registry / litopencode / 0.1.47

litopencode@0.1.47

LitOpenCode OpenCode plugin bootstrap package.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Explicit installation registers LitOpenCode as an OpenCode plugin and provisions package-managed configuration, commands, and skills. No npm install-time execution is present.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `litopencode install` or `npx litopencode install`.

Impact

Changes the selected OpenCode root and invokes the local `opencode` CLI globally; this is a package-owned extension lifecycle action.

Mechanism

Explicit OpenCode extension registration and managed-skill provisioning.

Rationale

The package is not malicious by source evidence, but it has an explicit agent-extension installer that mutates an AI-agent control surface. Per policy, this warrants a non-blocking warning rather than a publish block.

Evidence

package.jsonbin/litopencode.cjsdist/cli/install.jsdist/cli/install-config.jsdist/cli/plugin-mutation.jsdist/cli/native-skill-install.jsdist/public-source-fetch.js<OpenCode root>/opencode.json[c]<OpenCode root>/litopencode.json<OpenCode root>/command<OpenCode root>/skills

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`dist/cli/install.js` runs `opencode plugin <litopencode@version> --global --force` after an explicit install command.
`dist/cli/install.js` writes OpenCode plugin config, LitOpenCode config, command aliases, and native skills.
`dist/cli/native-skill-install.js` provisions managed skill directories into the selected OpenCode root.

Evidence against

`package.json` has no `preinstall`, `install`, or `postinstall` lifecycle hook.
`bin/litopencode.cjs` only imports the CLI when the user invokes the binary.
Plugin mutation preserves non-LitOpenCode entries and only replaces/removes LitOpenCode entries.
Managed-skill installation validates sources and preserves unmanaged skill collisions.
`fetch-public` is an explicit user command with URL and private-network guards; no package-owned endpoint was found.
No credential harvesting, secret exfiltration, eval/vm execution, or hidden binary payload was found in inspected runtime files.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

Source & flagged code

3 flagged

skills/lit-scientific-visualization/original/tests/test_figure_export.pyView file

•path = skills/lit-scientific-visualization/original/tests/test_figure_export.py kind = payload_in_excluded_dir sizeBytes = 1742 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/lit-scientific-visualization/original/tests/test_figure_export.pyView on unpkg

•path = skills/lit-scientific-visualization/original/tests/test_figure_export.py kind = build_helper sizeBytes = 1742 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/lit-scientific-visualization/original/tests/test_figure_export.pyView on unpkg

dist/cli/install.jsView file

Source & flagged code

3 flagged · loading source

skills/lit-scientific-visualization/original/tests/test_figure_export.pyView file

•path = skills/lit-scientific-visualization/original/tests/test_figure_export.py kind = payload_in_excluded_dir sizeBytes = 1742 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/lit-scientific-visualization/original/tests/test_figure_export.pyView on unpkg

•path = skills/lit-scientific-visualization/original/tests/test_figure_export.py kind = build_helper sizeBytes = 1742 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/lit-scientific-visualization/original/tests/test_figure_export.pyView on unpkg

dist/cli/install.jsView file

Findings

2 High4 Medium5 Low

HighPayload In Excluded Dirskills/lit-scientific-visualization/original/tests/test_figure_export.py

HighPrevious Version Dangerous Deltadist/cli/install.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperskills/lit-scientific-visualization/original/tests/test_figure_export.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LPM CLI

UrlStrings

Manifest

NoLicense

scanned 54 file(s), 315 KB of source, external domains: example.com, litopencode.dev, opencode.ai

•matchType = previous_version_dangerous_delta matchedPackage = litopencode@0.1.45 matchedIdentity = npm:bGl0b3BlbmNvZGU:0.1.45 similarity = 0.739 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/install.jsView on unpkg

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellHighEntropyStringsUrlStringsNoLicense

Source & flagged code

3 flagged

skills/lit-scientific-visualization/original/tests/test_figure_export.pyView file

•path = skills/lit-scientific-visualization/original/tests/test_figure_export.py kind = payload_in_excluded_dir sizeBytes = 1742 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/lit-scientific-visualization/original/tests/test_figure_export.pyView on unpkg

•path = skills/lit-scientific-visualization/original/tests/test_figure_export.py kind = build_helper sizeBytes = 1742 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/lit-scientific-visualization/original/tests/test_figure_export.pyView on unpkg

dist/cli/install.jsView file

•

matchType = previous_version_dangerous_delta matchedPackage = litopencode@0.1.45 matchedIdentity = npm:bGl0b3BlbmNvZGU:0.1.45 similarity = 0.739 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/install.jsView on unpkg