Loading npm security reports…

opencode-matrixx@2.6.13: Suspicious npm security report (Warn) | LPM Firewall

registry / opencode-matrixx / 2.6.13

opencode-matrixx@2.6.13

The Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools

AI Security Review

scanned 13d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. After the user loads this OpenCode plugin, a new session can update it in place. With auto_update left at its default, the hook reads this package's npm dist-tag, removes the installed copy under the OpenCode config directory, and runs bun install there.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

OpenCode emits session.created while the plugin is loaded and auto_update is not set to false.

Impact

A later release of this same plugin can be installed into the user's OpenCode config tree without another prompt. Pinned entries and auto_update false stay notification-only. No install-time hook or credential export was found.

Mechanism

The hook fetches registry.npmjs.org dist-tags for opencode-matrixx, deletes the package directory and its config package.json dependency, then spawns bun install in the OpenCode config directory.

AI rationale

The published bundle has no npm install lifecycle hook. Once loaded as an OpenCode plugin, its auto-update hook defaults on and can replace itself by running bun install in the OpenCode config directory after a registry version check.

Evidence

dist/index.jsopencode.jsonopencode.jsoncpackage.jsonbun.lock

Network endpoints1

registry.npmjs.org/-/package/opencode-matrixx/dist-tags

Decision evidence

Source & flagged code

13 flagged · loading source

dist/index.jsView file

106var init_js_yaml = __esm(() => { L107: /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */ L108: __create2 = Object.create; ... L536: for (;index < max; index++) { L537: if (!isHexCode(data.charCodeAt(index))) L538: return false; ... L2846: if (!match) { L2847: return { data: {}, body: content, hadFrontmatter: false, parseError: false }; L2848: } ... L3025: } L3026: if (typeof process !== "undefined" && process.platform) { L3027: return process.platform === "win32";

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L106

106var init_js_yaml = __esm(() => { L107: /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */ L108: __create2 = Object.create; ... L536: for (;index < max; index++) { L537: if (!isHexCode(data.charCodeAt(index))) L538: return false; ... L2846: if (!match) { L2847: return { data: {}, body: content, hadFrontmatter: false, parseError: false }; L2848: } ... L3025: } L3026: if (typeof process !== "undefined" && process.platform) { L3027: return process.platform === "win32";

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.jsView on unpkg · L106

106Trigger-reachable chain: manifest.main -> dist/index.js L106: var init_js_yaml = __esm(() => { L107: /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */ L108: __create2 = Object.create; ... L536: for (;index < max; index++) { L537: if (!isHexCode(data.charCodeAt(index))) L538: return false; ... L2846: if (!match) { L2847: return { data: {}, body: content, hadFrontmatter: false, parseError: false }; L2848: } ... L3025: } L3026: if (typeof process !== "undefined" && process.platform) { L3027: return process.platform === "win32";

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L106

27683* **CWE-78 Command Injection**: L27684: - \`exec()\`, \`spawn()\`, or \`execSync()\` with unsanitized user input. L27685: - \`child_process\` usage without strict argument separation.

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L27683

23217L23218: **Windows (PowerShell):** L23219: \`\`\`powershell

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L23217

27688- \`JSON.parse()\` on untrusted input without schema validation. L27689: - \`eval()\` or \`new Function()\` with user-controlled strings. L27690: - Unsafe YAML or XML parsing.

High

Eval

Package source references dynamic code evaluation.

dist/index.jsView on unpkg · L27688

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: function readLineBreak(state) { readLineBreak(state); readLineBreak(state); readLineBreak(state); import { existsSync as existsSync41, mkdirSync as mkdirSync17, readFileSync as readFileSync37, unlinkSync as unlinkSync9, writeFileSync as writeFileSync20 } from "fs"; writeFileSync20(filePath, content, "utf-8"); agent-browser open api.example.com --headers '{"Authorization": "Bearer <token>"}' - **World baseURL**: The generated \`world.ts\` MUST set \`baseURL: process.env.BDD_BASE_URL || 'http://localhost:4000'\` in \`browser.newContext()\` so \`page.goto('/login')\` res...

