Loading npm security reports…

opencode-memd@0.2.0: AI-agent control-surface risk | LPM Firewall

registry / opencode-memd / 0.2.0

opencode-memd@0.2.0

Claude Code-style persistent memory for OpenCode — plain markdown, no vector DB

AI Security Review

scanned 28d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On package installation, the lifecycle hook writes executable tool files into the user-wide OpenCode tools directory. Those tools extend an AI agent with persistent-memory read, write, search, and deletion capabilities.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation of the package invokes postinstall.

Impact

Unconsented user-wide AI-agent control-surface mutation and durable memory-file manipulation.

Mechanism

Automatic copying of agent-callable tools into the OpenCode configuration directory.

Policy narrative

Installing the package automatically runs postinstall. It creates the user-wide OpenCode tools directory and copies every bundled TypeScript tool into it, making capabilities available beyond the installed package directory without an explicit setup command. The copied tools can create or overwrite persistent global and project memory files. No network theft or remote payload behavior was found, but the unconsented lifecycle mutation of a broad AI-agent control surface meets the blocking policy.

AI rationale

The automatic postinstall hook mutates a user-wide OpenCode tool control surface by installing agent-callable code. This is a concrete install-hook abuse despite the absence of network exfiltration.

Evidence

package.jsonpostinstall.mjstools/memory_write.tstools/*.ts~/.config/opencode/tools/*.ts~/.config/opencode/memory/

Decision evidence

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

10"scripts": { "install-plugin": "bash install.sh", "postinstall": "node postinstall.mjs" }

High

Suspicious Lifecycle Evidence

The package declares an automatic postinstall lifecycle hook.

package.jsonView on unpkg · L10

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 889 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

src/storage.ts#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/storage.ts#virtual:normalized:round1View on unpkg

postinstall.mjsView file

15const configDir = process.env.XDG_CONFIG_HOME || join(homedir(), ".config") const toolsDest = join(configDir, "opencode", "tools") mkdirSync(toolsDest, { recursive: true }) const files = readdirSync(toolsSrc).filter(f => f.endsWith(".ts")) for (const file of files) { copyFileSync(join(toolsSrc, file), join(toolsDest, file)) }

High

Ai Review Evidence

That hook creates the user-wide OpenCode tools directory and copies every shipped TypeScript tool into it without an explicit user command.

postinstall.mjsView on unpkg · L15

tools/memory_write.tsView file

21const base = join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "opencode", "memory") if (scope === "global") return join(base, "global")

High

Ai Review Evidence

The tool maps global-scope memory to the user's OpenCode configuration directory.

tools/memory_write.tsView on unpkg · L21

Source & flagged code

7 flagged

package.jsonView file

Lines 1-19json

1{

2 "name": "opencode-memd",

3 "version": "0.2.0",

4 "description": "Claude Code-style persistent memory for OpenCode — plain markdown, no vector DB",

5 "type": "module",

6 "main": "src/index.ts",

7 "dependencies": {

8 "@opencode-ai/plugin": "^1.18.30"

9 },

10 "scripts": {

11 "install-plugin": "bash install.sh",

12 "postinstall": "node postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L12

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L12

13 },

High

Suspicious Lifecycle Evidence

The package declares an automatic postinstall lifecycle hook.

package.jsonView on unpkg · L10

14 "files": ["src/", "tools/", "install.sh", "postinstall.mjs"],

15 "devDependencies": {

16 "@types/node": "^22"

17 }

18}

19

install.shView file

•path = install.sh kind = build_helper sizeBytes = 889 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

src/storage.ts#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/storage.ts#virtual:normalized:round1View on unpkg

postinstall.mjsView file

Lines 1-28javascript

1// Automatically copies tool files to ~/.config/opencode/tools/

2// Runs after `bun install` so npm-based plugin installs get tools too.

3

4import { existsSync, mkdirSync, copyFileSync, readdirSync } from "fs"

5import { join, dirname } from "path"

6import { homedir } from "os"

7import

tools/memory_write.tsView file

Lines 1-41typescript

1import { tool } from "@opencode-ai/plugin"

2import { createHash } from "crypto"

3import { existsSync, readFileSync, writeFileSync, mkdirSync } from "fs"

4import { join, resolve } from "path"

5import { execSync }