registry / @thelioo/opencode-balancer / 0.2.10

@thelioo/opencode-balancer@0.2.10

Account balancer plugin for opencode.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User follows INSTALL.txt or enables the opencode plugin; runtime hooks activate during opencode chat/TUI use.

Impact

Can alter opencode plugin configuration when installed by an agent and can locally store/switch provider credentials for chat requests.

Mechanism

Explicit opencode plugin setup plus credential-balancing fetch hook

Rationale

This is not malicious by source inspection, but it is an explicit user-command AI-agent configuration mutation for an agent/plugin control surface and should be warned rather than silently allowed. No publish block is warranted because behavior is disclosed, package-aligned, and lacks concrete malicious execution or exfiltration.

Evidence

package.jsonREADME.mdINSTALL.txtdist/index.jsdist/tui/tui.js~/.config/opencode/opencode.jsonc~/.config/opencode/opencode.json~/.config/opencode/tui.jsonc~/.config/opencode/tui.json~/.config/opencode/balancer.sqlite~/.local/share/opencode/auth.json

Network endpoints6

registry.npmjs.org/-/package/api.github.com/copilot_internal/userapi.github.com/userapi.github.com/orgs/chatgpt.com/backend-api/wham/usageapi.openai.com/v1/organization/usage/completions

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

INSTALL.txt explicitly instructs agents to edit ~/.config/opencode/opencode.json[c] and tui.json[c] plugin arrays
dist/index.js registers opencode plugin hooks and monkey-patches globalThis.fetch for tagged chat requests
dist/index.js stores provider auth_json in balancer.sqlite and injects saved credentials into provider request headers
dist/tui/tui.js reads opencode auth.json or OPENCODE_AUTH_CONTENT and saves detected provider credentials

Evidence against

package.json has no preinstall/install/postinstall; prepare is husky and prepublishOnly builds only
README.md discloses local credential store and opencode plugin behavior
network calls are package-aligned usage/version checks to registry.npmjs.org, api.github.com, chatgpt.com, and api.openai.com
dist/index.js cache removal is constrained to opencode packages cache and matching package/version
TUI usage snapshots redact known credential fields before storage
No evidence of credential exfiltration to attacker-controlled endpoints, shell execution, eval, persistence, or destructive behavior

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 166 KB of source, external domains: api.github.com, api.openai.com, chatgpt.com, github.com, registry.npmjs.org

Source & flagged code

1 flagged

dist/index.jsView file

Lines 147-171javascript

147 );

148 `);let i=t.query("INSERT OR REPLACE INTO settings_new (key, value) VALUES (?, ?)");for(let e of n){if(typeof e.key!=="string"||typeof e.value!=="string")continue;i.run(e.key,e.value)}t.exec(`

149 DROP TABLE IF EXISTS settings;

150 ALTER TABLE settings_new RENAME TO settings;

151 `)}function Q(t){t.exec(`

152 CREATE TABLE IF NOT EXISTS schema_migrations (

153 version INTEGER PRIMARY KEY,

154 applied_at INTEGER NOT NULL

155 );

156 `),t.transaction(()=>{if(Wt(t),Bt(t),bt(t),zt(t),Jt(t),Gt(t),Vt(t),!Ht(t,1))t.query("INSERT INTO schema_migrations (version, applied_at) VALUES (?, ?)").run(1,Date.now())})()}import{existsSync as Yt,readFileSync as Xt,rmSync as Kt}from"fs";import{homedir as q}from"os";import{dirname as D,join as _,sep as A}from"path";import{fileURLToPath as Qt}from"url";function Zt(){if(process.env.XDG_CACHE_HOME)return _(process.env.XDG_CACHE_HOME,"opencode");if(process.platform==="darwin")return _(q(),"Library","Caches","opencode");if(process.platform==="win32")return _(process.env.LOCALAPPDATA??_(q(),"A ...

