registry / jpcode-cli / 1.18.37

jpcode-cli@1.18.37

DEPRECATED: este paquete se movio. Instala @soyjuanpiece/jpcode (npm i -g @soyjuanpiece/jpcode) - mismo comando jpcode, motor opencode actualizado

AI Security Review

scanned 10d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation automatically modifies the global OpenCode agent and command configuration. One bundled agent enables unrestricted autonomous actions.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation runs the postinstall lifecycle script.

Impact

A package install can add a broadly privileged AI-agent mode to a foreign global control surface without an explicit setup command.

Mechanism

The script creates missing global configuration paths and copies bundled agent and command files there; the copied auto agent allows every permission.

Policy narrative

The package invokes a postinstall script automatically. That script populates the user's global OpenCode configuration with bundled agents and commands when files are absent. Its auto agent is configured to allow all permissions, including edits, shell activity, and external directories. This is an unconsented install-time modification of a broad AI-agent control surface.

AI rationale

The automatic lifecycle hook writes an unrestricted agent configuration outside the package into a global AI-agent configuration directory. Existing-file preservation and an opt-out do not establish consent for this default mutation.

Evidence

package.jsonpostinstall.mjsdefaults/agent/auto.md

Decision evidence

public snapshot

AI identified this as a at 96.0% confidence with false-positive risk.

jpcode-cli@1.18.37

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code