opencode-sdlc-system@1.0.0

One or more suspicious static signals were detected.

npm install (postinstall)

Package code loads into OpenCode sessions and injects workspace content into system prompts.

copies agents/plugins and registers global OpenCode plugins

On npm postinstall, install.js copies package-controlled agent and plugin files into the user's global OpenCode configuration directory, then creates or rewrites opencode.json(c) to load them. The installed ContextLoaderPlugin runs globally and injects project README and .agents files into chat system prompts. This is an unconsented install-time mutation of a broad AI-agent control surface.

The package has no observed exfiltration or remote payload chain, but its automatic postinstall globally installs and enables agent extensions. That meets the firewall block boundary for unconsented lifecycle mutation of a foreign/broad AI-agent control surface.