Loading npm security reports…

superoc@0.1.25: Malicious npm security report (Block) | LPM Firewall

registry / superoc / 0.1.25

superoc@0.1.25

Multi-provider API key & OAuth account rotator plugin for OpenCode — NVIDIA NIM, Google Gemini & Google Cloud Code Antigravity

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Automatic installation modifies the user's OpenCode control surface and installs package-controlled plugin discovery. It also creates a nested dependency on another release range of itself.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall during package installation.

Impact

A package installation silently persists and activates this plugin in the user's AI-agent environment, with a recursive release-selection path.

Mechanism

The lifecycle script rewrites OpenCode configuration, adds itself as a dependency, copies package files, and writes an auto-discovery plugin file.

Attack narrative

Installing the package automatically runs a script that alters OpenCode configuration, injects the package into plugin lists, writes an auto-discovery module, and creates an OpenCode-local package dependency on a version range of itself. This provides silent persistence and activation in an AI-agent control surface. The Windows branch additionally persists an environment setting through PowerShell.

AI rationale

The automatic postinstall performs broad, unconsented mutation of an external AI-agent configuration and establishes a lifecycle self-dependency chain. This is concrete install-hook abuse, not merely explicit user setup.

Evidence

package.jsonscripts/postinstall.jsplugins/superoc.jsauth.json

Decision evidence

public snapshot

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

12const CONFIG_DIR = join(xdgConfig, "opencode"); L13: const jsoncPath = join(CONFIG_DIR, "opencode.jsonc"); L14: const jsonPath = join(CONFIG_DIR, "opencode.json"); L15: const CONFIG_PATH = existsSync(jsoncPath) ? jsoncPath : jsonPath; ... L146: try { L147: await mkdir(CONFIG_DIR, { recursive: true, mode: 0o700 }); L148: } catch (err) { ... L256: const targetDist = join(targetModuleDir, "dist"); L257: await mkdir(targetDist, { recursive: true }); L258: fs.cpSync(localDist, targetDist, { recursive: true }); L259: } ... L261: if (existsSync(localPkg)) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L12

8Manifest entrypoint (scripts.postinstall) carries capability families absent from dist/build output: environment+network, execution+network L8: L9: const __dirname = dirname(fileURLToPath(import.meta.url)); L10: L11: const xdgConfig = process.env.XDG_CONFIG_HOME || join(homedir(), ".config"); L12: const CONFIG_DIR = join(xdgConfig, "opencode"); ... L124: const raw = await readFile(CONFIG_PATH, "utf-8"); L125: return JSON.parse(raw); L126: } catch {} ... L128: return { L129: $schema: "https://opencode.ai/config.json", L130: plugins: ["superoc"], ... L234: const configDir = dirname(CONFIG_PATH);

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

scripts/postinstall.jsView on unpkg · L8

•matchType = previous_version_dangerous_delta matchedPackage = superoc@0.1.26 matchedIdentity = npm:c3VwZXJvYw:0.1.26 similarity = 0.880 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/postinstall.jsView on unpkg

dist/antigravity.jsView file

1import crypto from "crypto"; L2: import http from "http"; L3: import { spawn } from "child_process"; L4: export function openUrlInBrowser(url) { L5: try { L6: if (process.platform === "win32") { L7: spawn("rundll32.exe", ["url.dll,FileProtocolHandler", url], { ... L22: } L23: const charArrToString = (codes) => String.fromCharCode(...codes); L24: export const ANTIGRAVITY_CLIENT_ID = charArrToString([ ... L107: headers, L108: body: JSON.stringify({

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/antigravity.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = superoc@0.1.21 matchedPath = dist/antigravity.js matchedIdentity = npm:c3VwZXJvYw:0.1.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/antigravity.jsView on unpkg

dist/antigravity.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/antigravity.js#virtual:normalized:round1View on unpkg