registry / AI-agent control-surface risk / opencode-sdlc-system

opencode-sdlc-system

Multi-agent SDLC Orchestration System with Global Hooks for OpenCode Desktop

This report shows the evidence for opencode-sdlc-system@1.2.1. 5 of 5 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

Source inspection confirms concrete postinstall mutation of global OpenCode and ~/.agents control surfaces, exceeding first-party project setup. The absence of exfiltration does not mitigate the unconsented persistent control-plane modification.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall; then OpenCode session/message hooks

Impact

Installed OpenCode sessions gain package-controlled agents/plugins and wildcard external-directory permission; project dependency detection can add and execute third-party MCP/skill packages.

Mechanism

global AI-agent configuration and plugin injection with runtime package installation

Policy narrative

Installation automatically copies package-controlled agent extensions into global OpenCode directories, creates or rewrites global configuration, enables all shipped plugins, and grants wildcard external-directory access. Once loaded, AutoDiscoveryPlugin scans project dependencies, silently installs global skills through npx, and writes enabled project MCP commands that run npx packages. This is an unconsented install-time takeover of a broad AI-agent control surface.

AI rationale

Evidence

package.jsoninstall.jsplugins/AutoDiscoveryPlugin.tsagents/orchestrator.md~/.config/opencode/plugins/~/.config/opencode/agents/~/.config/opencode/skills/~/.config/opencode/opencode.jsonc~/.agents/skills/<project>/.opencode/opencode.jsonc<project>/.agents/auto-discovery.json

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

package.json postinstall runs install.js automatically.
install.js copies package plugins/agents to ~/.config/opencode and skills to ~/.agents/skills.
install.js creates/rewrites opencode.json(c), sets default_agent, registers six plugins, and grants external_directory '*' allow.
AutoDiscoveryPlugin silently executes npx skills add globally and writes project MCP commands that invoke npx packages.

Evidence against

No credential exfiltration, HTTP client, obfuscated payload, or destructive system command was found.
Listed credential URLs are setup guidance; source does not read or transmit their values.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 66.5 KB of source, external domains: console.aws.amazon.com, dashboard.stripe.com, github.com, id.atlassian.com, opencode.ai, sentry.io, supabase.com, vercel.com

Source & flagged code

7 flagged

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

plugins/AutoDiscoveryPlugin.tsView file

3import * as os from 'os'; L4: import { exec } from 'child_process'; L5:

High

Child Process

Package source references child process execution.

plugins/AutoDiscoveryPlugin.tsView on unpkg · L3

395if (source) { L396: exec(`npx skills add ${source}@${skillId} -g -y`, { windowsHide: true }, (err) => { L397: if (err) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

plugins/AutoDiscoveryPlugin.tsView on unpkg · L395

•matchType = normalized_sha256 matchedPackage = opencode-sdlc-system@1.1.1 matchedPath = plugins/AutoDiscoveryPlugin.ts matchedIdentity = npm:b3BlbmNvZGUtc2RsYy1zeXN0ZW0:1.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugins/AutoDiscoveryPlugin.tsView on unpkg

install.jsView file

17Install-time AI-agent control hijack evidence: L17: let configPath = path.join(os.homedir(), '.config', 'opencode'); L18: if (process.env.OPENCODE_CONFIG_DIR) { L19: configPath = process.env.OPENCODE_CONFIG_DIR; L20: } ... L89: configFile = configPathJsonc; L90: fs.writeFileSync( L91: configFile, ... L210: L211: fs.writeFileSync(configFile, JSON.stringify(configObj, null, 2), 'utf8'); L212: console.log("✅ Se registraron los plugins, comandos slash (/sdlc, /plan, /review, /test, /docs) y configuración en " + path.basename(configFile) + "."); Payload evidence from skills/opencode-best-practices/SKILL.md: L17: { L18: "$schema": "https://opencode.ai/config.json", L19: "default_agent": "orchestrator", // Primary agent loaded on session start ... L156: 1. **Avoid Dynamic Timestamps in System Pr

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install.jsView on unpkg · L17

•matchType = normalized_sha256 matchedPackage = opencode-sdlc-system@1.1.1 matchedPath = install.js matchedIdentity = npm:b3BlbmNvZGUtc2RsYy1zeXN0ZW0:1.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

install.jsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

plugins/AutoDiscoveryPlugin.tsView file

3import * as os from 'os'; L4: import { exec } from 'child_process'; L5:

High

Child Process

Package source references child process execution.

plugins/AutoDiscoveryPlugin.tsView on unpkg · L3

Findings

1 Critical6 High3 Medium4 Low

CriticalAi Agent Control Hijackinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processplugins/AutoDiscoveryPlugin.ts

HighShell

HighRuntime Package Installplugins/AutoDiscoveryPlugin.ts

HighKnown Malware Source Similarityinstall.js

HighKnown Malware Source Similarityplugins/AutoDiscoveryPlugin.ts

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to opencode-sdlc-system@1.2.1.

The versions list below shows the verdict for each recorded version.

Avoid installing opencode-sdlc-system@1.2.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-23 12:24:24.916Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

5 known versions

1.2.1latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedJul 23, 2026, 12:18 PM 1.1.1MaliciousSoft block: AI-agent control surfaceBlockPublishedJul 23, 2026, 12:09 PM 1.0.2MaliciousSoft block: AI-agent control surfaceBlockPublishedJul 20, 2026, 11:39 AM 1.0.1MaliciousSoft block: AI-agent control surfaceBlockPublished

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code