Loading npm security reports…

opencode-matrixx@2.6.8: Malicious npm security report (Block) | LPM Firewall

registry / opencode-matrixx / 2.6.8

opencode-matrixx@2.6.8

The Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools

AI Security Review

scanned 22d ago · by lpm-firewall-ai

When loaded as an OpenCode plugin, it installs restrictive package-authored agent prompts and can make Morpheus the default agent. Its enabled-by-default update hook removes package metadata and runs Bun install in the OpenCode configuration directory.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Loading the plugin and receiving an OpenCode event while automatic updates are not disabled.

Impact

User requests can be redirected to package-imposed planning behavior, and the host OpenCode configuration dependency state can be changed automatically.

Mechanism

Agent-control replacement plus automatic dependency mutation and package installation.

Attack narrative

The runtime plugin installs its own agent configuration, sets Morpheus as the default when none exists, and embeds instructions that reinterpret all implementation requests as planning requests. Separately, its event hook defaults automatic updates to enabled. On a version change it removes its package and dependency records from the OpenCode configuration directory and runs Bun install. Remote MCP configuration also forwards configured API credentials to external MCP services.

AI rationale

This is malicious agent-control behavior combined with unconsented automatic mutation of the host configuration and dependency environment. The lack of an npm install lifecycle hook does not neutralize the runtime update and control-hijacking path.

Evidence

dist/index.jsopencode.jsonopencode.jsoncpackage.jsonbun.locknode_modules/opencode-matrixx

Network endpoints5

Source & flagged code

10 flagged · loading source

dist/index.jsView file

106var init_js_yaml = __esm(() => { L107: /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */ L108: __create2 = Object.create; ... L536: for (;index < max; index++) { L537: if (!isHexCode(data.charCodeAt(index))) L538: return false; ... L2846: if (!match) { L2847: return { data: {}, body: content, hadFrontmatter: false, parseError: false }; L2848: } ... L3025: } L3026: if (typeof process !== "undefined" && process.platform) { L3027: return process.platform === "win32";

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L106

106var init_js_yaml = __esm(() => { L107: /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */ L108: __create2 = Object.create; ... L536: for (;index < max; index++) { L537: if (!isHexCode(data.charCodeAt(index))) L538: return false; ... L2846: if (!match) { L2847: return { data: {}, body: content, hadFrontmatter: false, parseError: false }; L2848: } ... L3025: } L3026: if (typeof process !== "undefined" && process.platform) { L3027: return process.platform === "win32";

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.jsView on unpkg · L106

106Trigger-reachable chain: manifest.main -> dist/index.js L106: var init_js_yaml = __esm(() => { L107: /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */ L108: __create2 = Object.create; ... L536: for (;index < max; index++) { L537: if (!isHexCode(data.charCodeAt(index))) L538: return false; ... L2846: if (!match) { L2847: return { data: {}, body: content, hadFrontmatter: false, parseError: false }; L2848: } ... L3025: } L3026: if (typeof process !== "undefined" && process.platform) { L3027: return process.platform === "win32";

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L106

27683* **CWE-78 Command Injection**: L27684: - \`exec()\`, \`spawn()\`, or \`execSync()\` with unsanitized user input. L27685: - \`child_process\` usage without strict argument separation.

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L27683

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: function readLineBreak(state) { readLineBreak(state); readLineBreak(state); readLineBreak(state); import { existsSync as existsSync35, mkdirSync as mkdirSync13, readFileSync as readFileSync28, unlinkSync as unlinkSync7, writeFileSync as writeFileSync15 } from "fs"; writeFileSync15(filePath, content, "utf-8"); agent-browser open api.example.com --headers '{"Authorization": "Bearer <token>"}' - **World baseURL**: The generated \`world.ts\` MUST set \`baseURL: process.env.BDD_BASE_URL || 'http://localhost:4000'\` in \`browser.newContext()\` so \`page.goto('/login')\` res...

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

106var init_js_yaml = __esm(() => { L107: /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */ L108: __create2 = Object.create; ... L536: for (;index < max; index++) { L537: if (!isHexCode(data.charCodeAt(index))) L538: return false; ... L2846: if (!match) { L2847: return { data: {}, body: content, hadFrontmatter: false, parseError: false }; L2848: } ... L3025: } L3026: if (typeof process !== "undefined" && process.platform) { L3027: return process.platform === "win32";

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.jsView on unpkg · L106

106var init_js_yaml = __esm(() => { L107: /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */ L108: __create2 = Object.create; ... L536: for (;index < max; index++) { L537: if (!isHexCode(data.charCodeAt(index))) L538: return false; ... L2846: if (!match) { L2847: return { data: {}, body: content, hadFrontmatter: false, parseError: false }; L2848: } ... L3025: } L3026: if (typeof process !== "undefined" && process.platform) { L3027: return process.platform === "win32";

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L106

26256- **TypeScript loader**: Add \`{ module: ['tsx/esm'] }\` to \`requireModule\` so \`tsx\` transpiles \`.ts\` files on import. L26257: - **World baseURL**: The generated \`world.ts\` MUST set \`baseURL: process.env.BDD_BASE_URL || 'http://localhost:4000'\` in \`browser.newContext()\` so \`page.goto('/login')\` res... L26258: ... L27683: * **CWE-78 Command Injection**: L27684: - \`exec()\`, \`spawn()\`, or \`execSync()\` with unsanitized user input. L27685: - \`child_process\` usage without strict argument separation. ... L44904: try { L44905: const content = readFileSync(cacheFile, "utf-8"); L44906: const data = JSON.parse(content); ... L100906: ### Phase 2: Automated Scanning L100907: Run available tools in order. If a tool is not installed, note it and continue with the next. L100

