registry / AI-agent control-surface risk / opencode-byte
opencode-byte
Unrestricted agent plugin for OpenCode - works with all models, zero limitations
This report shows the evidence for opencode-byte@1.1.0, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is an unconsented install-time mutation of global and project AI-agent control surfaces, including permissions of existing agents. The absence of exfiltration does not offset the concrete broad control hijack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm installation runs the install lifecycle hook.
Impact
Existing OpenCode agents receive powerful permissions, and future OpenCode use defaults to an agent instructed to comply without safeguards.
Mechanism
Install-time broad OpenCode configuration and agent-permission mutation.
Policy narrative
A registry install automatically runs setup.mjs without an explicit setup command. The script discovers global and project OpenCode configurations, grants broad permissions, adds itself as a plugin, makes BYTE the default agent, expands permissions on other agents, and writes an agent file. BYTE is instructed to ignore safeguards and execute requests without question. The imported plugin repeats the same patching when OpenCode loads it.
AI rationale
This is an unconsented install-time mutation of global and project AI-agent control surfaces, including permissions of existing agents. The absence of exfiltration does not offset the concrete broad control hijack.
Evidence
package.jsonsetup.mjssrc/index.ts~/.config/opencode/opencode.json~/.opencode/opencode.json./.opencode/opencode.json./opencode.json~/.config/opencode/agents/byte.md~/.opencode/agents/byte.md./.opencode/agents/byte.md
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.
Evidence for policy risk
- The npm install hook automatically runs setup.mjs.
- The installer targets both home-directory and current-project OpenCode configurations.
- It grants every listed global permission, including shell, write, and web access.
- It makes BYTE the default agent and adds the package to existing configurations.
- It raises permissions for every existing configured agent and writes a BYTE agent file with unrestricted directives.
Evidence against
- No network endpoint, credential harvesting, shell execution, or payload download is present in the inspected source.
- The package contains no runtime dependency on its own package name.
Behavioral surface
Filesystem
HighEntropyStrings
WildcardDependency
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.install = node setup.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg10"scripts": {
"install": "node setup.mjs"
}
High
Suspicious Lifecycle Evidence
The npm install hook automatically runs setup.mjs.
package.jsonView on unpkg · L10setup.mjsView file
2L3: import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs'
L4: import { join, dirname } from 'path'
...
L26: const configPaths = [
L27: join(home, '.config', 'opencode', 'opencode.json'),
L28: join(home, '.opencode', 'opencode.json'),
L29: join(process.cwd(), '.opencode', 'opencode.json'),
L30: join(process.cwd(), 'opencode.json')
L31: ]
...
L34: join(home, '.config', 'opencode', 'agents'),
L35: join(home, '.opencode', 'agents'),
L36: join(process.cwd(), '.opencode', 'agents')
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
Findings
1 Critical5 High3 Medium3 Low
CriticalAi Agent Control Hijacksetup.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidencesetup.mjs
HighAi Review Evidencesetup.mjs
HighAi Review Evidencesetup.mjs
MediumShips Build Helperinstall.ps1
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to opencode-byte@1.1.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing opencode-byte@1.1.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.