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

106var init_js_yaml = __esm(() => { L107: /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */ L108: __create2 = Object.create; ... L536: for (;index < max; index++) { L537: if (!isHexCode(data.charCodeAt(index))) L538: return false; ... L2846: if (!match) { L2847: return { data: {}, body: content, hadFrontmatter: false, parseError: false }; L2848: } ... L3025: } L3026: if (typeof process !== "undefined" && process.platform) { L3027: return process.platform === "win32";

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.jsView on unpkg · L106

106var init_js_yaml = __esm(() => { L107: /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */ L108: __create2 = Object.create; ... L536: for (;index < max; index++) { L537: if (!isHexCode(data.charCodeAt(index))) L538: return false; ... L2846: if (!match) { L2847: return { data: {}, body: content, hadFrontmatter: false, parseError: false }; L2848: } ... L3025: } L3026: if (typeof process !== "undefined" && process.platform) { L3027: return process.platform === "win32";

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L106

26256- **TypeScript loader**: Add \`{ module: ['tsx/esm'] }\` to \`requireModule\` so \`tsx\` transpiles \`.ts\` files on import. L26257: - **World baseURL**: The generated \`world.ts\` MUST set \`baseURL: process.env.BDD_BASE_URL || 'http://localhost:4000'\` in \`browser.newContext()\` so \`page.goto('/login')\` res... L26258: ... L27683: * **CWE-78 Command Injection**: L27684: - \`exec()\`, \`spawn()\`, or \`execSync()\` with unsanitized user input. L27685: - \`child_process\` usage without strict argument separation. ... L44904: try { L44905: const content = readFileSync(cacheFile, "utf-8"); L44906: const data = JSON.parse(content); ... L103727: ### Phase 2: Automated Scanning L103728: Run available tools in order. If a tool is not installed, note it and continue with the next. L103

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L26256

106Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js L106: var init_js_yaml = __esm(() => { L107: /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */ L108: __create2 = Object.create; ... L536: for (;index < max; index++) { L537: if (!isHexCode(data.charCodeAt(index))) L538: return false; ... L2846: if (!match) { L2847: return { data: {}, body: content, hadFrontmatter: false, parseError: false }; L2848: } ... L3025: } L3026: if (typeof process !== "undefined" && process.platform) { L3027: return process.platform === "win32";

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/index.jsView on unpkg · L106

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = opencode-matrixx@2.6.8 matchedPath = dist/index.js matchedIdentity = npm:b3BlbmNvZGUtbWF0cml4eA:2.6.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

13 flagged

dist/index.jsView file

106var init_js_yaml = __esm(() => { L107: /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */ L108: __create2 = Object.create; ... L536: for (;index < max; index++) { L537: if (!isHexCode(data.charCodeAt(index))) L538: return false; ... L2846: if (!match) { L2847: return { data: {}, body: content, hadFrontmatter: false, parseError: false }; L2848: } ... L3025: } L3026: if (typeof process !== "undefined" && process.platform) { L3027: return process.platform === "win32";

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L106

106var init_js_yaml = __esm(() => { L107: /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */ L108: __create2 = Object.create; ... L536: for (;index < max; index++) { L537: if (!isHexCode(data.charCodeAt(index))) L538: return false; ... L2846: if (!match) { L2847: return { data: {}, body: content, hadFrontmatter: false, parseError: false }; L2848: } ... L3025: } L3026: if (typeof process !== "undefined" && process.platform) { L3027: return process.platform === "win32";

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.jsView on unpkg · L106

106Trigger-reachable chain: manifest.main -> dist/index.js L106: var init_js_yaml = __esm(() => { L107: /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */ L108: __create2 = Object.create; ... L536: for (;index < max; index++) { L537: if (!isHexCode(data.charCodeAt(index))) L538: return false; ... L2846: if (!match) { L2847: return { data: {}, body: content, hadFrontmatter: false, parseError: false }; L2848: } ... L3025: } L3026: if (typeof process !== "undefined" && process.platform) { L3027: return process.platform === "win32";

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L106

27683* **CWE-78 Command Injection**: L27684: - \`exec()\`, \`spawn()\`, or \`execSync()\` with unsanitized user input. L27685: - \`child_process\` usage without strict argument separation.