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L26256

106Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js L106: var init_js_yaml = __esm(() => { L107: /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */ L108: __create2 = Object.create; ... L536: for (;index < max; index++) { L537: if (!isHexCode(data.charCodeAt(index))) L538: return false; ... L2846: if (!match) { L2847: return { data: {}, body: content, hadFrontmatter: false, parseError: false }; L2848: } ... L3025: } L3026: if (typeof process !== "undefined" && process.platform) { L3027: return process.platform === "win32";

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/index.jsView on unpkg · L106

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.jsView on unpkg

Source & flagged code

10 flagged

dist/index.jsView file

106var init_js_yaml = __esm(() => { L107: /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */ L108: __create2 = Object.create; ... L536: for (;index < max; index++) { L537: if (!isHexCode(data.charCodeAt(index))) L538: return false; ... L2846: if (!match) { L2847: return { data: {}, body: content, hadFrontmatter: false, parseError: false }; L2848: } ... L3025: } L3026: if (typeof process !== "undefined" && process.platform) { L3027: return process.platform === "win32";

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L106

106var init_js_yaml = __esm(() => { L107: /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */ L108: __create2 = Object.create; ... L536: for (;index < max; index++) { L537: if (!isHexCode(data.charCodeAt(index))) L538: return false; ... L2846: if (!match) { L2847: return { data: {}, body: content, hadFrontmatter: false, parseError: false }; L2848: } ... L3025: } L3026: if (typeof process !== "undefined" && process.platform) { L3027: return process.platform === "win32";

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.jsView on unpkg · L106

106Trigger-reachable chain: manifest.main -> dist/index.js L106: var init_js_yaml = __esm(() => { L107: /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */ L108: __create2 = Object.create; ... L536: for (;index < max; index++) { L537: if (!isHexCode(data.charCodeAt(index))) L538: return false; ... L2846: if (!match) { L2847: return { data: {}, body: content, hadFrontmatter: false, parseError: false }; L2848: } ... L3025: } L3026: if (typeof process !== "undefined" && process.platform) { L3027: return process.platform === "win32";

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L106

27683* **CWE-78 Command Injection**: L27684: - \`exec()\`, \`spawn()\`, or \`execSync()\` with unsanitized user input. L27685: - \`child_process\` usage without strict argument separation.

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L27683

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: function readLineBreak(state) { readLineBreak(state); readLineBreak(state); readLineBreak(state); import { existsSync as existsSync35, mkdirSync as mkdirSync13, readFileSync as readFileSync28, unlinkSync as unlinkSync7, writeFileSync as writeFileSync15 } from "fs"; writeFileSync15(filePath, content, "utf-8"); agent-browser open api.example.com --headers '{"Authorization": "Bearer <token>"}' - **World baseURL**: The generated \`world.ts\` MUST set \`baseURL: process.env.BDD_BASE_URL || 'http://localhost:4000'\` in \`browser.newContext()\` so \`page.goto('/login')\` res...

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

106var init_js_yaml = __esm(() => { L107: /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */ L108: __create2 = Object.create; ... L536: for (;index < max; index++) { L537: if (!isHexCode(data.charCodeAt(index))) L538: return false; ... L2846: if (!match) { L2847: return { data: {}, body: content, hadFrontmatter: false, parseError: false }; L2848: } ... L3025: } L3026: if (typeof process !== "undefined" && process.platform) { L3027: return process.platform === "win32";

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.jsView on unpkg · L106

106var init_js_yaml = __esm(() => { L107: /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */ L108: __create2 = Object.create; ... L536: for (;index < max; index++) { L537: if (!isHexCode(data.charCodeAt(index))) L538: return false; ... L2846: if (!match) { L2847: return { data: {}, body: content, hadFrontmatter: false, parseError: false }; L2848: } ... L3025: } L3026: if (typeof process !== "undefined" && process.platform) { L3027: return process.platform === "win32";

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L106

26256- **TypeScript loader**: Add \`{ module: ['tsx/esm'] }\` to \`requireModule\` so \`tsx\` transpiles \`.ts\` files on import. L26257: - **World baseURL**: The generated \`world.ts\` MUST set \`baseURL: process.env.BDD_BASE_URL || 'http://localhost:4000'\` in \`browser.newContext()\` so \`page.goto('/login')\` res... L26258: ... L27683: * **CWE-78 Command Injection**: L27684: - \`exec()\`, \`spawn()\`, or \`execSync()\` with unsanitized user input. L27685: - \`child_process\` usage without strict argument separation. ... L44904: try { L44905: const content = readFileSync(cacheFile, "utf-8"); L44906: const data = JSON.parse(content); ... L100906: ### Phase 2: Automated Scanning L100907: Run available tools in order. If a tool is not installed, note it and continue with the next. L100

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L26256

106Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js L106: var init_js_yaml = __esm(() => { L107: /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */ L108: __create2 = Object.create; ... L536: for (;index < max; index++) { L537: if (!isHexCode(data.charCodeAt(index))) L538: return false; ... L2846: if (!match) { L2847: return { data: {}, body: content, hadFrontmatter: false, parseError: false }; L2848: } ... L3025: } L3026: if (typeof process !== "undefined" && process.platform) { L3027: return process.platform === "win32";

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/index.jsView on unpkg · L106

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.jsView on unpkg