@tera-system/pro@0.2.20

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

npm installation, through the postinstall lifecycle hook.

It can add enabled agent tooling and package-managed files to the consumer workspace without an explicit setup command.

Automatic OpenCode control-surface creation and remote bundle application.

The postinstall hook runs against INIT_CWD, the consumer project. It creates .opencode/opencode.json if absent and populates it with enabled MCP entries that execute npx -y commands. In the same automatic lifecycle it fetches a remote signed bundle and applies its files to OpenCode agent and command directories and other workspace paths. Although it avoids replacing an existing configuration and verifies bundle signatures, the vendor controls the signer and the install still creates a foreign AI-agent control surface without an explicit user setup action.

This is a concrete unconsented postinstall mutation of a consumer OpenCode control surface, coupled with remote vendor-controlled content application. Signature verification does not remove the supply-chain control exercised by the package publisher.