registry / AI-agent control-surface risk / ryo-framework
ryo-framework
Build production-ready software with AI using real engineering principles.
This report shows the evidence for ryo-framework@3.0.0. 1 of 3 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiThe package performs unconsented lifecycle writes to OpenCode agent/control files with shell/edit-capable agents, matching the firewall's malicious AI-agent control hijack boundary. Other network and telemetry behaviors appear package-aligned, but they do not mitigate the install-time control-surface mutation.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
npm global install postinstall
Impact
OpenCode may load package-supplied agents with shell/edit capabilities; shell rc files may also be modified for ryo completion persistence.
Mechanism
unconsented lifecycle AI-agent config and agent file installation
Policy narrative
On global installation, npm runs the postinstall script. That script copies package-supplied OpenCode agent markdown files into the user's global OpenCode config and merges agent definitions from opencode.json, including agents granted edit and bash permissions. It also appends a completion block to shell rc files. This is an install-time AI-agent control-surface mutation rather than a user-invoked setup step.
AI rationale
The package performs unconsented lifecycle writes to OpenCode agent/control files with shell/edit-capable agents, matching the firewall's malicious AI-agent control hijack boundary. Other network and telemetry behaviors appear package-aligned, but they do not mitigate the install-time control-surface mutation.
Evidence
package.jsonscripts/install-opencode-agents.jsopencode.json.opencode/agents/backend.md.opencode/agents/refactor.md.opencode/agents/release.md.opencode/agents/tester.mddist/commands/opencodeSetup.jsdist/utils/checkUpdate.jsdist/utils/telemetry.js.opencode/agents/*.md~/.config/opencode/agent/*.md~/.config/opencode/agents/*.md~/.config/opencode/opencode.json~/.zshrc~/.bashrc
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 94.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json defines postinstall: node scripts/install-opencode-agents.js.
- scripts/install-opencode-agents.js only gates on global install, then writes package .opencode agents into ~/.config/opencode/agent and agents.
- scripts/install-opencode-agents.js merges package opencode.json into ~/.config/opencode/opencode.json during install.
- opencode.json/.opencode agents define backend/refactor/release/tester agents with edit: allow and bash: allow.
- scripts/install-opencode-agents.js appends ryo completion eval block to existing shell rc files.
Evidence against
- No credential harvesting or exfiltration found in inspected files.
- Runtime npm/curl checks in dist/utils/checkUpdate.js and dist/commands/upgrade.js are package-aligned update checks.
- Telemetry in dist/utils/telemetry.js is opt-in and local-file only.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-opencode-agents.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/utils/checkUpdate.jsView file
8exports.getPendingNotification = getPendingNotification;
L9: const child_process_1 = require("child_process");
L10: const fs_1 = __importDefault(require("fs"));
High
Child Process
Package source references child process execution.
dist/utils/checkUpdate.jsView on unpkg · L8scripts/install-opencode-agents.jsView file
1Install-time AI-agent control hijack evidence:
L10: const home = os.homedir();
L11: const sourceDir = path.resolve(__dirname, "..", ".opencode", "agents");
L12: const sourceConfig = path.resolve(__dirname, "..", "opencode.json");
...
L28: for (const dir of agentDirs) {
L29: fs.mkdirSync(dir, { recursive: true });
L30: for (const file of agentFiles) {
L31: fs.copyFileSync(path.join(sourceDir, file), path.join(dir, file));
L32: }
...
L49:
L50: fs.writeFileSync(targetConfig, JSON.stringify(merged, null, 2) + "\n");
L51: }
...
L82: content += "\n" + completionBlock + "\n";
Payload evidence from official-skills/database/prisma/SKILL.md:
L1: # prisma Skill
L2:
Findings
2 Critical3 High3 Medium4 Low
CriticalAi Agent Control Hijackscripts/install-opencode-agents.js
CriticalPrevious Version Dangerous Deltadist/commands/init.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/utils/checkUpdate.js
HighRuntime Package Installdist/commands/upgrade.js
MediumEnvironment Vars
MediumInstall Persistencescripts/install-opencode-agents.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to ryo-framework@3.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing ryo-framework@3.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.