hiskra-code@2.0.2

High-risk behavior combination matched malicious policy.

npm install hiskra-code postinstall, or requiring/using exported index.cjs functions in a project without .opencode

Future opencode sessions may follow package-supplied primary agent, permissions, and workflow instructions in the target project.

unconsented AI-agent configuration and instruction drop

Installing the package runs postinstall.js, which locates the consumer project, creates .opencode/agents and .opencode/skills, copies package-supplied markdown instructions, and creates opencode.json pointing opencode at .opencode/config.md with default_agent set to orquestrador. The CommonJS entry also auto-initializes the same control files when exported functions are used.

Although the contents look like a legitimate opencode agent bundle and no exfiltration/destructive code was found, installing npm packages must not silently install or activate AI-agent control instructions in the consuming project. The concrete lifecycle and import-time mutation of .opencode/opencode.json is sufficient to block as AI-agent control-surface hijack. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.