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L27683

23217L23218: **Windows (PowerShell):** L23219: \`\`\`powershell

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L23217

27688- \`JSON.parse()\` on untrusted input without schema validation. L27689: - \`eval()\` or \`new Function()\` with user-controlled strings. L27690: - Unsafe YAML or XML parsing.

High

Eval

Package source references dynamic code evaluation.

dist/index.jsView on unpkg · L27688

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: function readLineBreak(state) { readLineBreak(state); readLineBreak(state); readLineBreak(state); import { existsSync as existsSync41, mkdirSync as mkdirSync17, readFileSync as readFileSync37, unlinkSync as unlinkSync9, writeFileSync as writeFileSync20 } from "fs"; writeFileSync20(filePath, content, "utf-8"); agent-browser open api.example.com --headers '{"Authorization": "Bearer <token>"}' - **World baseURL**: The generated \`world.ts\` MUST set \`baseURL: process.env.BDD_BASE_URL || 'http://localhost:4000'\` in \`browser.newContext()\` so \`page.goto('/login')\` res...

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

106var init_js_yaml = __esm(() => { L107: /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */ L108: __create2 = Object.create; ... L536: for (;index < max; index++) { L537: if (!isHexCode(data.charCodeAt(index))) L538: return false; ... L2846: if (!match) { L2847: return { data: {}, body: content, hadFrontmatter: false, parseError: false }; L2848: } ... L3025: } L3026: if (typeof process !== "undefined" && process.platform) { L3027: return process.platform === "win32";

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.jsView on unpkg · L106

106var init_js_yaml = __esm(() => { L107: /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */ L108: __create2 = Object.create; ... L536: for (;index < max; index++) { L537: if (!isHexCode(data.charCodeAt(index))) L538: return false; ... L2846: if (!match) { L2847: return { data: {}, body: content, hadFrontmatter: false, parseError: false }; L2848: } ... L3025: } L3026: if (typeof process !== "undefined" && process.platform) { L3027: return process.platform === "win32";

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L106

26256- **TypeScript loader**: Add \`{ module: ['tsx/esm'] }\` to \`requireModule\` so \`tsx\` transpiles \`.ts\` files on import. L26257: - **World baseURL**: The generated \`world.ts\` MUST set \`baseURL: process.env.BDD_BASE_URL || 'http://localhost:4000'\` in \`browser.newContext()\` so \`page.goto('/login')\` res... L26258: ... L27683: * **CWE-78 Command Injection**: L27684: - \`exec()\`, \`spawn()\`, or \`execSync()\` with unsanitized user input. L27685: - \`child_process\` usage without strict argument separation. ... L44904: try { L44905: const content = readFileSync(cacheFile, "utf-8"); L44906: const data = JSON.parse(content); ... L103727: ### Phase 2: Automated Scanning L103728: Run available tools in order. If a tool is not installed, note it and continue with the next. L103

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L26256

106Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js L106: var init_js_yaml = __esm(() => { L107: /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */ L108: __create2 = Object.create; ... L536: for (;index < max; index++) { L537: if (!isHexCode(data.charCodeAt(index))) L538: return false; ... L2846: if (!match) { L2847: return { data: {}, body: content, hadFrontmatter: false, parseError: false }; L2848: } ... L3025: } L3026: if (typeof process !== "undefined" && process.platform) { L3027: return process.platform === "win32";

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/index.jsView on unpkg · L106

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = opencode-matrixx@2.6.8 matchedPath = dist/index.js matchedIdentity = npm:b3BlbmNvZGUtbWF0cml4eA:2.6.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg