opencode-orchestrator@1.7.11: Suspicious npm security report | LPM Firewall

Loading npm security reports…

opencode-orchestrator@1.7.11: Suspicious npm security report | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/run-install-hook.mjs postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/run-install-hook.mjs postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/index.js: To maintain a scalable and maintainable codebase, follow these structural principles regardless of the programming language: Finalize only when ALL of the following are true: - NEVER skip error handling \u2192 Follow project's error handling patterns - NEVER use weak types \u2192 Follow project's type safety conventions Remember: OBSERVE how existing code handles these, then FOLLOW those patterns. - Follow error handling style used in similar files ## Phase 4: IMPLEMENT (Following discoveries) 7. Write code following OBSERVED patterns

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/index.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = opencode-orchestrator@1.7.8 matchedIdentity = npm:b3BlbmNvZGUtb3JjaGVzdHJhdG9y:1.7.8 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

5967*/ L5968: import(snapshot) { L5969: this.storage = snapshot;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L5967

bin/orchestrator-macos-arm64View file

•path = bin/orchestrator-macos-arm64 kind = native_binary sizeBytes = 4558688 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/orchestrator-macos-arm64View on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 40-80json

40 "README.md",

41 "LICENSE",

42 "opencode-orchestrator.schema.json"

43 ],

44 "scripts": {

45 "docker:build-all": "docker compose run --rm dev && docker compose run --rm rust-arm64 && docker compose run --rm win-builder",

46 "docker:build-win": "docker compose run --rm win-builder",

47 "docker:rust-dist": "docker compose run --rm dev && docker compose run --rm rust-arm64 && (sudo chown -R $(id -u):$(id -g) bin/ 2>/dev/null || true)",

48 "docker:test": "docker compose run --rm test",

49 "docker:clean": "docker compose down -v",

50 "sync:landing": "node scripts/sync-landing.mjs",

51 "prebuild": "node scripts/sync-landing.mjs",

52 "build": "node scripts/build.mjs",

53 "gen:schema": "esbuild scripts/gen-schema.ts --bundle --platform=node --format=esm --outfile=node_modules/.cache/gen-schema.mjs && node node_modules/.cache/gen-schema.mjs",

54 "build:all": "npm run build && npm run docker:rust-dist",

55 "test": "vitest run --reporter=verbose",

56 "test:coverage": "vitest run --coverage",

57 "test:unit": "vitest run tests/unit --reporter=verbose",

58 "test:e2e": "vitest run tests/e2e --reporter=verbose",

59 "test:all": "npm run build && vitest run --reporter=verbose && echo '=== ALL TESTS PASSED ==='",

60 "postinstall": "node scripts/run-install-hook.mjs postinstall",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L60

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L60

61 "cleanup:plugin": "node scripts/run-install-hook.mjs preuninstall",

62 "prepublishOnly": "npm run build",

63 "publish:token": "npm publish --access public",

64 "sync:readme-version": "node scripts/sync-readme-version.mjs",

65 "version": "node scripts/sync-readme-version.mjs --stage",

66 "release:preflight": "node scripts/release-preflight.mjs",

67 "release:patch": "node scripts/release-auth-check.mjs && node scripts/release-version.mjs patch && npm run release:preflight && npm run docker:rust-dist && node scripts/release-sync-artifacts.mjs && npm run publish:token",

68 "release:minor": "node scripts/release-auth-check.mjs && node scripts/release-version.mjs minor && npm run release:preflight && npm run docker:rust-dist && node scripts/release-sync-artifacts.mjs && npm run publish:token",

69 "release:major": "node scripts/release-auth-check.mjs && node scripts/release-version.mjs major && npm run release:preflight && npm run docker:rust-dist && node scripts/release-sync-artifacts.mjs && npm run publish:token",

70 "release:dry-run": "node scripts/release-preflight.mjs --allow-dirty --skip-branch --skip-version-check",

71 "release:push-tags": "git push origin main && git push origin --tags",

72 "release:clean": "shx rm -rf dist bin && docker compose down -v",

73 "reset:local": "brew uninstall opencode 2>/dev/null; rm -rf ~/.config/opencode ~/.opencode ~/.local/share/opencode ~/.cache/opencode/node_modules/opencode-orchestrator && echo '=== Clean done ===' && brew install opencode && echo '{\"plugin\": [\"opencode-orchestrator\"], \"$schema\": \"https://opencode.ai/config.json\"}' > ~/.config/opencode/opencode.json && echo '=== Reset (Dev) complete. Run: opencode ==='",

74 "reset:prod": "brew uninstall opencode 2>/dev/null; rm -rf ~/.config/opencode ~/.opencode ~/.local/share/opencode ~/.cache/opencode/node_modules/opencode-orchestrator && echo '=== Clean done ===' && brew install opencode && echo '{\"plugin\": [\"opencode-orchestrator\"], \"$schema\": \"https://opencode.ai/config.json\"}' > ~/.config/opencode/opencode.json && npm run cleanup:plugin && npm uninstall -g opencode-orchestrator && echo '=== Reset (Prod) complete. Run: opencode ==='",

75 "ginstall": "npm install -g opencode-orchestrator",

76 "log": "tail -f \"$(node -e 'console.log(require(\"os\").tmpdir())')/opencode-orchestrator.log\""

77 },

78 "engines": {

79 "node": ">=24"

80 },

dist/index.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/index.js: To maintain a scalable and maintainable codebase, follow these structural principles regardless of the programming language: Finalize only when ALL of the following are true: - NEVER skip error handling \u2192 Follow project's error handling patterns - NEVER use weak types \u2192 Follow project's type safety conventions Remember: OBSERVE how existing code handles these, then FOLLOW those patterns. - Follow error handling style used in similar files ## Phase 4: IMPLEMENT (Following discoveries) 7. Write code following OBSERVED patterns

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/index.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = opencode-orchestrator@1.7.8 matchedIdentity = npm:b3BlbmNvZGUtb3JjaGVzdHJhdG9y:1.7.8 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

5967*/ L5968: import(snapshot) { L5969: this.storage = snapshot;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L5967

bin/orchestrator-macos-arm64View file

•path = bin/orchestrator-macos-arm64 kind = native_binary sizeBytes = 4558688 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/orchestrator-macos-arm64View on unpkg