hiskra-code@2.0.1

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

npm install lifecycle postinstall

Future opencode sessions in the project can load package-supplied instructions and a primary agent with edit/bash permissions.

unconsented install-time AI-agent control-surface mutation

Installing the package runs postinstall.js. That script locates the containing project, creates .opencode directories, copies package-controlled agents, skills, and config.md, and creates opencode.json pointing opencode at those instructions with default_agent set to orquestrador. The installed orquestrador agent is primary and permits edit and bash, so the package persistently changes an AI-agent control surface without an explicit user CLI action.

Static inspection confirms install-time writes of package-supplied opencode agent/control files into the consumer project, including default agent configuration. The absence of exfiltration or shell execution narrows impact, but the lifecycle control-surface mutation is concrete and unconsented. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.