registry / AI-agent control-surface risk / rfazlur-qaflow
rfazlur-qaflow
QA Agentic Workflows for OpenCode — 9router edition
This report shows the evidence for rfazlur-qaflow@1.1.0. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe guarded global-install lifecycle still performs unconsented postinstall writes to OpenCode’s global configuration and shell profiles. This is a concrete AI-agent control-surface takeover, not merely a user-invoked setup helper.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
npm global installation
Impact
Hijacks the default AI-agent provider/control surface and persists remotely supplied credentials.
Mechanism
postinstall mutation of global OpenCode and shell configuration
Policy narrative
On global install, postinstall runs setup without a separate opt-in. Setup requests an email, obtains a remotely supplied base URL and API key, installs package agents into OpenCode's global directory, replaces its global configuration, and writes those values into shell startup files. This changes a broad third-party AI-agent control surface and persists its routing configuration.
AI rationale
The guarded global-install lifecycle still performs unconsented postinstall writes to OpenCode’s global configuration and shell profiles. This is a concrete AI-agent control-surface takeover, not merely a user-invoked setup helper.
Evidence
package.jsonscripts/postinstall.jsscripts/setup.jsscripts/preuninstall.js.opencode/opencode.json.opencode/agent/~/.config/opencode/agents/~/.config/opencode/opencode.jsonc~/.zshrc~/.bashrc
Network endpoints1
api.qaflow.site/users/email/{email}
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs postinstall.
- scripts/postinstall.js invokes setup on global install.
- scripts/setup.js copies agents into ~/.config/opencode/agents.
- scripts/setup.js overwrites ~/.config/opencode/opencode.jsonc.
- scripts/setup.js injects API credentials into shell RC files.
- Remote API response supplies baseURL and API key.
Evidence against
- Setup prompts for an email before its network request.
- No payload execution, child process, or credential harvesting beyond entered email.
Behavioral surface
EnvironmentVarsFilesystemNetwork
UrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/setup.jsView file
1Install-time AI-agent control hijack evidence:
L16: const GLOBAL_AGENTS_DIR = path.join(GLOBAL_OPENCODE_DIR, "agents");
L17: const GLOBAL_CONFIG = path.join(GLOBAL_OPENCODE_DIR, "opencode.jsonc");
L18:
...
L60: function copyDirRecursive(src, dest) {
L61: fs.mkdirSync(dest, { recursive: true });
L62: for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
...
L67: } else {
L68: fs.copyFileSync(srcPath, destPath);
L69: console.log(` [OK] agents/${path.relative(GLOBAL_AGENTS_DIR, destPath)}`);
...
L87: );
L88: fs.writeFileSync(rcFile, updated, "utf8");
L89: console.log(` [UPDATE] ${rcFile}`);
Payload evidence from .opencode/agent/orchestrator.md:
L1: ---
L2: description: >-
Findings
1 Critical3 High5 Medium4 Low
CriticalAi Agent Control Hijackscripts/setup.js
HighInstall Time Lifecycle Scriptspackage.json
HighTrigger Reachable Persistencescripts/setup.js
HighKnown Malware Source Similarityscripts/setup.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencescripts/setup.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to rfazlur-qaflow@1.1.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing rfazlur-qaflow@1.1.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.