OpenSSF/OSV advisory MAL-2026-12405 confirms this npm version as malicious. On npm install, postinstall.mjs enumerates platform-specific sibling package names of the form opencode-engos-<platform>-<arch>[-baseline][-musl], resolves each to the current 'latest' tag via `npm view <name> version`, installs the resolved version into a temp directory, then copies the fetched 'opencode' binary into the wrapper's bin/ with chmod 755...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in opencode-engos-ai (npm)
Details
On npm install, postinstall.mjs enumerates platform-specific sibling package names of the form opencode-engos-<platform>-<arch>[-baseline][-musl], resolves each to the current 'latest' tag via `npm view <name> version`, installs the resolved version into a temp directory, then copies the fetched 'opencode' binary into the wrapper's bin/ with chmod 755. The fetched artifact is not pinned to a specific version and is not hash- or signature-verified, so whatever the publisher of the sibling packages pushes to 'latest' at install time is what executes on the installer's host. The sibling package names are not declared in the manifest's optionalDependencies, so they are resolved by name rather than through the reviewable dependency graph. In addition, createSymlinks() writes symlinks at /usr/local/bin/innexarcode and /usr/bin/innexarcode pointing at the fetched binary — a name that matches neither the package name (opencode-engos-ai), its declared bin entry (opencode-engos), nor any documented CLI, placing an unrelated command into the installer's system PATH. The package name also resembles the existing 'opencode' AI CLI.
Decision reason
One or more suspicious static signals were detected.