Loading npm security reports…

rfazlur-qaflow@1.0.0: AI-agent control-surface risk | LPM Firewall

registry / rfazlur-qaflow / 1.0.0

rfazlur-qaflow@1.0.0

QA Agentic Workflows for OpenCode — 9router edition

AI Security Review

scanned 11d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Global installation triggers an interactive postinstall setup that takes control of the user's global OpenCode configuration. It obtains a remote provider endpoint and key, installs agent definitions, and persists credentials in shell startup files.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Global npm install of rfazlur-qaflow

Impact

Routes OpenCode through a server-supplied provider and changes the user's global agent control surface.

Mechanism

postinstall global OpenCode takeover and shell-profile persistence

Policy narrative

On global install, the postinstall invokes setup. After collecting an email and querying api.qaflow.site, it accepts a server-provided base URL and API key, replaces the global OpenCode configuration, copies package agents into the global agent directory, and writes those values to shell startup files. This is unconsented install-time mutation of a broad AI-agent control surface with persistent remote-provider routing.

Rationale

The source confirms a concrete install-time global OpenCode takeover and shell persistence chain. The interactive prompt does not remove the unconsented postinstall mutation risk.

Evidence

package.jsonscripts/postinstall.jsscripts/setup.js.opencode/opencode.json.opencode/agent/orchestrator.md.opencode/agent/~/.config/opencode/opencode.jsonc~/.config/opencode/agents/~/.zshrc~/.bashrc

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/setup.jsView file

1Install-time AI-agent control hijack evidence: L16: const GLOBAL_AGENTS_DIR = path.join(GLOBAL_OPENCODE_DIR, "agents"); L17: const GLOBAL_CONFIG = path.join(GLOBAL_OPENCODE_DIR, "opencode.jsonc"); L18: ... L60: function copyDirRecursive(src, dest) { L61: fs.mkdirSync(dest, { recursive: true }); L62: for (const entry of fs.readdirSync(src, { withFileTypes: true })) { ... L67: } else { L68: fs.copyFileSync(srcPath, destPath); L69: console.log(` [OK] agents/${path.relative(GLOBAL_AGENTS_DIR, destPath)}`); ... L87: ); L88: fs.writeFileSync(rcFile, updated, "utf8"); L89: console.log(` [UPDATE] ${rcFile}`); Payload evidence from .opencode/agent/orchestrator.md: L1: --- L2: description: >-

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/setup.jsView on unpkg · L1

7Trigger-reachable persistence chain: scripts.postinstall -> scripts/postinstall.js -> scripts/setup.js L7: const os = require("os"); L8: const https = require("https"); L9: const http = require("http"); ... L14: L15: const GLOBAL_OPENCODE_DIR = path.join(os.homedir(), ".config", "opencode"); L16: const GLOBAL_AGENTS_DIR = path.join(GLOBAL_OPENCODE_DIR, "agents"); ... L21: function detectRcFiles() { L22: const shell = process.env.SHELL || ""; L23: if (shell.endsWith("zsh")) return [path.join(os.homedir(), ".zshrc")]; L24: if (shell.endsWith("bash")) return [path.join(os.homedir(), ".bashrc")]; ... L28: function prompt(question) { L29: const rl = readline.createInterface({ input: process.stdin, output: process.stdout });

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

scripts/setup.jsView on unpkg · L7

7const os = require("os"); L8: const https = require("https"); L9: const http = require("http"); ... L14: L15: const GLOBAL_OPENCODE_DIR = path.join(os.homedir(), ".config", "opencode"); L16: const GLOBAL_AGENTS_DIR = path.join(GLOBAL_OPENCODE_DIR, "agents"); ... L21: function detectRcFiles() { L22: const shell = process.env.SHELL || ""; L23: if (shell.endsWith("zsh")) return [path.join(os.homedir(), ".zshrc")]; L24: if (shell.endsWith("bash")) return [path.join(os.homedir(), ".bashrc")]; ... L28: function prompt(question) { L29: const rl = readline.createInterface({ input: process.stdin, output: process.stdout });

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/setup.jsView on unpkg · L7