Loading npm security reports…

makdoong2-team@2.3.2: AI-agent control-surface risk | LPM Firewall

registry / makdoong2-team / 2.3.2

makdoong2-team@2.3.2

내 일을 대신해주는 막둥이들. Self-contained opencode plugin for 사내 workflow: per-stage specialist agents, deterministic shell gates, primary-only enforcement, and a model fallback advisor.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm installation automatically mutates the user's OpenCode control surface. It registers and loads this package, enables tools, and grants broad external-directory access.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm global installation of the package

Impact

The package gains automatic loading and broad OpenCode directory permissions without an explicit setup command.

Mechanism

postinstall deployment that patches OpenCode configuration and cache

Policy narrative

On global npm installation, postinstall invokes the installer without asking the user to run a setup command. The installer adds the package to OpenCode's plugin list, enables its tools, grants allow access for the package and configuration trees, and seeds the OpenCode cache with a symlink to the installed release. This is an unconsented lifecycle mutation of a broad AI-agent control surface.

Rationale

The guarded global-install condition does not establish user consent for automatic OpenCode configuration and permission changes. The lifecycle hook creates a persistent, broadly permitted plugin load path.

Evidence

package.jsonpostinstall.mjsscripts/install-lib.mjsopencode.jsonagents/skills/command/makdoong2-team.json~/.cache/opencode/packages/

Decision evidence

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/cli.tsView file

23import { dirname, join, resolve } from "node:path"; L24: import { execFileSync } from "node:child_process"; L25: import {

High

Child Process

Package source references child process execution.

bin/cli.tsView on unpkg · L23

10// L11: // npx makdoong2-team install [--config <dir>] [--force] L12: // npx makdoong2-team doctor [--config <dir>] ... L23: import { dirname, join, resolve } from "node:path"; L24: import { execFileSync } from "node:child_process"; L25: import {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.tsView on unpkg · L10

scripts/install-lib.mjsView file

33} L34: import { cpSync, mkdirSync, existsSync, readFileSync, writeFileSync, chmodSync, readdirSync, rmSync, symlinkSync, lstatSync, renameSync, } from "node:fs"; L35: import { homedir } from "node:os"; ... L37: // opencode parses its config as JSONC — comments and trailing commas are legal L38: // there. Using strict JSON.parse here silently skipped the whole opencode.json L39: // patch (plugin ref, tools, permissions) for anyone whose config had a trailing ... L129: // module (pre-dist-build era: opencode had to load raw TypeScript). L130: // Both are stripped from opencode.json on install and replaced with the npm L131: // package name (see currentPluginRef()) so the entry stays portable across ... L160: /** L161: * Plugin entry as written to opencode.json. Uses the npm package

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-lib.mjsView on unpkg · L33

gates/stage6-post-commit-verify.shView file

•path = gates/stage6-post-commit-verify.sh kind = build_helper sizeBytes = 8225 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

gates/stage6-post-commit-verify.shView on unpkg

assets/makdoong2-team.schema.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

assets/makdoong2-team.schema.jsonView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 51-89json

51 "engines": {

52 "opencode": ">=1.18.0",

53 "node": ">=22.18.0",

54 "tmux": ">=3.0"

55 },

56 "peerDependencies": {

57 "@opencode-ai/plugin": "^1.18.0"

58 },

59 "devDependencies": {

60 "@opencode-ai/plugin": "1.18.15",

61 "@opencode-ai/sdk": "1.18.15",

62 "@types/node": "^22.20.1",

63 "husky": "^9.0.0",

64 "typescript": "^5.7.0"

65 },

66 "scripts": {

67 "build": "tsc -p tsconfig.build.json",

68 "typecheck": "tsc -p tsconfig.json",

69 "clean": "node -e \"import('node:fs').then(({rmSync})=>rmSync('dist',{recursive:true,force:true}))\"",

70 "prepack": "npm run clean && npm run build && npm run build:entry",

71 "postinstall": "node postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L71

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L71

72 "prepare": "husky install",

73 "test": "XDG_CONFIG_HOME=\"$(mktemp -d)\" XDG_CACHE_HOME=\"$(mktemp -d)\" npm run test:all",

74 "test:all": "npm run build && node scripts/run-tests.mts",

75 "test:install": "node test/install-lib.test.ts",

76 "test:postinstall": "node scripts/test-postinstall.mts",

77 "test:ubuntu": "bash scripts/test-ubuntu.sh",

78 "release": "bash scripts/release.sh",

79 "release:patch": "bash scripts/release.sh patch",

80 "release:minor": "bash scripts/release.sh minor",

81 "release:major": "bash scripts/release.sh major",

82 "build:entry": "tsc -p tsconfig.entry.json && node -e \"import('node:fs').then(({chmodSync})=>{chmodSync('bin/cli.js',0o755)})\""

83 },

84 "homepage": "https://github.com/y00njinuk/makdoong2-team#readme",

85 "bugs": {

86 "url": "https://github.com/y00njinuk/makdoong2-team/issues"

87 }

88}

89

bin/cli.tsView file

Lines 1-43typescript

1#!/usr/bin/env node

2// bin/cli.ts — makdoong2-team installer & doctor.

3//

4// 편집하지 말 것 — 다음 빌드가 덮어쓴다.

5//

6// **dist/ 를 import 하지 않는다.** doctor/validate 는 설치가 깨졌을 때 실행하는

7// 진단 도구인데 dist/ 는 .gitignore 대상이고, src/model-fallback-policy.ts 가

8// 끌고 오는 logger→config 체인은 진단 대상 설정(logging.mode="file" + path 누락)

9// 에서 throw 한다. 그래서 정책은 scripts/model-policy.mts(순수 미러)를 쓴다.

10//

11// npx makdoong2-team install [--config <dir>] [--force]

scripts/install-lib.mjsView file

Lines 13-53javascript

13/**

14 * 자격증명이 든 파일의 권한을 소유자 전용(0600)으로 좁힌다.

15 *

16 * makdoong2-team.json 은 `.secrets.*` 에 Jira / Confluence / Bitbucket / Bamboo

17 * PAT 를 **평문**으로 담는다. 그런데 종전에는 기본 umask 그대로 생성돼

18 * world-readable(0644/0666) 이었다. 같은 리포의 logger.ts 는 훅 로그가 자격증명을

19 * 흘릴 수 있다는 이유로 이미 0600 을 강제하고 있다 — 정작 토큰 원본이 든 파일이

20 * 더 느슨했다.

21 *

22 * chmod 실패는 무시한다 (Windows·특수 파일시스템). 권한 강화는 best-effort 다.

23

gates/stage6-post-commit-verify.shView file

•path = gates/stage6-post-commit-verify.sh kind = build_helper sizeBytes = 8225 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

gates/stage6-post-commit-verify.shView on unpkg

assets/makdoong2-team.schema.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

assets/makdoong2-team.schema.jsonView on unpkg