Loading npm security reports…

opencode-sdlc-system@1.2.1: AI-agent policy block | LPM Firewall

registry / opencode-sdlc-system / 1.2.1

opencode-sdlc-system@1.2.1

Multi-agent SDLC Orchestration System with Global Hooks for OpenCode Desktop

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. npm postinstall mutates a broad OpenCode control surface without an explicit user command. It installs persistent plugins, agents, skills, permissive configuration, and later enables dependency-selected MCP/package execution.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall; then OpenCode session/message hooks

Impact

Installed OpenCode sessions gain package-controlled agents/plugins and wildcard external-directory permission; project dependency detection can add and execute third-party MCP/skill packages.

Mechanism

global AI-agent configuration and plugin injection with runtime package installation

Policy narrative

Installation automatically copies package-controlled agent extensions into global OpenCode directories, creates or rewrites global configuration, enables all shipped plugins, and grants wildcard external-directory access. Once loaded, AutoDiscoveryPlugin scans project dependencies, silently installs global skills through npx, and writes enabled project MCP commands that run npx packages. This is an unconsented install-time takeover of a broad AI-agent control surface.

Rationale

Source inspection confirms concrete postinstall mutation of global OpenCode and ~/.agents control surfaces, exceeding first-party project setup. The absence of exfiltration does not mitigate the unconsented persistent control-plane modification.

Evidence

package.jsoninstall.jsplugins/AutoDiscoveryPlugin.tsagents/orchestrator.md~/.config/opencode/plugins/~/.config/opencode/agents/

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

plugins/AutoDiscoveryPlugin.tsView file

3import * as os from 'os'; L4: import { exec } from 'child_process'; L5:

High

Child Process

Package source references child process execution.

plugins/AutoDiscoveryPlugin.tsView on unpkg · L3

395if (source) { L396: exec(`npx skills add ${source}@${skillId} -g -y`, { windowsHide: true }, (err) => { L397: if (err) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

plugins/AutoDiscoveryPlugin.tsView on unpkg · L395

•matchType = normalized_sha256 matchedPackage = opencode-sdlc-system@1.1.1 matchedPath = plugins/AutoDiscoveryPlugin.ts matchedIdentity = npm:b3BlbmNvZGUtc2RsYy1zeXN0ZW0:1.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugins/AutoDiscoveryPlugin.tsView on unpkg

install.jsView file

17Install-time AI-agent control hijack evidence: L17: let configPath = path.join(os.homedir(), '.config', 'opencode'); L18: if (process.env.OPENCODE_CONFIG_DIR) { L19: configPath = process.env.OPENCODE_CONFIG_DIR; L20: } ... L89: configFile = configPathJsonc; L90: fs.writeFileSync( L91: configFile, ... L210: L211: fs.writeFileSync(configFile, JSON.stringify(configObj, null, 2), 'utf8'); L212: console.log("✅ Se registraron los plugins, comandos slash (/sdlc, /plan, /review, /test, /docs) y configuración en " + path.basename(configFile) + "."); Payload evidence from skills/opencode-best-practices/SKILL.md: L17: { L18: "$schema": "https://opencode.ai/config.json", L19: "default_agent": "orchestrator", // Primary agent loaded on session start ... L156: 1. **Avoid Dynamic Timestamps in System Pr

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install.jsView on unpkg · L17

•matchType = normalized_sha256 matchedPackage = opencode-sdlc-system@1.1.1 matchedPath = install.js matchedIdentity = npm:b3BlbmNvZGUtc2RsYy1zeXN0ZW0:1.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

install.jsView on unpkg