registry / opencode-matrixx / 2.6.3

opencode-matrixx@2.6.3

The Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools

AI Security Review

scanned 26d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. When loaded as an OpenCode plugin, it can automatically replace and reinstall its own plugin package after a session starts. It also executes shell fragments embedded in command-template text and downloads executable helper binaries.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Loading the plugin and creating an OpenCode session; using a command template containing !`...`; or activating helper tools that need a missing binary.

Impact

A package update or untrusted command-template content can cause code execution in the user's OpenCode environment and modify the plugin installation.

Mechanism

Automatic plugin update, command-template shell execution, and remote helper-binary installation.

AI rationale

The package exposes dangerous runtime capabilities and an automatic first-party extension updater, so it warrants a warning. Static inspection did not establish malicious install-time behavior or credential theft.

Evidence

dist/index.jsOpenCode configuration directory/package.jsonOpenCode configuration directory/bun.lockOpenCode configuration directory/node_modules/opencode-matrixx~/.cache/matrixx/bin

Network endpoints2

registry.npmjs.org/-/package/opencode-matrixx/dist-tagsgithub.com/code-yeongyu/go-claude-code-comment-checker/releases/download/

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Command templates execute embedded shell commands without an approval check.
A session-created hook enables automatic self-update by default, removes its installed package, and runs Bun install.
The package downloads executable archives from GitHub, extracts them, and marks binaries executable without source verification.

Evidence against

package.json has no install, preinstall, or postinstall lifecycle hook.
The examined API-key uses configure named MCP providers; no fixed unrelated credential collection endpoint was found.
The updater operates on this plugin's own OpenCode installation rather than an npm install-time foreign control surface.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 944 KB of source, external domains: 127.0.0.1, astral.sh, bun.sh, git-scm.com, json-schema.org, mcp.context7.com, mcp.exa.ai, mcp.grep.app, mcp.tavily.com, opencode.ai, raw.githubusercontent.com, zod.dev

Oversized source lightweight scan

dist/index.js3.54 MB file, sampled 256 KB

FilesystemEnvironmentVarsHighEntropyStringsUrlStringsastral.shmcp.context7.commcp.exa.aimcp.grep.appmcp.tavily.comzod.dev

Source & flagged code

10 flagged

dist/index.jsView file

106var init_js_yaml = __esm(() => { L107: /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */ L108: __create2 = Object.create; ... L536: for (;index < max; index++) { L537: if (!isHexCode(data.charCodeAt(index))) L538: return false; ... L2846: if (!match) { L2847: return { data: {}, body: content, hadFrontmatter: false, parseError: false }; L2848: } ... L3025: } L3026: if (typeof process !== "undefined" && process.platform) { L3027: return process.platform === "win32";

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L106

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.jsView on unpkg · L106

106Trigger-reachable chain: manifest.main -> dist/index.js L106: var init_js_yaml = __esm(() => { L107: /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */ L108: __create2 = Object.create; ... L536: for (;index < max; index++) { L537: if (!isHexCode(data.charCodeAt(index))) L538: return false; ... L2846: if (!match) { L2847: return { data: {}, body: content, hadFrontmatter: false, parseError: false }; L2848: } ... L3025: } L3026: if (typeof process !== "undefined" && process.platform) { L3027: return process.platform === "win32";

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L106

27683* **CWE-78 Command Injection**: L27684: - \`exec()\`, \`spawn()\`, or \`execSync()\` with unsanitized user input. L27685: - \`child_process\` usage without strict argument separation.

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L27683

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: function readLineBreak(state) { readLineBreak(state); readLineBreak(state); readLineBreak(state); import { existsSync as existsSync34, mkdirSync as mkdirSync13, readFileSync as readFileSync28, unlinkSync as unlinkSync7, writeFileSync as writeFileSync15 } from "fs"; writeFileSync15(filePath, content, "utf-8"); agent-browser open api.example.com --headers '{"Authorization": "Bearer <token>"}' - **World baseURL**: The generated \`world.ts\` MUST set \`baseURL: process.env.BDD_BASE_URL || 'http://localhost:4000'\` in \`browser.newContext()\` so \`page.goto('/login')\` res...

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.jsView on unpkg · L106

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L106

26256- **TypeScript loader**: Add \`{ module: ['tsx/esm'] }\` to \`requireModule\` so \`tsx\` transpiles \`.ts\` files on import. L26257: - **World baseURL**: The generated \`world.ts\` MUST set \`baseURL: process.env.BDD_BASE_URL || 'http://localhost:4000'\` in \`browser.newContext()\` so \`page.goto('/login')\` res... L26258: ... L27683: * **CWE-78 Command Injection**: L27684: - \`exec()\`, \`spawn()\`, or \`execSync()\` with unsanitized user input. L27685: - \`child_process\` usage without strict argument separation. ... L30554: try { L30555: const content = readFileSync(cacheFile, "utf-8"); L30556: const data = JSON.parse(content); ... L98649: ### Phase 2: Automated Scanning L98650: Run available tools in order. If a tool is not installed, note it and continue with the next. L98651

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L26256

106Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js L106: var init_js_yaml = __esm(() => { L107: /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */ L108: __create2 = Object.create; ... L536: for (;index < max; index++) { L537: if (!isHexCode(data.charCodeAt(index))) L538: return false; ... L2846: if (!match) { L2847: return { data: {}, body: content, hadFrontmatter: false, parseError: false }; L2848: } ... L3025: } L3026: if (typeof process !== "undefined" && process.platform) { L3027: return process.platform === "win32";

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/index.jsView on unpkg · L106

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.jsView on unpkg

Source & flagged code

10 flagged · loading source

dist/index.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L106

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.jsView on unpkg · L106

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L106

27683* **CWE-78 Command Injection**: L27684: - \`exec()\`, \`spawn()\`, or \`execSync()\` with unsanitized user input. L27685: - \`child_process\` usage without strict argument separation.

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L27683

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.jsView on unpkg · L106

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L106

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L26256

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/index.jsView on unpkg · L106

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.jsView on unpkg

Findings

3 Critical7 High2 Medium5 Low

CriticalCredential Exfiltrationdist/index.js

CriticalDownload Executedist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighChild Processdist/index.js

HighCredential Redirect Persistencedist/index.js

HighCloud Metadata Accessdist/index.js

HighObfuscated Payload Loaderdist/index.js

HighRemote Agent Bridgedist/index.js

HighTrigger Reachable Credential Exfiltrationdist/index.js

HighSemantic Analysis Limiteddist/index.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to opencode-matrixx@2.6.3.

See version security history for other recorded verdicts.

Review the evidence and your use of opencode-matrixx@2.6.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-12 19:06:55.722Z (UTC).

91%Suspicious

AI assessment confidence

IntentDangerous Capability

TypeAgent extension lifecycle risk

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn-only agent extension risk

Package metadata

npm

Authorklpanagi

Maintainersklpanagi

Version2.6.3

Latest on npm2.6.16

PublishedSep 9, 2026

LicenseSUL-1.0

Dependencies13

Integrityverified

Package size1.11 MB

Files965

Keywordsopencodeopencode-pluginclaudeclaude-codeanthropicopenaigeminiai

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → dist/index.jstypes → dist/index.d.tsexports mapbin → matrixx, opencode-matrixx

RuntimeNo engine / OS / CPU constraints

Artifact5.26 MB · 965 files2 signature(s) · provenance

Install lifecycleprepublishOnly

Behavioral surface

ChildProcessEnvironmentVarsFilesystemHighEntropyStringsUrlStringsManifest: clean