registry / opencode-swarm / 7.107.1

opencode-swarm@7.107.1

⚠ Under review

Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review

Static Scan Results

scanned 15h ago · by rust-scanner

Static analysis flagged 22 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 49 file(s), 3.20 MB of source, external domains: 127.0.0.1, api.search.brave.com, api.tavily.com, github.com, json-schema.org, registry.npmjs.org

Oversized source lightweight scan

dist/index.js4.39 MB file, sampled 256 KB

FilesystemNetworkEnvironmentVarsHighEntropyStringsMinifiedUrlStringsProtestwareapi.search.brave.comapi.tavily.comgithub.comregistry.npmjs.org

Source & flagged code

13 flagged

dist/cli/index-gt514nt1.jsView file

24589patternName = private_key_rsa severity = critical line = 24589 matchedText = redactTe...---"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/cli/index-gt514nt1.jsView on unpkg · L24589

•matchType = previous_version_dangerous_delta matchedPackage = opencode-swarm@7.100.0 matchedIdentity = npm:b3BlbmNvZGUtc3dhcm0:7.100.0 similarity = 0.814 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/index-gt514nt1.jsView on unpkg

24589patternName = private_key_rsa severity = critical line = 24589 matchedText = redactTe...---"

Critical

Secret Pattern

RSA private key in dist/cli/index-gt514nt1.js

dist/cli/index-gt514nt1.jsView on unpkg · L24589

446const escapedProfilePath = shellEscape2(profilePath); L447: return `sandbox-exec -f '${escapedProfilePath}' bash -c '${escapedCommand}'`; L448: }

High

Shell

Package source references shell execution.

dist/cli/index-gt514nt1.jsView on unpkg · L446

194Cross-file remote execution chain: dist/cli/index-gt514nt1.js spawns dist/cli/index-8w4d325g.js; helper contains network access plus dynamic code execution. L194: // src/sandbox/linux/bubblewrap-executor.ts L195: import { spawnSync as spawnSync3 } from "child_process"; L196: function probeBwrap() { ... L212: } L213: return result.status === BWRAP_VERSION_EXIT && result.stdout.trim().length > 0; L214: } catch (err) { ... L392: constructor(scopePaths = [], tempDir) { L393: if (process.platform !== "darwin") { L394: throw new Error("MacOSSandboxExecutor not yet implemented"); ... L485: } L486: const encodedBase64Pattern = /-Enc(odedCommand)?\s+[A-Za-z0-9+/=]+/i; L487: if (encodedBase64Pattern.test(command)) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index-gt514nt1.jsView on unpkg · L194

194// src/sandbox/linux/bubblewrap-executor.ts L195: import { spawnSync as spawnSync3 } from "child_process"; L196: function probeBwrap() { ... L212: } L213: return result.status === BWRAP_VERSION_EXIT && result.stdout.trim().length > 0; L214: } catch (err) { ... L392: constructor(scopePaths = [], tempDir) { L393: if (process.platform !== "darwin") { L394: throw new Error("MacOSSandboxExecutor not yet implemented"); ... L485: } L486: const encodedBase64Pattern = /-Enc(odedCommand)?\s+[A-Za-z0-9+/=]+/i; L487: if (encodedBase64Pattern.test(command)) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/index-gt514nt1.jsView on unpkg · L194

dist/cli/index-8w4d325g.jsView file

Lines 67-107javascript

67 return;

68 }

69 getAll() {

70 return Array.from(this.profiles.values());

71 }

72 getTier(tier) {

73 return Array.from(this.profiles.values

dist/cli/index-7v734syt.jsView file

Lines 399-439javascript

399 };

400 }

401 if (/^zip\b.*\s-m\b/i.test(seg) && /\.swarm(?:[\x5c/\s]|$)/i.test(seg)) {

402 return {

dist/lang/grammars/tree-sitter-go.wasmView file

•path = dist/lang/grammars/tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/lang/grammars/tree-sitter-go.wasmView on unpkg

.opencode/skills/codebase-review-swarm/scripts/init-review-run.pyView file

•path = .opencode/skills/codebase-review-swarm/scripts/init-review-run.py kind = payload_in_excluded_dir sizeBytes = 4410 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.opencode/skills/codebase-review-swarm/scripts/init-review-run.pyView on unpkg

•path = .opencode/skills/codebase-review-swarm/scripts/init-review-run.py kind = build_helper sizeBytes = 4410 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.opencode/skills/codebase-review-swarm/scripts/init-review-run.pyView on unpkg

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 4604459 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

Source & flagged code

13 flagged · loading source

dist/cli/index-gt514nt1.jsView file

24589patternName = private_key_rsa severity = critical line = 24589 matchedText = redactTe...---"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/cli/index-gt514nt1.jsView on unpkg · L24589

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/index-gt514nt1.jsView on unpkg

24589patternName = private_key_rsa severity = critical line = 24589 matchedText = redactTe...---"

Critical

Secret Pattern

RSA private key in dist/cli/index-gt514nt1.js

dist/cli/index-gt514nt1.jsView on unpkg · L24589

446const escapedProfilePath = shellEscape2(profilePath); L447: return `sandbox-exec -f '${escapedProfilePath}' bash -c '${escapedCommand}'`; L448: }

High

Shell

Package source references shell execution.

dist/cli/index-gt514nt1.jsView on unpkg · L446

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index-gt514nt1.jsView on unpkg · L194