157 FROM pending_connections

158 ORDER BY captured_at DESC, id DESC`).all().map(mn)}function yn(t){return t.match(/(?:[^\s"]+|"[^"]*")+/g)?.map((n)=>n.replace(/^"|"$/g,""))

159`);if(i==="list"){let r=g(t);if(r.length===0)return"No accounts saved.";return r.map((o)=>`${o.providerID}/${o.alias}`).join(`

160`)}if(i==="status")return`accounts=${g(t).length} pending=${nt(t).length}`;if(i==="use"){let[r,o]=e;if(!r||!o)return"Usage: /balancer use <provider> <alias>";try{let a=E(t,r,o);return`Active account changed to ${

161 ON CONFLICT(key) DO UPDATE SET value = excluded.value`).run(hn(n),String(c()+i))}var L="native_connect_until";function pe(t,n=180000){t.query(`INSERT INTO settings (key, value) VALUES ('native_connect_until', ?)

162 ON CONFLICT(key) DO UPDATE SET value = excluded.value`).run(String(c()+n))}function rt(t){let n=t.query("SELECT value FROM settings WHERE key = ?").get(L),i=Number(n?.value??0);if(Number.isFinite(i)&&i>c())return!0;if(n)t.query

163 SET failures = failures + 1,

164 rate_limited_until = ?,

165 updated_at = ?

166 WHERE provider_id = ? AND alias = ?`).run(o+e,o,n,r.alias)}function dt(t,n,i){let e=c(),r=f(i);return g(t,n).find((o)=>{if(o.alias===r)return!1;if(o.disabled)return!1;return!o.rateLimitedUntil||o.rateLimitedUntil<=e})}var pt=!1;function En(t){return Array.from(t.entries()).map(([n,i])=>[n.toLowerCase(),i])}function An(t,n,i={}){let e=n.auth,r=En(t);if(e.type==="oauth"){if(i.preserveExistingOAuth&&t.has("authorization"))return;t.set("authorization",`Bearer ${e.access}`);return}if(e.type==="wellknown"){if(t.has("authorization"))t.set("authorization",`Bearer ${e.token}`);else t.set(e.key ...

167`)[0]??o,"info"),Error(`[balancer]

168${o}`)},config:async(e)=>{xn(e)},"experimental.chat.messages.transform":async(e,r)=>{r.messages=r.messages.filter((o)=>{return!o.parts.some((a)=>{return a?.metadata?.[ot]===!0})})},tool:{balancer_command:gt({args:{command:gt.schema.string().describe

169

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L167

170//# debugId=ACD871405212C09064756E2164756E21

171

Long lines were clipped for display.

Source & flagged code

1 flagged · loading source

dist/index.jsView file

167`)[0]??o,"info"),Error(`[balancer] L168: ${o}`)},config:async(e)=>{xn(e)},"experimental.chat.messages.transform":async(e,r)=>{r.messages=r.messages.filter((o)=>{return!o.parts.some((a)=>{return a?.metadata?.[ot]===!0})})}... L169:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L167

Findings

3 Medium4 Low

MediumDynamic Requiredist/index.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/index.jsView file

Lines 147-171javascript

147 );

148 `);let i=t.query("INSERT OR REPLACE INTO settings_new (key, value) VALUES (?, ?)");for(let e of n){if(typeof e.key!=="string"||typeof e.value!=="string")continue;i.run(e.key,e.value)}t.exec(`

149 DROP TABLE IF EXISTS settings;

150 ALTER TABLE settings_new RENAME TO settings;

151 `)}function Q(t){t.exec(`

152 CREATE TABLE IF NOT EXISTS schema_migrations (

153 version INTEGER PRIMARY KEY,

154 applied_at INTEGER NOT NULL

155 );

157 FROM pending_connections

158 ORDER BY captured_at DESC, id DESC`).all().map(mn)}function yn(t){return t.match(/(?:[^\s"]+|"[^"]*")+/g)?.map((n)=>n.replace(/^"|"$/g,""))

159`);if(i==="list"){let r=g(t);if(r.length===0)return"No accounts saved.";return r.map((o)=>`${o.providerID}/${o.alias}`).join(`

163 SET failures = failures + 1,

164 rate_limited_until = ?,

165 updated_at = ?

167`)[0]??o,"info"),Error(`[balancer]

169

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L167

170//# debugId=ACD871405212C09064756E2164756E21

171

Long lines were clipped for display.