registry / plugin-updater / 1.5.1

plugin-updater@1.5.1

Plugin lifecycle manager for OpenCode and Claude Code launchers

AI Security Review

scanned 7d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The package is a plugin lifecycle manager with high-privilege but documented update, build, deploy, and app-registration behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

CLI commands such as plugin-updater init/add/run or import as an OpenCode/Claude plugin entry

Impact

Can modify app plugin configuration and execute builds for user-configured plugins, but no source-grounded malicious exfiltration or hijack was found.

Mechanism

configured plugin update/build/deploy automation

Rationale

Static inspection shows dangerous primitives, but they implement the advertised plugin updater workflow and are activated by app/CLI configuration rather than install-time malware. I found no credential theft, covert exfiltration, hidden payload, or unconsented AI-agent control-surface mutation.

Evidence

package.jsondist/index.jsdist/git.jsdist/npm.jsdist/deploy.jsdist/cli.jsdist/syncbridge.jslib/core.js<configDir>/config/plugins.json<configDir>/plugins.json<configDir>/opencode.json<configDir>/opencode.jsonc<configDir>/settings.json<configDir>/repos/<pluginName><configDir>/plugin/<pluginName>.js<configDir>/logs/YYYY-MM-DD/plugin-updater-*.log

Network endpoints4

github.com/intisy-ai/plugin-updater.gitgithub.com/intisy-ai/<plugin>github.com/intisy-ai/sync-bridge127.0.0.1:<daemon.port>/health

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with medium false-positive risk.

Evidence for block

dist/index.js auto-runs activate() on import unless PLUGIN_UPDATER_LIBRARY_MODE/ACTIVATION is set.
dist/git.js clones/pulls configured git URLs and runs npm install/build for plugin repos.
dist/npm.js runs npm install/update/uninstall -g for configured npm plugin names.
dist/cli.js init writes app config/hooks, including Claude SessionStart npx plugin-updater@latest.

Evidence against

package.json has no install/postinstall hook; prepublishOnly is publish-time only.
Network/exec behavior is plugin-manager aligned and driven by CLI/app config entries.
dist/config.js and dist/cli.js manage opencode/plugins.json rather than harvesting arbitrary files.
dist/deploy.js only copies/activates configured plugin bundles and declared daemons.
No credential/env harvesting, exfiltration endpoint, obfuscation, persistence beyond documented app registration, or destructive broad deletion found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 14 file(s), 78.8 KB of source, external domains: 127.0.0.1, github.com, img.shields.io, opencode.ai, www.npmjs.com

Source & flagged code

4 flagged

dist/npm.jsView file

Lines 1-23javascript

1import fs from "fs";

2import path from "path";

3import os from "os";

4import { execSync } from "child_process";

5import { isOpencodeHookInvocation } from "./env.js";

High

Child Process

Package source references child process execution.

dist/npm.jsView on unpkg · L3

6import { writeLog } from "./log.js";

7import { readOpencodeJson, writeOpencodeJson } from "./config.js";

8// @ts-ignore — generated bundle, no .d.ts

9import { loadConfig } from "../lib/core.js";

10function getNpmTimeoutMs() {

11 // eslint-disable-next-line @typescript-eslint/no-explicit-any

12 const cfg = loadConfig("plugin-updater");

13 const seconds = typeof cfg.npm_timeout_seconds === "number" ? cfg.npm_timeout_seconds : 300;

14 return seconds * 1000;

15}

16let npmGlobalRoot = null;

17export function getNpmGlobalRoot() {

18 if (npmGlobalRoot !== null)

19 return npmGlobalRoot;

20 try {

21 npmGlobalRoot = execSync("npm root -g", { stdio: ["ignore", "pipe", "ignore"] }).toString().trim();

22 }

23 catch {

Lines 62-102javascript

62}

63export function getNpmPlugins(configDir) {

64 if (isOpencodeHookInvocation(configDir))

65 return [];

66 const { plugins } = readOpencodeJson(configDir);

67 return plugins.map((raw) => {

dist/syncbridge.jsView file

Lines 9-42javascript

9// where plugin-updater itself deploys git plugins.

10function resolveSyncBridgeLib(configDir) {

11 const candidates = [

12 path.join(configDir, "repos", "sync-bridge", "dist", "lib.js"),

13 ];

14 for (const

lib/core.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = plugin-updater@1.5.0 matchedIdentity = npm:cGx1Z2luLXVwZGF0ZXI:1.5.0 similarity = 0.846 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

lib/core.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/npm.jsView file

3import os from "os"; L4: import { execSync } from "child_process"; L5: import { isOpencodeHookInvocation } from "./env.js";

High

Child Process

Package source references child process execution.

dist/npm.jsView on unpkg · L3

82} L83: execSync(`npm install -g ${name}`, { stdio: "pipe", timeout: getNpmTimeoutMs() }); L84: writeLog(`Installed npm plugin: ${name}`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/npm.jsView on unpkg · L82

dist/syncbridge.jsView file

29try { L30: const bridge = (await import(pathToFileURL(libPath).href)); L31: if (typeof bridge.syncPlugins !== "function") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/syncbridge.jsView on unpkg · L29

lib/core.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

lib/core.jsView on unpkg

Findings

1 Critical3 High4 Medium5 Low

CriticalPrevious Version Dangerous Deltalib/core.js

HighChild Processdist/npm.js

HighShell

HighRuntime Package Installdist/npm.js

MediumDynamic Requiredist/syncbridge.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/npm.jsView file

Lines 1-23javascript

1import fs from "fs";

2import path from "path";

3import os from "os";

4import { execSync } from "child_process";

5import { isOpencodeHookInvocation } from "./env.js";

High

Child Process

Package source references child process execution.

dist/npm.jsView on unpkg · L3

6import { writeLog } from "./log.js";

7import { readOpencodeJson, writeOpencodeJson } from "./config.js";

8// @ts-ignore — generated bundle, no .d.ts

9import { loadConfig } from "../lib/core.js";

10function getNpmTimeoutMs() {

11 // eslint-disable-next-line @typescript-eslint/no-explicit-any

12 const cfg = loadConfig("plugin-updater");

13 const seconds = typeof cfg.npm_timeout_seconds === "number" ? cfg.npm_timeout_seconds : 300;

14 return seconds * 1000;

15}

16let npmGlobalRoot = null;

17export function getNpmGlobalRoot() {

18 if (npmGlobalRoot !== null)

19 return npmGlobalRoot;

20 try {

21 npmGlobalRoot = execSync("npm root -g", { stdio: ["ignore", "pipe", "ignore"] }).toString().trim();

22 }

23 catch {

Lines 62-102javascript

62}

63export function getNpmPlugins(configDir) {

64 if (isOpencodeHookInvocation(configDir))

65 return [];

66 const { plugins } = readOpencodeJson(configDir);

67 return plugins.map((raw) => {

dist/syncbridge.jsView file

Lines 9-42javascript

9// where plugin-updater itself deploys git plugins.

10function resolveSyncBridgeLib(configDir) {

11 const candidates = [

12 path.join(configDir, "repos", "sync-bridge", "dist", "lib.js"),

13 ];

14 for (const

lib/core.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

lib/core.jsView on unpkg