Loading npm security reports…

rfazlur-qaflow@1.1.0: AI-agent control-surface risk | LPM Firewall

registry / rfazlur-qaflow / 1.1.0

rfazlur-qaflow@1.1.0

QA Agentic Workflows for OpenCode — 9router edition

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install silently configures the host OpenCode installation. It replaces the global provider configuration, installs agent definitions, and persists provider credentials in shell startup files.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm global installation

Impact

Hijacks the default AI-agent provider/control surface and persists remotely supplied credentials.

Mechanism

postinstall mutation of global OpenCode and shell configuration

Policy narrative

On global install, postinstall runs setup without a separate opt-in. Setup requests an email, obtains a remotely supplied base URL and API key, installs package agents into OpenCode's global directory, replaces its global configuration, and writes those values into shell startup files. This changes a broad third-party AI-agent control surface and persists its routing configuration.

Rationale

The guarded global-install lifecycle still performs unconsented postinstall writes to OpenCode’s global configuration and shell profiles. This is a concrete AI-agent control-surface takeover, not merely a user-invoked setup helper.

Evidence

package.jsonscripts/postinstall.jsscripts/setup.jsscripts/preuninstall.js.opencode/opencode.json.opencode/agent/~/.config/opencode/agents/~/.config/opencode/opencode.jsonc~/.zshrc~/.bashrc

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/setup.jsView file

1Install-time AI-agent control hijack evidence: L16: const GLOBAL_AGENTS_DIR = path.join(GLOBAL_OPENCODE_DIR, "agents"); L17: const GLOBAL_CONFIG = path.join(GLOBAL_OPENCODE_DIR, "opencode.jsonc"); L18: ... L60: function copyDirRecursive(src, dest) { L61: fs.mkdirSync(dest, { recursive: true }); L62: for (const entry of fs.readdirSync(src, { withFileTypes: true })) { ... L67: } else { L68: fs.copyFileSync(srcPath, destPath); L69: console.log(` [OK] agents/${path.relative(GLOBAL_AGENTS_DIR, destPath)}`); ... L87: ); L88: fs.writeFileSync(rcFile, updated, "utf8"); L89: console.log(` [UPDATE] ${rcFile}`); Payload evidence from .opencode/agent/orchestrator.md: L1: --- L2: description: >-

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/setup.jsView on unpkg · L1

7Trigger-reachable persistence chain: scripts.postinstall -> scripts/postinstall.js -> scripts/setup.js L7: const os = require("os"); L8: const https = require("https"); L9: const http = require("http"); ... L14: L15: const GLOBAL_OPENCODE_DIR = path.join(os.homedir(), ".config", "opencode"); L16: const GLOBAL_AGENTS_DIR = path.join(GLOBAL_OPENCODE_DIR, "agents"); ... L21: function detectRcFiles() { L22: const shell = process.env.SHELL || ""; L23: if (shell.endsWith("zsh")) return [path.join(os.homedir(), ".zshrc")]; L24: if (shell.endsWith("bash")) return [path.join(os.homedir(), ".bashrc")]; ... L28: function prompt(question) { L29: const rl = readline.createInterface({ input: process.stdin, output: process.stdout });

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

scripts/setup.jsView on unpkg · L7

•matchType = normalized_sha256 matchedPackage = rfazlur-qaflow@1.0.0 matchedPath = scripts/setup.js matchedIdentity = npm:cmZhemx1ci1xYWZsb3c:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/setup.jsView on unpkg

7const os = require("os"); L8: const https = require("https"); L9: const http = require("http"); ... L14: L15: const GLOBAL_OPENCODE_DIR = path.join(os.homedir(), ".config", "opencode"); L16: const GLOBAL_AGENTS_DIR = path.join(GLOBAL_OPENCODE_DIR, "agents"); ... L21: function detectRcFiles() { L22: const shell = process.env.SHELL || ""; L23: if (shell.endsWith("zsh")) return [path.join(os.homedir(), ".zshrc")]; L24: if (shell.endsWith("bash")) return [path.join(os.homedir(), ".bashrc")]; ... L28: function prompt(question) { L29: const rl = readline.createInterface({ input: process.stdin, output: process.stdout });

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/setup.jsView on unpkg · L7