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/index-gt514nt1.jsView on unpkg · L194

dist/cli/index-8w4d325g.jsView file

1151"Check for XSS \u2014 all output must be escaped with htmlspecialchars()", L1152: "Confirm no eval(), exec(), or shell_exec() with user-controlled input", L1153: "Validate proper error handling \u2014 no bare catch blocks that swallow errors",

High

Child Process

Package source references child process execution.

dist/cli/index-8w4d325g.jsView on unpkg · L1151

87build: { L88: detectFiles: ["package.json"], L89: commands: [ ... L792: detect: "CMakeLists.txt", L793: cmd: "cppcheck --error-exitcode=1 .", L794: priority: 10 ... L1151: "Check for XSS \u2014 all output must be escaped with htmlspecialchars()", L1152: "Confirm no eval(), exec(), or shell_exec() with user-controlled input", L1153: "Validate proper error handling \u2014 no bare catch blocks that swallow errors", ... L1377: bigint: () => bigint2, L1378: base64url: () => base64url2, L1379: base64: () => base642,

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/cli/index-8w4d325g.jsView on unpkg · L87

dist/cli/index-7v734syt.jsView file

419{ L420: let probe = seg.replace(/^(?:[A-Za-z_][A-Za-z0-9_]*=\S+\s+)+/, "").replace(/^eval(?:\s+--)?\s+["']?/, "").replace(/["']\s*$/, "").replace(/^\$\(\s*/, "").replace(/^\(\s*/, "").repl... L421: for (let i = 0;i < 4; i++) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli/index-7v734syt.jsView on unpkg · L419

dist/lang/grammars/tree-sitter-go.wasmView file

•path = dist/lang/grammars/tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/lang/grammars/tree-sitter-go.wasmView on unpkg

.opencode/skills/codebase-review-swarm/scripts/init-review-run.pyView file

•path = .opencode/skills/codebase-review-swarm/scripts/init-review-run.py kind = payload_in_excluded_dir sizeBytes = 4410 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.opencode/skills/codebase-review-swarm/scripts/init-review-run.pyView on unpkg

•path = .opencode/skills/codebase-review-swarm/scripts/init-review-run.py kind = build_helper sizeBytes = 4410 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.opencode/skills/codebase-review-swarm/scripts/init-review-run.pyView on unpkg

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 4604459 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

Findings

3 Critical6 High6 Medium7 Low

CriticalCritical Secretdist/cli/index-gt514nt1.js

CriticalPrevious Version Dangerous Deltadist/cli/index-gt514nt1.js

CriticalSecret Patterndist/cli/index-gt514nt1.js

HighChild Processdist/cli/index-8w4d325g.js

HighShelldist/cli/index-gt514nt1.js

HighObfuscated Payload Loaderdist/cli/index-8w4d325g.js

HighCross File Remote Execution Contextdist/cli/index-gt514nt1.js

HighPayload In Excluded Dir.opencode/skills/codebase-review-swarm/scripts/init-review-run.py

HighOversized Source Filedist/index.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Wasm Moduledist/lang/grammars/tree-sitter-go.wasm

MediumShips Build Helper.opencode/skills/codebase-review-swarm/scripts/init-review-run.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/cli/index-7v734syt.js

LowWeak Cryptodist/cli/index-gt514nt1.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

13 flagged

dist/cli/index-gt514nt1.jsView file

24589patternName = private_key_rsa severity = critical line = 24589 matchedText = redactTe...---"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/cli/index-gt514nt1.jsView on unpkg · L24589

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/index-gt514nt1.jsView on unpkg

24589patternName = private_key_rsa severity = critical line = 24589 matchedText = redactTe...---"

Critical

Secret Pattern

RSA private key in dist/cli/index-gt514nt1.js

dist/cli/index-gt514nt1.jsView on unpkg · L24589

446const escapedProfilePath = shellEscape2(profilePath); L447: return `sandbox-exec -f '${escapedProfilePath}' bash -c '${escapedCommand}'`; L448: }

High

Shell

Package source references shell execution.

dist/cli/index-gt514nt1.jsView on unpkg · L446

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index-gt514nt1.jsView on unpkg · L194

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/index-gt514nt1.jsView on unpkg · L194

dist/cli/index-8w4d325g.jsView file

Lines 67-107javascript

67 return;

68 }

69 getAll() {

70 return Array.from(this.profiles.values());

71 }

72 getTier(tier) {

73 return Array.from(this.profiles.values

dist/cli/index-7v734syt.jsView file

Lines 399-439javascript

399 };

400 }

401 if (/^zip\b.*\s-m\b/i.test(seg) && /\.swarm(?:[\x5c/\s]|$)/i.test(seg)) {

402 return {

dist/lang/grammars/tree-sitter-go.wasmView file

•path = dist/lang/grammars/tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/lang/grammars/tree-sitter-go.wasmView on unpkg

.opencode/skills/codebase-review-swarm/scripts/init-review-run.pyView file

•path = .opencode/skills/codebase-review-swarm/scripts/init-review-run.py kind = payload_in_excluded_dir sizeBytes = 4410 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.opencode/skills/codebase-review-swarm/scripts/init-review-run.pyView on unpkg

•path = .opencode/skills/codebase-review-swarm/scripts/init-review-run.py kind = build_helper sizeBytes = 4410 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.opencode/skills/codebase-review-swarm/scripts/init-review-run.pyView on unpkg

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 4604459 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg