Loading npm security reports…

@tera-system/pro@0.2.26: AI-agent control-surface risk | LPM Firewall

registry / @tera-system/pro / 0.2.26

@tera-system/pro@0.2.26

Tera System Pro â€” commercial edition (thin): system files are fetched from teranoo.com as a signed bundle; enforced license gate + heartbeat

AI Security Review

scanned 20d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall runs an installer that mutates the consumer OpenCode control surface and then fetches a remote signed bundle into the same agent and command directories. That is unconsented install-time hijack of a foreign agent runtime, with network-served files as the thin-package payload.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install of @tera-system/pro, which runs the postinstall script node scripts/install.js

Impact

OpenCode in the consumer project can load package- and server-supplied agents, commands, and MCP config without a separate user setup command

Mechanism

unconsented postinstall write of OpenCode agents, commands, and config, plus remote bundle apply

Policy narrative

On npm install, postinstall runs scripts/install.js against the consumer workspace. It seeds OpenCode agent and command directories and, if missing, writes .opencode/opencode.json from a bundled MCP template. In thin mode it then fetches a signed bundle from teranoo.com and applyBundle writes those files into .opencode/agents and .opencode/commands without the ownership checks used for local copies. That is unconsented install-time mutation of a foreign OpenCode control surface, with a remote payload as the content source.

AI rationale

The postinstall hook mutates a foreign OpenCode control surface in the consumer project and then applies a remotely fetched bundle into the same agent and command paths. That matches unconsented install-time AI-agent control hijack and is not saved by README text or local ownership checks.

Evidence

package.jsonscripts/install.jsscripts/lib/bundle.mjs

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/install.jsView file

10* - Never overwrites a file it does not own. L11: * - Tracks ownership via `.opencode/tera.manifest.json`. L12: * - Only updates files it owns, always keeping a backup first. L13: * - Idempotent: re-running is safe; identical files are skipped. L14: * - Never touches an existing user `opencode.json`. L15: * ... L75: function copyFile(src, dest) { L76: fs.mkdirSync(path.dirname(dest), { recursive: true }); L77: fs.copyFileSync(src, dest); L78: } ... L80: function loadOwnership(target) { L81: const p = path.join(target, ".opencode", MANIFEST_NAME);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install.jsView on unpkg · L10

scripts/build.mjsView file

•matchType = normalized_sha256 matchedPackage = @tera-system/pro@0.2.1 matchedPath = scripts/build.mjs matchedIdentity = npm:QHRlcmEtc3lzdGVtL3Bybw:0.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/build.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = a5ff247054fe373d signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @tera-system/pro@0.2.25 matchedPath = scripts/build.mjs matchedIdentity = npm:QHRlcmEtc3lzdGVtL3Bybw:0.2.25 similarity = 1.000 shingleOverlap = 12 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/build.mjsView on unpkg

Source & flagged code

5 flagged

package.jsonView file

Lines 9-49json

9 },

10 "files": [

11 "scripts",

12 "core/project-control",

13 "MANIFEST.json",

14 "opencode.tera.example.json",

15 "WELCOME.md",

16 "README.md",

17 "LICENSE.md",

18 "RELEASES.md"

19 ],

20 "bin": {

21 "tera-restore": "scripts/install.js",

22 "tera-pro-restore": "scripts/install.js",

23 "tera-license": "scripts/tera-license.mjs",

24 "tera-sync": "scripts/tera-sync.mjs",

25 "tera-heartbeat": "scripts/tera-heartbeat.mjs",

26 "tera-preflight": "scripts/preflight.mjs"

27 },

28 "scripts": {

29 "postinstall": "node scripts/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L29

30 "tera-license": "node scripts/tera-license.mjs",

31 "tera-preflight": "node scripts/preflight.mjs",

32 "tera-sync": "node scripts/tera-sync.mjs",

33 "tera-heartbeat": "node scripts/tera-heartbeat.mjs",

34 "tera-bundle": "node scripts/build-bundle.mjs"

35 },

36 "keywords": [

37 "opencode",

38 "plugin",

39 "tera",

40 "governance",

41 "agents",

42 "commercial",

43 "license"

44 ],

45 "publishConfig": {

46 "access": "public"

47 }

48}

49

scripts/install.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2/**

3 * @tera/core installer

4 * --------------------------------------------------------------

5 * NON-DESTRUCTIVE + OWNERSHIP-AWARE installer for the Tera System

6 * OpenCode Plugin component.

7 *

8 * Rules:

9 * - Never deletes anything.

10 * - Never overwrites a file it does not own.

11 * - Tracks ownership via `.opencode/tera.manifest.json`.

scripts/build.mjsView file

•matchType = normalized_sha256 matchedPackage = @tera-system/pro@0.2.1 matchedPath = scripts/build.mjs matchedIdentity = npm:QHRlcmEtc3lzdGVtL3Bybw:0.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/build.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = a5ff247054fe373d signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @tera-system/pro@0.2.25 matchedPath = scripts/build.mjs matchedIdentity = npm:QHRlcmEtc3lzdGVtL3Bybw:0.2.25 similarity = 1.000 shingleOverlap = 12 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/build.mjsView on unpkg