registry / opencode-orchestrator / 1.7.2

opencode-orchestrator@1.7.2

Multi-agent mission control for OpenCode with Commander, Planner, Worker, and Reviewer workflows.

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 576 KB of source, external domains: api.duckduckgo.com, github.com, grep.app, html.duckduckgo.com, nextjs.org, opencode.ai, paulgo.io, react.dev, search.brave.com, search.bus-hit.me, searxng.site

Source & flagged code

4 flagged

package.jsonView file

Lines 40-80json

40 "README.md",

41 "LICENSE",

42 "opencode-orchestrator.schema.json"

43 ],

44 "scripts": {

45 "docker:build-all": "docker compose run --rm dev && docker compose run --rm rust-arm64 && docker compose run --rm win-builder",

46 "docker:build-win": "docker compose run --rm win-builder",

47 "docker:rust-dist": "docker compose run --rm dev && docker compose run --rm rust-arm64 && (sudo chown -R $(id -u):$(id -g) bin/ 2>/dev/null || true)",

48 "docker:test": "docker compose run --rm test",

49 "docker:clean": "docker compose down -v",

50 "sync:landing": "node scripts/sync-landing.mjs",

51 "prebuild": "node scripts/sync-landing.mjs",

52 "build": "node scripts/build.mjs",

53 "gen:schema": "esbuild scripts/gen-schema.ts --bundle --platform=node --format=esm --outfile=node_modules/.cache/gen-schema.mjs && node node_modules/.cache/gen-schema.mjs",

54 "build:all": "npm run build && npm run docker:rust-dist",

55 "test": "vitest run --reporter=verbose",

56 "test:coverage": "vitest run --coverage",

57 "test:unit": "vitest run tests/unit --reporter=verbose",

58 "test:e2e": "vitest run tests/e2e --reporter=verbose",

59 "test:all": "npm run build && vitest run --reporter=verbose && echo '=== ALL TESTS PASSED ==='",

60 "postinstall": "node scripts/run-install-hook.mjs postinstall",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L60

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L60

61 "cleanup:plugin": "node scripts/run-install-hook.mjs preuninstall",

62 "prepublishOnly": "npm run build",

63 "publish:token": "npm publish --access public",

64 "sync:readme-version": "node scripts/sync-readme-version.mjs",

65 "version": "node scripts/sync-readme-version.mjs --stage",

66 "release:preflight": "node scripts/release-preflight.mjs",

67 "release:patch": "node scripts/release-auth-check.mjs && node scripts/release-version.mjs patch && npm run release:preflight && npm run docker:rust-dist && node scripts/release-sync-artifacts.mjs && npm run publish:token",

68 "release:minor": "node scripts/release-auth-check.mjs && node scripts/release-version.mjs minor && npm run release:preflight && npm run docker:rust-dist && node scripts/release-sync-artifacts.mjs && npm run publish:token",

69 "release:major": "node scripts/release-auth-check.mjs && node scripts/release-version.mjs major && npm run release:preflight && npm run docker:rust-dist && node scripts/release-sync-artifacts.mjs && npm run publish:token",

70 "release:dry-run": "node scripts/release-preflight.mjs --allow-dirty --skip-branch --skip-version-check",

71 "release:push-tags": "git push origin main && git push origin --tags",

72 "release:clean": "shx rm -rf dist bin && docker compose down -v",

73 "reset:local": "brew uninstall opencode 2>/dev/null; rm -rf ~/.config/opencode ~/.opencode ~/.local/share/opencode ~/.cache/opencode/node_modules/opencode-orchestrator && echo '=== Clean done ===' && brew install opencode && echo '{\"plugin\": [\"opencode-orchestrator\"], \"$schema\": \"https://opencode.ai/config.json\"}' > ~/.config/opencode/opencode.json && echo '=== Reset (Dev) complete. Run: opencode ==='",

