Loading npm security reports…

ryo-framework@2.3.9: AI-agent policy block | LPM Firewall

registry / ryo-framework / 2.3.9

ryo-framework@2.3.9

Build production-ready software with AI using real engineering principles.

AI Security Review

scanned 20d ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. Global npm install mutates OpenCode agent configuration and shell startup files at install time. This changes an AI-agent control surface without a user-invoked ryo opencode-setup command.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm global install running postinstall

Impact

Installs package-supplied agents with edit/bash permissions into the user's OpenCode config and adds shell completion eval to rc files.

Mechanism

install-time OpenCode agent/config drop and shell rc modification

Policy narrative

On global installation, the postinstall script copies package-provided OpenCode agent files into the user's global OpenCode config and merges agent definitions that grant edit/bash capability for several roles. It also modifies shell rc files for completion. The agent content is not itself exfiltrative, but the install-time, unprompted AI-agent control-surface mutation is concrete and policy-relevant.

Rationale

The package performs unconsented lifecycle mutation of a global AI-agent configuration surface, including agents with bash/edit permissions, during postinstall. Other risky primitives appear package-aligned, but the lifecycle OpenCode config write is enough to block. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.

Evidence

package.jsonscripts/install-opencode-agents.jsopencode.json.opencode/agents/backend.md.opencode/agents/tester.mddist/utils/checkUpdate.jsdist/utils/offline.js

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-opencode-agents.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/utils/checkUpdate.jsView file

9exports.getPendingNotification = getPendingNotification; L10: const child_process_1 = require("child_process"); L11: const fs_1 = __importDefault(require("fs"));

High

Child Process

Package source references child process execution.

dist/utils/checkUpdate.jsView on unpkg · L9

scripts/install-opencode-agents.jsView file

1Install-time AI-agent control hijack evidence: L10: const home = os.homedir(); L11: const sourceDir = path.resolve(__dirname, "..", ".opencode", "agents"); L12: const sourceConfig = path.resolve(__dirname, "..", "opencode.json"); ... L28: for (const dir of agentDirs) { L29: fs.mkdirSync(dir, { recursive: true }); L30: for (const file of agentFiles) { L31: fs.copyFileSync(path.join(sourceDir, file), path.join(dir, file)); L32: } ... L49: L50: fs.writeFileSync(targetConfig, JSON.stringify(merged, null, 2) + "\n"); L51: } ... L82: content += "\n" + completionBlock + "\n"; Payload evidence from official-skills/database/prisma/SKILL.md: L1: # prisma Skill L2:

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/install-opencode-agents.jsView on unpkg · L1

4L5: const isGlobal = process.env.npm[redacted] === "true"; L6: if (!isGlobal) { ... L9: L10: const home = os.homedir(); L11: const sourceDir = path.resolve(__dirname, "..", ".opencode", "agents"); ... L36: if (fs.existsSync(sourceConfig)) { L37: const ourConfig = JSON.parse(fs.readFileSync(sourceConfig, "utf8")); L38: const existingConfig = fs.existsSync(targetConfig) ... L64: if (shell.includes("zsh")) { L65: rcFiles.push(".zshrc"); L66: } else if (shell.includes("bash")) {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/install-opencode-agents.jsView on unpkg · L4

dist/commands/upgrade.jsView file

64try { L65: (0, child_process_1.execSync)("npm install -g ryo-framework@latest", { L66: stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/upgrade.jsView on unpkg · L64

dist/utils/offline.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = ryo-framework@2.3.6 matchedIdentity = npm:cnlvLWZyYW1ld29yaw:2.3.6 similarity = 0.769 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/utils/offline.jsView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 13-53json

13 "official-skills/",

14 "registry/",

15 "templates/",

16 ".opencode/",

17 "opencode.json",

18 "scripts/",

19 "README.md",

20 "CHANGELOG.md",

21 "LICENSE",

22 "package.json"

23 ],

24 "engines": {

25 "node": ">=20"

26 },

27 "scripts": {

28 "build": "tsc",

29 "test": "vitest --run --maxWorkers=1",

30 "coverage": "vitest run --coverage",

31 "lint": "eslint .",

32 "format": "prettier --write .",

33 "postinstall": "node scripts/install-opencode-agents.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

34 },

35 "repository": {

36 "type": "git",

37 "url": "git+https://github.com/baguskara1/ryo-engineering-framework.git"

38 },

39 "keywords": [

40 "ryo",

41 "engineering",

42 "framework",

43 "ai",

44 "cli",

45 "skills",

46 "templates"

47 ],

48 "author": "Ryo Framework",

49 "license": "MIT",

50 "bugs": {

51 "url": "https://github.com/baguskara1/ryo-engineering-framework/issues"

52 },

53 "homepage": "https://github.com/baguskara1/ryo-engineering-framework#readme",

dist/utils/checkUpdate.jsView file

Lines 1-29javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod :

scripts/install-opencode-agents.jsView file

Lines 1-24javascript

1const fs = require("fs");

2const path = require("path");

3const os =

dist/commands/upgrade.jsView file

Lines 44-84javascript

44 timeout: 10000,

45 })

46 .toString()

47 .trim();

48 }

49 catch {

50 logger_1.logger.warning(

dist/utils/offline.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = ryo-framework@2.3.6 matchedIdentity = npm:cnlvLWZyYW1ld29yaw:2.3.6 similarity = 0.769 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/utils/offline.jsView on unpkg