registry / plugin-updater / 1.5.9

plugin-updater@1.5.9

⚠ Under review

Plugin lifecycle manager for OpenCode and Claude Code launchers

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 14 file(s), 85.6 KB of source, external domains: 127.0.0.1, github.com, img.shields.io, opencode.ai, www.npmjs.com

Source & flagged code

5 flagged

dist/npm.jsView file

Lines 1-23javascript

1import fs from "fs";

2import path from "path";

3import os from "os";

4import { execSync } from "child_process";

5import { isOpencodeHookInvocation } from "./env.js";

High

Child Process

Package source references child process execution.

dist/npm.jsView on unpkg · L3

6import { writeLog } from "./log.js";

7import { readOpencodeJson, writeOpencodeJson } from "./config.js";

8// @ts-ignore — generated bundle, no .d.ts

9import { loadConfig } from "../lib/core.js";

10function getNpmTimeoutMs() {

11 // eslint-disable-next-line @typescript-eslint/no-explicit-any

12 const cfg = loadConfig("plugin-updater");

13 const seconds = typeof cfg.npm_timeout_seconds === "number" ? cfg.npm_timeout_seconds : 300;

14 return seconds * 1000;

15}

16let npmGlobalRoot = null;

17export function getNpmGlobalRoot() {

18 if (npmGlobalRoot !== null)

19 return npmGlobalRoot;

20 try {

21 npmGlobalRoot = execSync("npm root -g", { stdio: ["ignore", "pipe", "ignore"] }).toString().trim();

22 }

23 catch {

Lines 62-102javascript

62}

63export function getNpmPlugins(configDir) {

64 if (isOpencodeHookInvocation(configDir))

65 return [];

66 const { plugins } = readOpencodeJson(configDir);

67 return plugins.map((raw) => {

dist/git.jsView file

Lines 1-27javascript

1import fs from "fs";

2import path from "path";

3import os from "os";

4import { execSync, exec } from "child_process";

5import { promisify } from "util";

6import { getReposDir }

dist/syncbridge.jsView file

Lines 9-42javascript

9// where plugin-updater itself deploys git plugins.

10function resolveSyncBridgeLib(configDir) {

11 const candidates = [

12 path.join(configDir, "repos", "sync-bridge", "dist", "lib.js"),

13 ];

14 for (const

dist/deploy.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = plugin-updater@1.5.4 matchedIdentity = npm:cGx1Z2luLXVwZGF0ZXI:1.5.4 similarity = 0.538 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/deploy.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/npm.jsView file

3import os from "os"; L4: import { execSync } from "child_process"; L5: import { isOpencodeHookInvocation } from "./env.js";

High

Child Process

Package source references child process execution.

dist/npm.jsView on unpkg · L3

82} L83: execSync(`npm install -g ${name}`, { stdio: "pipe", timeout: getNpmTimeoutMs() }); L84: writeLog(`Installed npm plugin: ${name}`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/npm.jsView on unpkg · L82

dist/git.jsView file

7import { writeLog } from "./log.js"; L8: const execAsync = promisify(exec); L9: // Fetch each plugin's remote HEAD hash CONCURRENTLY (network I/O) so earlyLaunch's

High

Shell

Package source references shell execution.

dist/git.jsView on unpkg · L7

dist/syncbridge.jsView file

29try { L30: const bridge = (await import(pathToFileURL(libPath).href)); L31: if (typeof bridge.syncPlugins !== "function") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/syncbridge.jsView on unpkg · L29

dist/deploy.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/deploy.jsView on unpkg

Findings

1 Critical3 High4 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/deploy.js

HighChild Processdist/npm.js

HighShelldist/git.js

HighRuntime Package Installdist/npm.js

MediumDynamic Requiredist/syncbridge.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/npm.jsView file

Lines 1-23javascript

1import fs from "fs";

2import path from "path";

3import os from "os";

4import { execSync } from "child_process";

5import { isOpencodeHookInvocation } from "./env.js";

High

Child Process

Package source references child process execution.

dist/npm.jsView on unpkg · L3

6import { writeLog } from "./log.js";

7import { readOpencodeJson, writeOpencodeJson } from "./config.js";

8// @ts-ignore — generated bundle, no .d.ts

9import { loadConfig } from "../lib/core.js";

10function getNpmTimeoutMs() {

11 // eslint-disable-next-line @typescript-eslint/no-explicit-any

12 const cfg = loadConfig("plugin-updater");

13 const seconds = typeof cfg.npm_timeout_seconds === "number" ? cfg.npm_timeout_seconds : 300;

14 return seconds * 1000;

15}

16let npmGlobalRoot = null;

17export function getNpmGlobalRoot() {

18 if (npmGlobalRoot !== null)

19 return npmGlobalRoot;

20 try {

21 npmGlobalRoot = execSync("npm root -g", { stdio: ["ignore", "pipe", "ignore"] }).toString().trim();

22 }

23 catch {

Lines 62-102javascript

62}

63export function getNpmPlugins(configDir) {

64 if (isOpencodeHookInvocation(configDir))

65 return [];

66 const { plugins } = readOpencodeJson(configDir);

67 return plugins.map((raw) => {

dist/git.jsView file

Lines 1-27javascript

1import fs from "fs";

2import path from "path";

3import os from "os";

4import { execSync, exec } from "child_process";

5import { promisify } from "util";

6import { getReposDir }

dist/syncbridge.jsView file

Lines 9-42javascript

9// where plugin-updater itself deploys git plugins.

10function resolveSyncBridgeLib(configDir) {

11 const candidates = [

12 path.join(configDir, "repos", "sync-bridge", "dist", "lib.js"),

13 ];

14 for (const

dist/deploy.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/deploy.jsView on unpkg