74 "reset:prod": "brew uninstall opencode 2>/dev/null; rm -rf ~/.config/opencode ~/.opencode ~/.local/share/opencode ~/.cache/opencode/node_modules/opencode-orchestrator && echo '=== Clean done ===' && brew install opencode && echo '{\"plugin\": [\"opencode-orchestrator\"], \"$schema\": \"https://opencode.ai/config.json\"}' > ~/.config/opencode/opencode.json && npm run cleanup:plugin && npm uninstall -g opencode-orchestrator && echo '=== Reset (Prod) complete. Run: opencode ==='",

75 "ginstall": "npm install -g opencode-orchestrator",

76 "log": "tail -f \"$(node -e 'console.log(require(\"os\").tmpdir())')/opencode-orchestrator.log\""

77 },

78 "engines": {

79 "node": ">=24"

80 },

dist/index.jsView file

6230*/ L6231: import(snapshot) { L6232: this.storage = snapshot;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L6230

bin/orchestrator-macos-arm64View file

•path = bin/orchestrator-macos-arm64 kind = native_binary sizeBytes = 4153232 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/orchestrator-macos-arm64View on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/run-install-hook.mjs postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/run-install-hook.mjs postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

6230*/ L6231: import(snapshot) { L6232: this.storage = snapshot;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L6230

bin/orchestrator-macos-arm64View file

•path = bin/orchestrator-macos-arm64 kind = native_binary sizeBytes = 4153232 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/orchestrator-macos-arm64View on unpkg

Findings

1 High6 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/index.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarybin/orchestrator-macos-arm64

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

package.jsonView file

Lines 40-80json

40 "README.md",

41 "LICENSE",

42 "opencode-orchestrator.schema.json"

43 ],

44 "scripts": {

45 "docker:build-all": "docker compose run --rm dev && docker compose run --rm rust-arm64 && docker compose run --rm win-builder",

46 "docker:build-win": "docker compose run --rm win-builder",

47 "docker:rust-dist": "docker compose run --rm dev && docker compose run --rm rust-arm64 && (sudo chown -R $(id -u):$(id -g) bin/ 2>/dev/null || true)",

48 "docker:test": "docker compose run --rm test",

49 "docker:clean": "docker compose down -v",

50 "sync:landing": "node scripts/sync-landing.mjs",

51 "prebuild": "node scripts/sync-landing.mjs",

52 "build": "node scripts/build.mjs",

53 "gen:schema": "esbuild scripts/gen-schema.ts --bundle --platform=node --format=esm --outfile=node_modules/.cache/gen-schema.mjs && node node_modules/.cache/gen-schema.mjs",

54 "build:all": "npm run build && npm run docker:rust-dist",

55 "test": "vitest run --reporter=verbose",

56 "test:coverage": "vitest run --coverage",

57 "test:unit": "vitest run tests/unit --reporter=verbose",

58 "test:e2e": "vitest run tests/e2e --reporter=verbose",

59 "test:all": "npm run build && vitest run --reporter=verbose && echo '=== ALL TESTS PASSED ==='",

60 "postinstall": "node scripts/run-install-hook.mjs postinstall",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L60

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L60

61 "cleanup:plugin": "node scripts/run-install-hook.mjs preuninstall",

62 "prepublishOnly": "npm run build",

63 "publish:token": "npm publish --access public",

64 "sync:readme-version": "node scripts/sync-readme-version.mjs",

65 "version": "node scripts/sync-readme-version.mjs --stage",

66 "release:preflight": "node scripts/release-preflight.mjs",

70 "release:dry-run": "node scripts/release-preflight.mjs --allow-dirty --skip-branch --skip-version-check",

71 "release:push-tags": "git push origin main && git push origin --tags",

72 "release:clean": "shx rm -rf dist bin && docker compose down -v",

75 "ginstall": "npm install -g opencode-orchestrator",

76 "log": "tail -f \"$(node -e 'console.log(require(\"os\").tmpdir())')/opencode-orchestrator.log\""

77 },

78 "engines": {

79 "node": ">=24"

80 },

dist/index.jsView file

6230*/ L6231: import(snapshot) { L6232: this.storage = snapshot;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L6230

bin/orchestrator-macos-arm64View file

•path = bin/orchestrator-macos-arm64 kind = native_binary sizeBytes = 4153232 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/orchestrator-macos-arm64View on unpkg