registry / AI-agent control-surface risk / opencode-impm-cn

opencode-impm-cn

我是项目经理（AI项目经理）OpenCode 插件 - 中文版工程化全流程开发套件（agents + commands + skills + 工具链）

This report shows the evidence for opencode-impm-cn@1.0.0. 3 of 3 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The package automatically and broadly alters a consumer project’s OpenCode agents, commands, skills, plugin files, and configuration. That meets the install-control-surface blocking policy even though no exfiltration endpoint was found.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation or OpenCode loading the plugin after an asset-version mismatch

Impact

The package gains automatic control over agents, commands, skills, and enabled plugins in the consumer project.

Mechanism

postinstall and load-time copying plus OpenCode configuration mutation

Policy narrative

On npm installation, postinstall resolves INIT_CWD to the consumer project and copies package assets into its .opencode control directories. It replaces the local impm plugin payload, writes OpenCode configuration, and enables both this package and opencode-browser without a user command. The copied plugin also reruns installation when OpenCode loads it if its manifest version differs. This is an unconsented install-time mutation of a foreign AI-agent control surface.

AI rationale

Evidence

package.jsonscripts/install.mjsscripts/install-core.mjsdist/index.jsopencode.json.opencode/agents.opencode/commands.opencode/skills.opencode/plugins/impm.opencode/plugins/impm.js.opencode/package.json.opencode/impm-manifest.json

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

A postinstall hook automatically launches the installer.
The installer targets the consumer project through INIT_CWD.
Installation copies agents, commands, and skills into the consumer’s .opencode directory.
Installation replaces a local plugin entry and registers both this package and opencode-browser in opencode.json.
The plugin repeats installation automatically when OpenCode loads it after a version change.
The plugin invokes its installer with the consumer project root.

Evidence against

No source evidence of network requests or credential exfiltration was found.
No runtime dependency on another release of this package was declared.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 21 file(s), 224 KB of source, external domains: opencode.ai

Source & flagged code

6 flagged

package.jsonView file

Lines 1-34json

2 "name": "opencode-impm-cn",

3 "version": "1.0.0",

4 "description": "我是项目经理（AI项目经理）OpenCode 插件 - 中文版工程化全流程开发套件（agents + commands + skills + 工具链）",

5 "type": "module",

6 "main": "dist/index.js",

7 "types": "dist/index.d.ts",

8 "scripts": {

9 "build": "tsc",

10 "dev": "tsc --watch",

11 "prepublishOnly": "npm run build",

12 "install:plugin": "node scripts/install.mjs",

13 "uninstall:plugin": "node scripts/uninstall.mjs",

14 "postinstall": "node scripts/install.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L14

15 },

16 "keywords": [

17 "opencode-plugin",

18 "opencode",

19 "impm",

20 "project-manager",

21 "ai-project-manager",

22 "tdd"

23 ],

24 "author": "jenemy8023 <jenemy8023@163.com>",

25 "license": "Apache-2.0",

26 "files": [

27 "dist/",

28 "assets/",

29 "scripts/install.mjs",

30 "scripts/install-core.mjs",

31 "scripts/uninstall.mjs",

32 "scripts/install.ps1",

33 "scripts/uninstall.ps1",

34 "scripts/agent-models.json"

dist/index.jsView file

Lines 117-157javascript

117async function ensureInstalled(projectRoot) {

118 try {

119 const manifestPath = join(projectRoot, ".opencode", "impm-manifest.json");

120

scripts/install.mjsView file

Lines 1-39javascript

1/**

3 *

4 * Licensed under the Apache License, Version 2.0 (the "License");

5 * you may not use this file except in compliance with the License.

6 * You may obtain a copy of the License at

7 *

8 * http://www.apache.org/licenses/LICENSE-2.0

9 *

10 * Unless required by applicable law or agreed to in writing, software

11 * distributed under the License is distributed on an "AS IS" BASIS,

scripts/uninstall.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: t") { for (const name of managedagents) { const entry = config.agent[name]; if (!entry || typeof entry !== "object") { continue; } let changed = false; if ("model" in entry) { delete entry.model; changed = true; } if ("reasoning_effort" in entry) { delete entry.reasoning_effort; changed = true; } if (changed && object.keys(entry).length === 0) { delete config.agent[name]; } if (changed) { cleaned++; } } if (object.keys(config

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/uninstall.mjsView on unpkg

scripts/uninstall.ps1View file

•path = scripts/uninstall.ps1 kind = build_helper sizeBytes = 13669 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/uninstall.ps1View on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

137const corePath = pathToFileURL(join(PLUGIN_ROOT, "scripts", "install-core.mjs")).href; L138: const core = (await import(corePath)); L139: core.runInstall({

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L137

Findings

1 Critical2 High5 Medium5 Low

CriticalAi Agent Control Hijackscripts/install.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighExternal Ai Agent Control Surface Mutationscripts/uninstall.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/index.js

MediumEnvironment Vars

MediumShips Build Helperscripts/uninstall.ps1

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to opencode-impm-cn@1.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing opencode-impm-cn@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-13 00:24:20.300Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

3 known versions

1.0.0latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedSep 9, 2026, 7:07 AM 0.9.0MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 4, 2026, 9:56 AM 0.8.10MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 4, 2026, 3:59 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Behavioral surface

Source & flagged code

Related packages

Other AI-agent control-surface risk packages