opencode-agent-skill@15.2.1: Suspicious npm security report | LPM Firewall

Loading npm security reports…

opencode-agent-skill@15.2.1: Suspicious npm security report | LPM Firewall

Source & flagged code

7 flagged · loading source

evals/long/graders/long-horizon.mjsView file

13const load = async (file) => L14: import(pathToFileURL(path.join(workspace, "src", file)).href + "?eval=" + Date.now() + "-" + Math.random()) L15:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

evals/long/graders/long-horizon.mjsView on unpkg · L13

evals/polyglot/fixtures/polyglot-bench/python/tenant_auth.pyView file

•path = [redacted]-bench/python/tenant_auth.py kind = payload_in_excluded_dir sizeBytes = 123 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

evals/polyglot/fixtures/polyglot-bench/python/tenant_auth.pyView on unpkg

•path = [redacted]-bench/python/tenant_auth.py kind = build_helper sizeBytes = 123 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

evals/polyglot/fixtures/polyglot-bench/python/tenant_auth.pyView on unpkg

lib/control-center.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/control-center.mjs#virtual:normalized:round1View on unpkg

lib/process-runner.mjsView file

•matchType = normalized_sha256 matchedPackage = opencode-agent-skill@11.0.0 matchedPath = lib/process-runner.mjs matchedIdentity = npm:b3BlbmNvZGUtYWdlbnQtc2tpbGw:11.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/process-runner.mjsView on unpkg

lib/browser-runtime.mjsView file

•matchType = normalized_sha256 matchedPackage = opencode-agent-skill@11.0.0 matchedPath = lib/browser-runtime.mjs matchedIdentity = npm:b3BlbmNvZGUtYWdlbnQtc2tpbGw:11.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/browser-runtime.mjsView on unpkg

lib/code-intelligence/lsp-pool.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = opencode-agent-skill@10.0.0 matchedIdentity = npm:b3BlbmNvZGUtYWdlbnQtc2tpbGw:10.0.0 similarity = 0.434 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/code-intelligence/lsp-pool.mjsView on unpkg

Source & flagged code

7 flagged

evals/long/graders/long-horizon.mjsView file

Lines 1-33javascript

1import assert from "node:assert/strict"

2import path from "node:path"

3import { spawnSync } from "node:child_process"

4import { fileURLToPath, pathToFileURL } from "node:url"

5

6const workspace = process.env.UES_EVAL_WORKSPACE

7const task = process.env.UES_EVAL_TASK

8if (!workspace || !task) {

9 console.error("UES_EVAL_WORKSPACE and UES_EVAL_TASK are required")

10 process.exit(2)

11}

12

13const load = async (file) =>

14 import(pathToFileURL(path.join(workspace, "src", file)).href + "?eval=" + Date.now() + "-" + Math.random())

15

Medium

Dynamic Require

Package source references dynamic require/import behavior.

evals/long/graders/long-horizon.mjsView on unpkg · L13

16const throws = (fn, Type) => assert.throws(fn, Type)

17

18switch (task) {

19 case "long-checkout-integration": {

20 const { calculateTotal } = await load("money.mjs")

21 const { reserveAll } = await load("inventory.mjs")

22 const { applyCharge } = await load("payment.mjs")

23 const { checkout } = await load("checkout.mjs")

24

25 const lines = [

26 { sku: "a", unitPriceCents: 250, quantity: 2 },

27 { sku: "a", unitPriceCents: 100, quantity: 1 },

28 { sku: "b", unitPriceCents: 50, quantity: 3 },

29 ]

30 assert.equal(calculateTotal(lines), 750)

31 throws(() => calculateTotal("x"), TypeError)

32 throws(() => calculateTotal([{ sku: "a", unitPriceCents: 1.5, quantity: 1 }]), TypeError)

33 throws(() => calculateTotal([{ sku: "a", unitPriceCents: -1, quantity: 1 }]), RangeError)

evals/polyglot/fixtures/polyglot-bench/python/tenant_auth.pyView file

•path = [redacted]-bench/python/tenant_auth.py kind = payload_in_excluded_dir sizeBytes = 123 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

evals/polyglot/fixtures/polyglot-bench/python/tenant_auth.pyView on unpkg

•path = [redacted]-bench/python/tenant_auth.py kind = build_helper sizeBytes = 123 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

evals/polyglot/fixtures/polyglot-bench/python/tenant_auth.pyView on unpkg

lib/control-center.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/control-center.mjs#virtual:normalized:round1View on unpkg

lib/process-runner.mjsView file

•matchType = normalized_sha256 matchedPackage = opencode-agent-skill@11.0.0 matchedPath = lib/process-runner.mjs matchedIdentity = npm:b3BlbmNvZGUtYWdlbnQtc2tpbGw:11.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/process-runner.mjsView on unpkg

lib/browser-runtime.mjsView file

•matchType = normalized_sha256 matchedPackage = opencode-agent-skill@11.0.0 matchedPath = lib/browser-runtime.mjs matchedIdentity = npm:b3BlbmNvZGUtYWdlbnQtc2tpbGw:11.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/browser-runtime.mjsView on unpkg

lib/code-intelligence/lsp-pool.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = opencode-agent-skill@10.0.0 matchedIdentity = npm:b3BlbmNvZGUtYWdlbnQtc2tpbGw:10.0.0 similarity = 0.434 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/code-intelligence/lsp-pool.mjsView on unpkg