Loading npm security reports…

opencode-fractal-memory: AI-agent control-surface risk | LPM Firewall

registry / opencode-fractal-memory / 0.8.4

opencode-fractal-memory@0.8.4

Fractal memory system for OpenCode with semantic search and automatic compression.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Automatic installation modifies the global OpenCode TUI plugin list. Runtime initialization repeats that registration and can create a global package symlink.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm installation runs postinstall; loading the plugin runs its initialization.

Impact

The package becomes enabled across OpenCode projects without an explicit setup command.

Mechanism

Global OpenCode configuration and package-link mutation.

Policy narrative

Installing the package automatically runs postinstall, which creates or edits the user's global OpenCode TUI configuration and adds the package as a plugin. If lifecycle scripts are skipped, merely loading the plugin repeats the registration and may create a global node_modules symlink. This is an unconsented, persistent mutation of a broad AI-agent control surface, causing the package to be activated for OpenCode use beyond the installing project.

AI rationale

This package has a concrete automatic postinstall path that mutates a global OpenCode control surface, and an import-time self-healing path that repeats it. That meets the install-control-surface block boundary despite no evidence of credential exfiltration.

Evidence

package.jsonscripts/postinstall.cjsdist/plugin/index.jsdist/infrastructure/tui-self-register.js~/.config/opencode/tui.json~/.config/opencode/node_modules/opencode-fractal-memory

Decision evidence

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

management/public/d3.min.jsView file

1// https://d3js.org v7.9.0 Copyright 2010-2023 Mike Bostock L2: !function(t,n){"object"==typeof exports&&"undefined"!=typeof module?n(exports):"function"==typeof define&&define.amd?define(["exports"],n):n((t="undefined"!=typeof globalThis?globa...

Low

Eval

Package source references a known benign dynamic code generation pattern.

management/public/d3.min.jsView on unpkg · L1

scripts/clean-plugin-installs.tsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: import { existssync, statsync, readfilesync, writefilesync } from "node:fs"; import { homedir } from "node:os"; import { join, resolve } from "node:path"; const pkg = "opencode-fractal-memory"; const dryrun = process.argv.includes("--dry-run"); const projectargs: string[] = []; for (let i = 0; i < process.argv.length; i++) { if (process.argv[i] === "--project") projectargs.push(resolve(process.argv[i + 1] ?? "")); } const projects = [process.cwd(), ...projectargs]; const home = homedir(); const targets: string[] = [ join(home, ".config", "opencode", "node_modules", pkg), join(home, ".cache", "opencode", "packages", `${pkg}@latest`), join(home, ".cache", "opencode", "packages", pkg), ]; for

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/clean-plugin-installs.tsView on unpkg

scripts/opencode-backup.shView file

•path = scripts/opencode-backup.sh kind = build_helper sizeBytes = 1629 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/opencode-backup.shView on unpkg

management/public/models/brain-atlas.glbView file

•path = management/public/models/brain-atlas.glb kind = high_entropy_blob sizeBytes = 103464 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

management/public/models/brain-atlas.glbView on unpkg

scripts/postinstall.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = opencode-fractal-memory@0.8.2 matchedIdentity = npm:b3BlbmNvZGUtZnJhY3RhbC1tZW1vcnk:0.8.2 similarity = 0.775 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/postinstall.cjsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 21-61json

21 "opencode-plugin",

22 "memory",

23 "embeddings",

24 "semantic-search",

25 "hnsw",

26 "vector-search",

27 "bm25",

28 "agent-memory"

29 ],

30 "license": "MIT",

31 "repository": {

32 "type": "git",

33 "url": "git+https://github.com/holgerreppert/opencode-fractal-memory.git"

34 },

35 "trustedDependencies": [],

36 "scripts": {

37 "build": "tsc",

38 "lint": "oxlint --config oxlintrc.json",

39 "lint:fix": "oxlint --fix-dangerously --config oxlintrc.json",

40 "prepublishOnly": "npm run build && npm run typecheck",

41 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L41

42 "dev-install": "bun run scripts/dev-install.ts",

43 "plugin:clean": "bun run scripts/clean-plugin-installs.ts",

44 "test": "bun test",

45 "test:essential": "bun test",

46 "test:full": "bun test --path-ignore-patterns 'zz-none'",

47 "test:slow": "bun test --path-ignore-patterns 'zz-none' ./src/storage/search.loco.test.ts ./src/storage/search.swecontext.test.ts",

48 "test:coverage": "bun test --coverage",

49 "typecheck": "tsc --noEmit",

50 "view": "bun run dist/management-standalone.js",

51 "mcp": "bun run dist/mcp-server.js"

52 },

53 "dependencies": {

54 "@huggingface/tokenizers": "^0.1.3",

55 "@kreuzberg/tree-sitter-language-pack-wasm": "^1.10.9",

56 "@modelcontextprotocol/sdk": "^1.30.0",

57 "@types/three": "^0.185.4",

58 "@viz-js/viz": "^3.29.0",

59 "graphology": "^0.26.0",

60 "graphology-communities-louvain": "^2.0.2",

61 "graphology-shortest-path": "^2.1.0",

management/public/d3.min.jsView file

Lines 1-3javascript

1// https://d3js.org v7.9.0 Copyright 2010-2023 Mike Bostock

2!function(t,n){"object"==typeof exports&&"undefined"!=typeof module?n(exports):"function"==typeof define&&

scripts/clean-plugin-installs.tsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: import { existssync, statsync, readfilesync, writefilesync } from "node:fs"; import { homedir } from "node:os"; import { join, resolve } from "node:path"; const pkg = "opencode-fractal-memory"; const dryrun = process.argv.includes("--dry-run"); const projectargs: string[] = []; for (let i = 0; i < process.argv.length; i++) { if (process.argv[i] === "--project") projectargs.push(resolve(process.argv[i + 1] ?? "")); } const projects = [process.cwd(), ...projectargs]; const home = homedir(); const targets: string[] = [ join(home, ".config", "opencode", "node_modules", pkg), join(home, ".cache", "opencode", "packages", `${pkg}@latest`), join(home, ".cache", "opencode", "packages", pkg), ]; for

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/clean-plugin-installs.tsView on unpkg

scripts/opencode-backup.shView file

•path = scripts/opencode-backup.sh kind = build_helper sizeBytes = 1629 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/opencode-backup.shView on unpkg

management/public/models/brain-atlas.glbView file

•path = management/public/models/brain-atlas.glb kind = high_entropy_blob sizeBytes = 103464 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

management/public/models/brain-atlas.glbView on unpkg

scripts/postinstall.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = opencode-fractal-memory@0.8.2 matchedIdentity = npm:b3BlbmNvZGUtZnJhY3RhbC1tZW1vcnk:0.8.2 similarity = 0.775 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/postinstall.cjsView on unpkg