Loading npm security reports…

makdoong2-team@2.3.0: AI-agent control-surface risk | LPM Firewall

registry / makdoong2-team / 2.3.0

makdoong2-team@2.3.0

내 일을 대신해주는 막둥이들. Self-contained opencode plugin for 사내 workflow: per-stage specialist agents, deterministic shell gates, primary-only enforcement, and a model fallback advisor.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install automatically changes the user's OpenCode configuration. It installs a plugin and a configuration that permits arbitrary bash commands.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Global npm installation, or a local installation with MAKDOONG2_AUTO_INSTALL=1.

Impact

The package can expand an AI agent's ability to execute shell commands and access configured directories.

Mechanism

Install-time OpenCode configuration mutation with broad shell permission.

Policy narrative

The postinstall hook runs for global installation and calls the installer against the OpenCode configuration directory. The installer adds the package as a plugin, enables its tools, and adds external-directory permissions. When it seeds the supplied configuration, that configuration grants bash wildcard permission. This is an automatic broad AI-agent control-surface change rather than a narrowly scoped package setup.

Rationale

Automatic global-install mutation of OpenCode's configuration adds a package plugin and broad shell permission. This meets the policy threshold for malicious install-hook abuse even without observed exfiltration.

Evidence

postinstall.mjsscripts/install-lib.mjsopencode.json.example~/.config/opencode/opencode.json~/.config/opencode/agents~/.config/opencode/skills

Decision evidence

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/cli.tsView file

23import { dirname, join, resolve } from "node:path"; L24: import { execFileSync } from "node:child_process"; L25: import {

High

Child Process

Package source references child process execution.

bin/cli.tsView on unpkg · L23

10// L11: // npx makdoong2-team install [--config <dir>] [--force] L12: // npx makdoong2-team doctor [--config <dir>] ... L23: import { dirname, join, resolve } from "node:path"; L24: import { execFileSync } from "node:child_process"; L25: import {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.tsView on unpkg · L10

scripts/install-lib.mjsView file

33} L34: import { cpSync, mkdirSync, existsSync, readFileSync, writeFileSync, chmodSync, readdirSync, rmSync, symlinkSync, lstatSync, renameSync, } from "node:fs"; L35: import { homedir } from "node:os"; ... L37: // opencode parses its config as JSONC — comments and trailing commas are legal L38: // there. Using strict JSON.parse here silently skipped the whole opencode.json L39: // patch (plugin ref, tools, permissions) for anyone whose config had a trailing ... L129: // module (pre-dist-build era: opencode had to load raw TypeScript). L130: // Both are stripped from opencode.json on install and replaced with the npm L131: // package name (see currentPluginRef()) so the entry stays portable across ... L160: /** L161: * Plugin entry as written to opencode.json. Uses the npm package

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-lib.mjsView on unpkg · L33

gates/stage6-post-commit-verify.shView file

•path = gates/stage6-post-commit-verify.sh kind = build_helper sizeBytes = 8225 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

gates/stage6-post-commit-verify.shView on unpkg

assets/makdoong2-team.schema.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

assets/makdoong2-team.schema.jsonView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 51-89json

51 "engines": {

52 "opencode": ">=1.18.0",

53 "node": ">=22.18.0",

54 "tmux": ">=3.0"

55 },

56 "peerDependencies": {

57 "@opencode-ai/plugin": "^1.18.0"

58 },

59 "devDependencies": {

60 "@opencode-ai/plugin": "1.18.15",

61 "@opencode-ai/sdk": "1.18.15",

62 "@types/node": "^22.20.1",

63 "husky": "^9.0.0",

64 "typescript": "^5.7.0"

65 },

66 "scripts": {

67 "build": "tsc -p tsconfig.build.json",

68 "typecheck": "tsc -p tsconfig.json",

69 "clean": "node -e \"import('node:fs').then(({rmSync})=>rmSync('dist',{recursive:true,force:true}))\"",

70 "prepack": "npm run clean && npm run build && npm run build:entry",

71 "postinstall": "node postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L71

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L71

72 "prepare": "husky install",

73 "test": "XDG_CONFIG_HOME=\"$(mktemp -d)\" XDG_CACHE_HOME=\"$(mktemp -d)\" npm run test:all",

74 "test:all": "npm run build && node scripts/run-tests.mts",

75 "test:install": "node test/install-lib.test.ts",

76 "test:postinstall": "node scripts/test-postinstall.mts",

77 "test:ubuntu": "bash scripts/test-ubuntu.sh",

78 "release": "bash scripts/release.sh",

79 "release:patch": "bash scripts/release.sh patch",

80 "release:minor": "bash scripts/release.sh minor",

81 "release:major": "bash scripts/release.sh major",

82 "build:entry": "tsc -p tsconfig.entry.json && node -e \"import('node:fs').then(({chmodSync})=>{chmodSync('bin/cli.js',0o755)})\""

83 },

84 "homepage": "https://github.com/y00njinuk/makdoong2-team#readme",

85 "bugs": {

86 "url": "https://github.com/y00njinuk/makdoong2-team/issues"

87 }

88}

89

bin/cli.tsView file

Lines 1-43typescript

1#!/usr/bin/env node

2// bin/cli.ts — makdoong2-team installer & doctor.

3//

4// 편집하지 말 것 — 다음 빌드가 덮어쓴다.

5//

6// **dist/ 를 import 하지 않는다.** doctor/validate 는 설치가 깨졌을 때 실행하는

7// 진단 도구인데 dist/ 는 .gitignore 대상이고, src/model-fallback-policy.ts 가

8// 끌고 오는 logger→config 체인은 진단 대상 설정(logging.mode="file" + path 누락)

9// 에서 throw 한다. 그래서 정책은 scripts/model-policy.mts(순수 미러)를 쓴다.

10//

11// npx makdoong2-team install [--config <dir>] [--force]

scripts/install-lib.mjsView file

Lines 13-53javascript

13/**

14 * 자격증명이 든 파일의 권한을 소유자 전용(0600)으로 좁힌다.

15 *

16 * makdoong2-team.json 은 `.secrets.*` 에 Jira / Confluence / Bitbucket / Bamboo

17 * PAT 를 **평문**으로 담는다. 그런데 종전에는 기본 umask 그대로 생성돼

18 * world-readable(0644/0666) 이었다. 같은 리포의 logger.ts 는 훅 로그가 자격증명을

19 * 흘릴 수 있다는 이유로 이미 0600 을 강제하고 있다 — 정작 토큰 원본이 든 파일이

20 * 더 느슨했다.

21 *

22 * chmod 실패는 무시한다 (Windows·특수 파일시스템). 권한 강화는 best-effort 다.

23

gates/stage6-post-commit-verify.shView file

•path = gates/stage6-post-commit-verify.sh kind = build_helper sizeBytes = 8225 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

gates/stage6-post-commit-verify.shView on unpkg

assets/makdoong2-team.schema.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

assets/makdoong2-team.schema.jsonView on unpkg