akm-opencode
OpenCode plugin for AKM with discovery tools, feedback, memory, and automatic learning proposals from corrections and recurring workflows.
This report shows the evidence for akm-opencode@0.10.261017. 1 of 30 known versions is blocked or flagged. The newest version, 0.10.261020, is allowed. See all versions.
AI Security Review
scanned 6d ago · by lpm-firewall-aiBy default, session-idle hooks send session-derived prompts through the user’s configured OpenCode model runner, potentially spending their provider tokens without a per-run request. The feature is disclosed and can be disabled, but an opt-out default does not satisfy the automatic-spending rule.
Static reason
No blocking static signals were detected.
Trigger
OpenCode emits `session.idle`; extraction is enabled by default and runs at most once per configured interval for each session.
Impact
When the configured provider charges for model use, session content is processed and tokens may be spent without a per-extraction user request; extracted insights are queued as proposals.
Mechanism
The plugin invokes `akm proposal extract` for the session. AKM builds a prompt from session events and runs model work through `opencode run`, using the user’s OpenCode configuration and login.
Attack narrative
On idle events, the plugin automatically starts AKM session extraction unless disabled. AKM builds a prompt from session data and runs model work through the user’s configured OpenCode account. This can consume paid provider tokens without a per-run request; the resulting insights are queued as proposals. The README discloses the feature and opt-out, but the review rules treat an opt-out default as insufficient consent for automatic spending.
AI rationale
By default, session-idle hooks send session-derived prompts through the user’s configured OpenCode model runner, potentially spending their provider tokens without a per-run request. The feature is disclosed and can be disabled, but an opt-out default does not satisfy the automatic-spending rule.
Evidence
dist/index.jsREADME.md.lpm-dependency-evidence-b09dd154-1865-4948-9cb6-94e5a4c6d2c8/1/npm-linux/dist/commands/improve/extract.js.lpm-dependency-evidence-b09dd154-1865-4948-9cb6-94e5a4c6d2c8/1/npm-linux/dist/commands/improve/extract-cli.js.lpm-dependency-evidence-b09dd154-1865-4948-9cb6-94e5a4c6d2c8/1/npm-linux/dist/integrations/harnesses/opencode/agent-builder.js
Decision evidence
public snapshotAI called this Malicious at 87.0% confidence as Malware with low false-positive risk.
Evidence for block
- Automatic memory extraction is enabled unless `AKM_AUTO_MEMORY=0`; the plugin triggers it on `session.idle`.
- The extraction command reads session events, builds a prompt, and invokes session extraction to queue proposals.
- AKM’s OpenCode model runner calls `opencode run` using the user’s OpenCode configuration and login, so extraction can consume the configured provider’s tokens.
- The README says idle events fire after every turn and describes the extraction opt-out.
Evidence against
- The feature is part of the package’s stated automatic learning and memory workflow.
- The README documents the behavior and provides an opt-out.
- The package manifest has no install lifecycle hook; its scripts are for building and typechecking.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem
HighEntropyStrings
Source & flagged code
7 flaggeddist/index.jsView file
464function autoMemoryEnabled() {
return (process.env.AKM_AUTO_MEMORY ?? "1") !== "0";
}
function unrefChildStream(stream) {
const handle = stream;
if (handle && typeof handle.unref === "function")
handle
High
Ai Review Evidence
Automatic memory extraction is enabled unless `AKM_AUTO_MEMORY=0`; the plugin triggers it on `session.idle`.
dist/index.jsView on unpkg · L4643521await maybeIndexSessionMemory(logClient, sid, type, "");
}
if (type === "session.idle") {
maybeExtractSessionOnIdle(logClient, sid, directory);
High
Ai Review Evidence
Automatic memory extraction is enabled unless `AKM_AUTO_MEMORY=0`; the plugin triggers it on `session.idle`.
dist/index.jsView on unpkg · L352129try {
L30: const manifestPath = createRequire(moduleUrl).resolve("akm-cli/package.json");
L31: const bin = JSON.parse(readFileSync(manifestPath, "utf8")).bin;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/index.jsView on unpkg · L29Findings
6 High2 Medium4 Low
HighAi Review Evidencedist/index.js
HighAi Review Evidencedist/index.js
HighAi Review Evidence.lpm-dependency-evidence-b09dd154-1865-4948-9cb6-94e5a4c6d2c8/1/npm-linux/dist/commands/improve/extract.js
HighAi Review Evidence.lpm-dependency-evidence-b09dd154-1865-4948-9cb6-94e5a4c6d2c8/1/npm-linux/dist/commands/improve/extract-cli.js
HighAi Review Evidence.lpm-dependency-evidence-b09dd154-1865-4948-9cb6-94e5a4c6d2c8/1/npm-linux/dist/integrations/harnesses/opencode/agent-builder.js
HighAi Review Evidence.lpm-dependency-evidence-b09dd154-1865-4948-9cb6-94e5a4c6d2c8/1/npm-linux/dist/integrations/harnesses/opencode/agent-builder.js
MediumDynamic Requiredist/index.js
MediumEnvironment Vars
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to akm-opencode@0.10.261017.
The versions list below shows the verdict for each recorded version.
- Avoid installing akm-opencode@0.10.261017. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.