registry / opencode-rpc / 2.0.0

opencode-rpc@2.0.0

Discord Rich Presence for [OpenCode](https://opencode.ai). works on both opencode 1.x.x and 2.x.x.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. An npm postinstall hook modifies OpenCode's plugin control configuration without an explicit user command. It can target the user's home OpenCode configuration.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package with npm lifecycle scripts enabled.

Impact

The package gains automatic loading by an AI-agent host through a user or global configuration file.

Mechanism

The postinstall script finds an OpenCode configuration file and writes an opencode-rpc plugin registration into it.

Policy narrative

On installation, the package invokes a postinstall script. That script searches for OpenCode configuration, including the home configuration location, then adds the package to the configured plugin list. This is an unconsented install-time mutation of an AI-agent control surface, causing the package to be loaded by OpenCode later.

AI rationale

The automatic lifecycle hook changes an AI-agent plugin configuration outside an explicit user setup action. Its home-level configuration targeting makes the mutation a broad control-surface change.

Evidence

package.jsonscripts/postinstall.mjs

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 93.0% confidence with low false-positive risk.

opencode-rpc@2.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code