Loading npm security reports…

ryo-framework: AI-agent policy block | LPM Firewall

registry / ryo-framework / 3.0.0

ryo-framework@3.0.0

Build production-ready software with AI using real engineering principles.

AI Security Review

scanned 20d ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. Global npm install mutates OpenCode AI-agent configuration without an explicit user command. The installed agents include edit and bash permissions, expanding an AI control surface at install time.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm global install postinstall

Impact

OpenCode may load package-supplied agents with shell/edit capabilities; shell rc files may also be modified for ryo completion persistence.

Mechanism

unconsented lifecycle AI-agent config and agent file installation

Policy narrative

On global installation, npm runs the postinstall script. That script copies package-supplied OpenCode agent markdown files into the user's global OpenCode config and merges agent definitions from opencode.json, including agents granted edit and bash permissions. It also appends a completion block to shell rc files. This is an install-time AI-agent control-surface mutation rather than a user-invoked setup step.

Rationale

The package performs unconsented lifecycle writes to OpenCode agent/control files with shell/edit-capable agents, matching the firewall's malicious AI-agent control hijack boundary. Other network and telemetry behaviors appear package-aligned, but they do not mitigate the install-time control-surface mutation.

Evidence

package.jsonscripts/install-opencode-agents.jsopencode.json.opencode/agents/backend.md.opencode/agents/refactor.md.opencode/agents/release.md.opencode/agents/tester.md

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-opencode-agents.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/utils/checkUpdate.jsView file

8exports.getPendingNotification = getPendingNotification; L9: const child_process_1 = require("child_process"); L10: const fs_1 = __importDefault(require("fs"));

High

Child Process

Package source references child process execution.

dist/utils/checkUpdate.jsView on unpkg · L8

scripts/install-opencode-agents.jsView file

1Install-time AI-agent control hijack evidence: L10: const home = os.homedir(); L11: const sourceDir = path.resolve(__dirname, "..", ".opencode", "agents"); L12: const sourceConfig = path.resolve(__dirname, "..", "opencode.json"); ... L28: for (const dir of agentDirs) { L29: fs.mkdirSync(dir, { recursive: true }); L30: for (const file of agentFiles) { L31: fs.copyFileSync(path.join(sourceDir, file), path.join(dir, file)); L32: } ... L49: L50: fs.writeFileSync(targetConfig, JSON.stringify(merged, null, 2) + "\n"); L51: } ... L82: content += "\n" + completionBlock + "\n"; Payload evidence from official-skills/database/prisma/SKILL.md: L1: # prisma Skill L2:

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/install-opencode-agents.jsView on unpkg · L1

4L5: const isGlobal = process.env.npm[redacted] === "true"; L6: if (!isGlobal) { ... L9: L10: const home = os.homedir(); L11: const sourceDir = path.resolve(__dirname, "..", ".opencode", "agents"); ... L36: if (fs.existsSync(sourceConfig)) { L37: const ourConfig = JSON.parse(fs.readFileSync(sourceConfig, "utf8")); L38: const existingConfig = fs.existsSync(targetConfig) ... L64: if (shell.includes("zsh")) { L65: rcFiles.push(".zshrc"); L66: } else if (shell.includes("bash")) {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/install-opencode-agents.jsView on unpkg · L4

dist/commands/upgrade.jsView file

65try { L66: (0, child_process_1.execSync)("npm install -g ryo-framework@latest", { L67: stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/upgrade.jsView on unpkg · L65

dist/commands/init.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = ryo-framework@2.3.9 matchedIdentity = npm:cnlvLWZyYW1ld29yaw:2.3.9 similarity = 0.829 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/commands/init.jsView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 13-53json

13 "official-skills/",

14 "registry/",

15 "templates/",

16 ".opencode/",

17 "opencode.json",

18 "scripts/",

19 "README.md",

20 "CHANGELOG.md",

21 "LICENSE",

22 "package.json"

23 ],

24 "engines": {

25 "node": ">=20"

26 },

27 "scripts": {

28 "build": "tsc",

29 "test": "vitest --run --maxWorkers=1",

30 "coverage": "vitest run --coverage",

31 "lint": "eslint .",

32 "format": "prettier --write .",

33 "postinstall": "node scripts/install-opencode-agents.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

34 },

35 "repository": {

36 "type": "git",

37 "url": "git+https://github.com/baguskara1/ryo-engineering-framework.git"

38 },

39 "keywords": [

40 "ryo",

41 "engineering",

42 "framework",

43 "ai",

44 "cli",

45 "skills",

46 "templates"

47 ],

48 "author": "Ryo Framework",

49 "license": "MIT",

50 "bugs": {

51 "url": "https://github.com/baguskara1/ryo-engineering-framework/issues"

52 },

53 "homepage": "https://github.com/baguskara1/ryo-engineering-framework#readme",

dist/utils/checkUpdate.jsView file

Lines 1-28javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod :

scripts/install-opencode-agents.jsView file

Lines 1-24javascript

1const fs = require("fs");

2const path = require("path");

3const os =

dist/commands/upgrade.jsView file

Lines 45-85javascript

45 timeout: 10000,

46 })

47 .toString()

48 .trim();

49 }

50 catch {

51 logger_1.logger.warning(

dist/commands/init.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = ryo-framework@2.3.9 matchedIdentity = npm:cnlvLWZyYW1ld29yaw:2.3.9 similarity = 0.829 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/commands/init.jsView on unpkg