Loading npm security reports…

superoc@0.1.21: Malicious npm security report (Block) | LPM Firewall

registry / superoc / 0.1.21

superoc@0.1.21

Multi-provider API key & OAuth account rotator plugin for OpenCode — NVIDIA NIM, Google Gemini & Google Cloud Code Antigravity

AI Security Review

scanned 26d ago · by lpm-firewall-ai

Installing the package automatically mutates the user's OpenCode configuration and enables plugin auto-loading. It also creates a self-dependency in OpenCode's package configuration, allowing later lifecycle execution of another superoc release.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall during package installation; later OpenCode plugin loading or package dependency installation.

Impact

The package gains automatic execution through a modified AI-agent configuration, expands web-search permission, and routes OAuth-backed provider traffic through its runtime wrapper.

Mechanism

Install-time OpenCode control-surface mutation and self-dependency persistence.

Attack narrative

On npm installation, postinstall edits the user's OpenCode configuration, adds itself to the plugin list, enables web search, and writes a provider. It then creates an OpenCode package manifest that depends on superoc, copies its runtime files, and drops an auto-discovery plugin module. This establishes recurring execution through a foreign AI-agent control surface. At runtime, the plugin replaces global fetch and handles OAuth tokens for provider requests.

AI rationale

This is a complete automatic lifecycle and self-dependency chain that broadly mutates a foreign AI-agent control surface. The OAuth implementation does not neutralize the unconsented persistence and configuration changes.

Evidence

package.jsonscripts/postinstall.jsdist/index.jsdist/antigravity.js~/.config/opencode/opencode.jsonc or ~/.config/opencode/opencode.json~/.config/opencode/package.json

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

12const CONFIG_DIR = join(xdgConfig, "opencode"); L13: const jsoncPath = join(CONFIG_DIR, "opencode.jsonc"); L14: const jsonPath = join(CONFIG_DIR, "opencode.json"); L15: const CONFIG_PATH = existsSync(jsoncPath) ? jsoncPath : jsonPath; ... L123: try { L124: await mkdir(CONFIG_DIR, { recursive: true, mode: 0o700 }); L125: } catch (err) { ... L206: const targetDist = join(targetModuleDir, "dist"); L207: await mkdir(targetDist, { recursive: true }); L208: fs.cpSync(localDist, targetDist, { recursive: true }); L209: } ... L213: const pluginFile = join(pluginsDir, "superoc.js");

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L12

8Manifest entrypoint (scripts.postinstall) carries capability families absent from dist/build output: environment+network, execution+network L8: L9: const __dirname = dirname(fileURLToPath(import.meta.url)); L10: L11: const xdgConfig = process.env.XDG_CONFIG_HOME || join(homedir(), ".config"); L12: const CONFIG_DIR = join(xdgConfig, "opencode"); ... L103: const raw = await readFile(CONFIG_PATH, "utf-8"); L104: return JSON.parse(raw); L105: } catch {} ... L107: return { L108: $schema: "https://opencode.ai/config.json", L109: plugin: ["superoc"], ... L184: const configDir = dirname(CONFIG_PATH);

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

scripts/postinstall.jsView on unpkg · L8

dist/antigravity.jsView file

1import crypto from "crypto"; L2: import http from "http"; L3: import { spawn } from "child_process"; L4: export function openUrlInBrowser(url) { L5: try { L6: if (process.platform === "win32") { L7: spawn("rundll32.exe", ["url.dll,FileProtocolHandler", url], { ... L22: } L23: const charArrToString = (codes) => String.fromCharCode(...codes); L24: export const ANTIGRAVITY_CLIENT_ID = charArrToString([ ... L107: headers, L108: body: JSON.stringify({

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/antigravity.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = superoc@0.1.19 matchedPath = dist/antigravity.js matchedIdentity = npm:c3VwZXJvYw:0.1.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/antigravity.jsView on unpkg

dist/antigravity.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/antigravity.js#virtual:normalized:round1View on unpkg