Never touches an existing user `opencode.json`. L15: * ... L75: function copyFile(src, dest) { L76: fs.mkdirSync(path.dirname(dest), { recursive: true }); L77: fs.copyFileSync(src, dest); L78: } ... L80: function loadOwnership(target) { L81: const p = path.join(target, ".opencode", MANIFEST_NAME);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install.jsView on unpkg · L10

scripts/build.mjsView file

•matchType = normalized_sha256 matchedPackage = @tera-system/pro@0.2.14 matchedPath = scripts/build.mjs matchedIdentity = npm:QHRlcmEtc3lzdGVtL3Bybw:0.2.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/build.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = a5ff247054fe373d signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @tera-system/pro@0.2.14 matchedPath = scripts/build.mjs matchedIdentity = npm:QHRlcmEtc3lzdGVtL3Bybw:0.2.14 similarity = 1.000 shingleOverlap = 12 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/build.mjsView on unpkg

Source & flagged code

5 flagged

package.jsonView file

Lines 9-48json

9 },

10 "files": [

11 "scripts",

12 "core/project-control",

13 "MANIFEST.json",

14 "opencode.tera.example.json",

15 "WELCOME.md",

16 "README.md",

17 "LICENSE.md",

18 "RELEASES.md"

19 ],

20 "bin": {

21 "tera-restore": "scripts/install.js",

22 "tera-pro-restore": "scripts/install.js",

23 "tera-license": "scripts/tera-license.mjs",

24 "tera-sync": "scripts/tera-sync.mjs",

25 "tera-heartbeat": "scripts/tera-heartbeat.mjs",

26 "tera-preflight": "scripts/preflight.mjs"

27 },

28 "scripts": {

29 "postinstall": "node scripts/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L29

30 "tera-license": "node scripts/tera-license.mjs",

31 "tera-preflight": "node scripts/preflight.mjs",

32 "tera-sync": "node scripts/tera-sync.mjs",

33 "tera-heartbeat": "node scripts/tera-heartbeat.mjs",

34 "tera-bundle": "node scripts/build-bundle.mjs"

35 },

36 "keywords": [

37 "opencode",

38 "plugin",

39 "tera",

40 "governance",

41 "agents",

42 "commercial",

43 "license"

44 ],

45 "publishConfig": {

46 "access": "public"

47 }

48}

scripts/install.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2/**

3 * @tera/core installer

4 * --------------------------------------------------------------

5 * NON-DESTRUCTIVE + OWNERSHIP-AWARE installer for the Tera System

6 * OpenCode Plugin component.

7 *

8 * Rules:

9 * - Never deletes anything.

10 * - Never overwrites a file it does not own.

11 * - Tracks ownership via `.opencode/tera.manifest.json`.

scripts/build.mjsView file

•matchType = normalized_sha256 matchedPackage = @tera-system/pro@0.2.14 matchedPath = scripts/build.mjs matchedIdentity = npm:QHRlcmEtc3lzdGVtL3Bybw:0.2.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/build.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = a5ff247054fe373d signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @tera-system/pro@0.2.14 matchedPath = scripts/build.mjs matchedIdentity = npm:QHRlcmEtc3lzdGVtL3Bybw:0.2.14 similarity = 1.000 shingleOverlap = 12 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/build.mjsView on unpkg