registry / AI-agent control-surface risk / makdoong2-team

makdoong2-team

내 일을 대신해주는 막둥이들. Self-contained opencode plugin for 사내 workflow: per-stage specialist agents, deterministic shell gates, primary-only enforcement, and a model fallback advisor.

This report shows the evidence for makdoong2-team@2.3.2. 2 of 12 known versions are blocked or flagged. The newest version, 3.0.4, is flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The guarded global-install condition does not establish user consent for automatic OpenCode configuration and permission changes. The lifecycle hook creates a persistent, broadly permitted plugin load path.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm global installation of the package

Impact

The package gains automatic loading and broad OpenCode directory permissions without an explicit setup command.

Mechanism

postinstall deployment that patches OpenCode configuration and cache

Policy narrative

On global npm installation, postinstall invokes the installer without asking the user to run a setup command. The installer adds the package to OpenCode's plugin list, enables its tools, grants allow access for the package and configuration trees, and seeds the OpenCode cache with a symlink to the installed release. This is an unconsented lifecycle mutation of a broad AI-agent control surface.

AI rationale

Evidence

package.jsonpostinstall.mjsscripts/install-lib.mjsopencode.jsonagents/skills/command/makdoong2-team.json~/.cache/opencode/packages/

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.

Evidence for policy risk

The package runs a postinstall hook that automatically deploys on global installation.
The lifecycle deployment registers this package as an OpenCode plugin and enables its tools in the user configuration.
The installer grants allow access to both the package tree and the whole OpenCode configuration directory.
The installer replaces cached package content with a symlink to the newly installed package.

Evidence against

The postinstall hook skips ordinary local installs and CI unless an opt-in variable is set.
No outbound network request or self-dependency is present in the inspected lifecycle path.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 29 file(s), 566 KB of source, external domains: 127.0.0.1

Source & flagged code

7 flagged

package.jsonView file

Lines 51-89json

51 "engines": {

52 "opencode": ">=1.18.0",

53 "node": ">=22.18.0",

54 "tmux": ">=3.0"

55 },

56 "peerDependencies": {

57 "@opencode-ai/plugin": "^1.18.0"

58 },

59 "devDependencies": {

60 "@opencode-ai/plugin": "1.18.15",

61 "@opencode-ai/sdk": "1.18.15",

62 "@types/node": "^22.20.1",

63 "husky": "^9.0.0",

64 "typescript": "^5.7.0"

65 },

66 "scripts": {

67 "build": "tsc -p tsconfig.build.json",

68 "typecheck": "tsc -p tsconfig.json",

69 "clean": "node -e \"import('node:fs').then(({rmSync})=>rmSync('dist',{recursive:true,force:true}))\"",

70 "prepack": "npm run clean && npm run build && npm run build:entry",

71 "postinstall": "node postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L71

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L71

72 "prepare": "husky install",

73 "test": "XDG_CONFIG_HOME=\"$(mktemp -d)\" XDG_CACHE_HOME=\"$(mktemp -d)\" npm run test:all",

74 "test:all": "npm run build && node scripts/run-tests.mts",

75 "test:install": "node test/install-lib.test.ts",

76 "test:postinstall": "node scripts/test-postinstall.mts",

77 "test:ubuntu": "bash scripts/test-ubuntu.sh",

78 "release": "bash scripts/release.sh",

79 "release:patch": "bash scripts/release.sh patch",

80 "release:minor": "bash scripts/release.sh minor",

81 "release:major": "bash scripts/release.sh major",

82 "build:entry": "tsc -p tsconfig.entry.json && node -e \"import('node:fs').then(({chmodSync})=>{chmodSync('bin/cli.js',0o755)})\""

83 },

84 "homepage": "https://github.com/y00njinuk/makdoong2-team#readme",

85 "bugs": {

86 "url": "https://github.com/y00njinuk/makdoong2-team/issues"

87 }

88}

bin/cli.tsView file

Lines 1-43typescript

1#!/usr/bin/env node

2// bin/cli.ts — makdoong2-team installer & doctor.

3//

4// 편집하지 말 것 — 다음 빌드가 덮어쓴다.

5//

6// **dist/ 를 import 하지 않는다.** doctor/validate 는 설치가 깨졌을 때 실행하는

7// 진단 도구인데 dist/ 는 .gitignore 대상이고, src/model-fallback-policy.ts 가

8// 끌고 오는 logger→config 체인은 진단 대상 설정(logging.mode="file" + path 누락)

9// 에서 throw 한다. 그래서 정책은 scripts/model-policy.mts(순수 미러)를 쓴다.

10//

11// npx makdoong2-team install [--config <dir>] [--force]

scripts/install-lib.mjsView file

Lines 13-53javascript

13/**

14 * 자격증명이 든 파일의 권한을 소유자 전용(0600)으로 좁힌다.

15 *

16 * makdoong2-team.json 은 `.secrets.*` 에 Jira / Confluence / Bitbucket / Bamboo

17 * PAT 를 **평문**으로 담는다. 그런데 종전에는 기본 umask 그대로 생성돼

18 * world-readable(0644/0666) 이었다. 같은 리포의 logger.ts 는 훅 로그가 자격증명을

19 * 흘릴 수 있다는 이유로 이미 0600 을 강제하고 있다 — 정작 토큰 원본이 든 파일이

20 * 더 느슨했다.

21 *

22 * chmod 실패는 무시한다 (Windows·특수 파일시스템). 권한 강화는 best-effort 다.

gates/stage6-post-commit-verify.shView file

•path = gates/stage6-post-commit-verify.sh kind = build_helper sizeBytes = 8225 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

gates/stage6-post-commit-verify.shView on unpkg

assets/makdoong2-team.schema.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

assets/makdoong2-team.schema.jsonView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/cli.tsView file

23import { dirname, join, resolve } from "node:path"; L24: import { execFileSync } from "node:child_process"; L25: import {

High

Child Process

Package source references child process execution.

bin/cli.tsView on unpkg · L23

Findings

1 Critical5 High4 Medium5 Low

CriticalAi Agent Control Hijackscripts/install-lib.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/cli.ts

HighShell

HighRuntime Package Installbin/cli.ts

HighSemantic Analysis Limitedassets/makdoong2-team.schema.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumShips Build Helpergates/stage6-post-commit-verify.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to makdoong2-team@2.3.2.

The versions list below shows the verdict for each recorded version.

Avoid installing makdoong2-team@2.3.2. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-04 20:58:28.048Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

12 known versions

3.0.4latestSuspiciousAgent extension lifecycle riskWarnPublishedSep 3, 2026, 9:53 AM 2.3.2shownMaliciousSoft block: AI-agent control surfaceBlockPublishedAug 31, 2026, 5:16 AM 2.3.1SuspiciousAgent extension lifecycle riskWarnPublishedAug 31, 2026, 12:14 AM 2.3.0MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 30, 2026, 1:08 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Source & flagged code

Related packages

Other AI-agent control-surface risk packages