Loading npm security reports…

@tera-system/pro@0.2.30: AI-agent control-surface risk | LPM Firewall

registry / @tera-system/pro / 0.2.30

@tera-system/pro@0.2.30

Tera System Pro â€” commercial edition (thin): system files are fetched from teranoo.com as a signed bundle; enforced license gate + heartbeat

AI Security Review

scanned 5d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Automatic installation creates a foreign AI-agent configuration with enabled MCP servers. Remote bundle application can also overwrite agent instructions, commands, and workspace files.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall runs scripts/install.js, targeting INIT_CWD by default.

Impact

Installation changes subsequent agent capabilities and instructions without a separate user setup command, and can replace existing workspace content.

Mechanism

The installer copies an enabled OpenCode configuration and automatically applies downloaded bundle files through a writer with broad destinations and no ownership checks.

Policy narrative

Installing the package automatically targets the consumer workspace, creates OpenCode configuration with enabled third-party MCP servers, and fetches a remote bundle. The bundle writer places content into agent and command directories and allows workspace-wide assets without checking existing file ownership. Signature verification limits who supplies the bundle but does not establish consent for these broad agent-control changes.

AI rationale

Source confirms unconsented postinstall mutation of a foreign, broad AI-agent control surface, meeting the blocking policy. Preserving existing configuration and verifying bundle signatures do not remove the automatic enabled-server setup or broad overwrite behavior.

Evidence

package.jsonscripts/install.jsopencode.tera.example.jsonscripts/lib/bundle.mjs.opencode/opencode.json

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/install.jsView file

10* - Never overwrites a file it does not own. L11: * - Tracks ownership via `.opencode/tera.manifest.json`. L12: * - Only updates files it owns, always keeping a backup first. L13: * - Idempotent: re-running is safe; identical files are skipped. L14: * - Never touches an existing user `opencode.json`. L15: * ... L75: function copyFile(src, dest) { L76: fs.mkdirSync(path.dirname(dest), { recursive: true }); L77: fs.copyFileSync(src, dest); L78: } ... L80: function loadOwnership(target) { L81: const p = path.join(target, ".opencode", MANIFEST_NAME);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install.jsView on unpkg · L10

scripts/build.mjsView file

•matchType = normalized_sha256 matchedPackage = @tera-system/pro@0.2.27 matchedPath = scripts/build.mjs matchedIdentity = npm:QHRlcmEtc3lzdGVtL3Bybw:0.2.27 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/build.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = a5ff247054fe373d signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @tera-system/pro@0.2.27 matchedPath = scripts/build.mjs matchedIdentity = npm:QHRlcmEtc3lzdGVtL3Bybw:0.2.27 similarity = 1.000 shingleOverlap = 12 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/build.mjsView on unpkg

Source & flagged code

5 flagged

package.jsonView file

Lines 9-49json

9 },

10 "files": [

11 "scripts",

12 "core/project-control",

13 "MANIFEST.json",

14 "opencode.tera.example.json",

15 "WELCOME.md",

16 "README.md",

17 "LICENSE.md",

18 "RELEASES.md"

19 ],

20 "bin": {

21 "tera-restore": "scripts/install.js",

22 "tera-pro-restore": "scripts/install.js",

23 "tera-license": "scripts/tera-license.mjs",

24 "tera-sync": "scripts/tera-sync.mjs",

25 "tera-heartbeat": "scripts/tera-heartbeat.mjs",

26 "tera-preflight": "scripts/preflight.mjs"

27 },

28 "scripts": {

29 "postinstall": "node scripts/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L29

30 "tera-license": "node scripts/tera-license.mjs",

31 "tera-preflight": "node scripts/preflight.mjs",

32 "tera-sync": "node scripts/tera-sync.mjs",

33 "tera-heartbeat": "node scripts/tera-heartbeat.mjs",

34 "tera-bundle": "node scripts/build-bundle.mjs"

35 },

36 "keywords": [

37 "opencode",

38 "plugin",

39 "tera",

40 "governance",

41 "agents",

42 "commercial",

43 "license"

44 ],

45 "publishConfig": {

46 "access": "public"

47 }

48}

49

scripts/install.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2/**

3 * @tera/core installer

4 * --------------------------------------------------------------

5 * NON-DESTRUCTIVE + OWNERSHIP-AWARE installer for the Tera System

6 * OpenCode Plugin component.

7 *

8 * Rules:

9 * - Never deletes anything.

10 * - Never overwrites a file it does not own.

11 * - Tracks ownership via `.opencode/tera.manifest.json`.

scripts/build.mjsView file

•matchType = normalized_sha256 matchedPackage = @tera-system/pro@0.2.27 matchedPath = scripts/build.mjs matchedIdentity = npm:QHRlcmEtc3lzdGVtL3Bybw:0.2.27 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/build.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = a5ff247054fe373d signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @tera-system/pro@0.2.27 matchedPath = scripts/build.mjs matchedIdentity = npm:QHRlcmEtc3lzdGVtL3Bybw:0.2.27 similarity = 1.000 shingleOverlap = 12 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/build.mjsView on unpkg