registry  /  plugin-updater  /  1.5.3

plugin-updater@1.5.3

Plugin lifecycle manager for OpenCode and Claude Code launchers

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 14 file(s), 80.1 KB of source, external domains: 127.0.0.1, github.com, img.shields.io, opencode.ai, www.npmjs.com

Source & flagged code

3 flagged · loading source
dist/npm.jsView file
3import os from "os"; L4: import { execSync } from "child_process"; L5: import { isOpencodeHookInvocation } from "./env.js";
High
Child Process

Package source references child process execution.

dist/npm.jsView on unpkg · L3
82} L83: execSync(`npm install -g ${name}`, { stdio: "pipe", timeout: getNpmTimeoutMs() }); L84: writeLog(`Installed npm plugin: ${name}`);
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/npm.jsView on unpkg · L82
dist/syncbridge.jsView file
29try { L30: const bridge = (await import(pathToFileURL(libPath).href)); L31: if (typeof bridge.syncPlugins !== "function") {
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/syncbridge.jsView on unpkg · L29

Findings

3 High4 Medium5 Low
HighChild Processdist/npm.js
HighShell
HighRuntime Package Installdist/npm.js
MediumDynamic Requiredist/syncbridge.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings