registry / @twing/cli / 0.2.30
@twing/cli@0.2.30
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe postinstall path is limited to global installs or an explicit machine-setup flag, but it configures this package’s agent integrations for machine-wide use. This is a guarded first-party integration lifecycle risk, so warn rather than block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Installing the package globally with npm, or passing the machine-setup flag to its postinstall script.
Impact
Agent sessions may load this package’s integrations across directories on the user’s machine; the inspected source does not show credential theft or other concrete attack behavior.
Mechanism
The script loads machine setup, which wires a Claude Code resolver, installs the package’s OpenCode plugin, and records an auto-managed marker.
AI rationale
The postinstall path is limited to global installs or an explicit machine-setup flag, but it configures this package’s agent integrations for machine-wide use. This is a guarded first-party integration lifecycle risk, so warn rather than block.
Evidence
package.jsonpostinstall.cjsdist/machine-setup.jsdist/enforce-hooks.jsdist/init.jsdist/resolve-hook.jsdist/opencode-plugin.js
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package runs a postinstall script that starts machine setup only for global installs or when explicitly passed the machine-setup flag.
- Machine setup writes Claude Code resolver wiring and installs the package’s OpenCode plugin, creating persistent user-level agent integrations.
- The OpenCode setup preserves an unrelated existing plugin file and leaves it untouched.
Evidence against
- The lifecycle exits for ordinary project dependency installs; its machine-wide setup is gated to global installs or an explicit flag.
- The inspected setup integrates this package’s own agent tooling and does not establish exfiltration, destructive behavior, or permission bypass.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/opencode-adapter.jsView file
12*/
L13: import { spawn } from "node:child_process";
L14: import * as fs from "node:fs";
High
Child Process
Package source references child process execution.
dist/opencode-adapter.jsView on unpkg · L12Findings
1 Critical6 High4 Medium4 Low
CriticalAi Agent Control Hijackdist/machine-setup.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/opencode-adapter.js
HighShell
HighSame File Env Network Executiondist/test-support.js
HighSemantic Analysis Limiteddist/design.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/opencode-adapter.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Low
Affected versions and remediation
This report applies to @twing/cli@0.2.30.
See all versions of @twing/cli for other recorded verdicts.
- Review the evidence and your use of @twing/cli@0.2.30 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.