opencode-optimised-toolings

{"modified":"2026-08-06T23:29:20Z","published":"2026-08-06T19:19:05Z","schema_version":"1.7.4","id":"MAL-2026-13452","summary":"Malicious code in opencode-optimised-toolings (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ae3527290ef726079347fab842fc46c8df96f07e2fa1734ebed7ee6ab10ed22c)\nOn plugin load, opencode-optimised-toolings@4.0.0 runs SelfPatchPlugin.runSelfPatch() without user prompt. It downloads an OpenCode source tarball from a non-publisher GitHub repository (github.com/anomalyco/opencode, distinct from the upstream sst/opencode project), runs `bun install` and a build inside the extracted tree, then in installPatchedBinary renames the user's on-PATH opencode executable aside to `<officialPath>.alonix-toolings-backup` / `.alonix-toolings-incoming-<ts>` and copies the newly built binary into its original path. All subsequent invocations of `opencode` on the host — including outside this plugin's context — then execute the author-built binary under the trusted CLI name, giving the author persistent code execution with the user's privileges. Persistence is reinforced by migrateInstalledConfig, which on each load rewrites `~/.config/opencode/opencode.jsonc`, injects an ALONIX-marked block into `AGENTS.md`, and pins `opencode-optimised-toolings@latest` in `~/.config/opencode/tui.json`, ensuring the self-patch pipeline continues to run on future opencode launches. The upstream archive URL uses a mutable version tag with no full-tree hash or signature verification; the manifest fingerprints only ~7 files while the entire tarball is compiled into the replacement binary.\n","affected":[{"package":{"ecosystem":"npm","name":"opencode-optimised-toolings"},"versions":["3.4.0","4.0.0","4.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"packages/selfpatch/lib/pipeline.js","sha256":"a77759848bcc2b946b927e34354538c8ec88214e5a3eb181da666765684252d0","tlsh":"4ee2c86324f802724f4266d0a96f12666335c227750a2c94fa8d42d43f5e17ecbf7eda"},{"path":"packages/bootstrap/index.js","sha256":"047bf11b0bb9a18a1e5092326f98b9f7bee640b3b3aa74f7e9ea207e0b5162f3","tlsh":"c5029443b1bc1f734f812ba4a01390b87e395bd03254ca82f65d77d8b80a6a5d1e79ed"}],"package_integrity":[{"filename":"opencode-optimised-toolings-3.4.0.tgz","hashes":{"sha1":"a62635f677a50f173f9b9b8d8bc472b68ad7d88e","sha512_sri":"sha512-OGuKm645nXU3E6oJIfN66V/C+wcnglWYEjeNWz2sCrcWgWpQCseoVGTPq4XMdP1GDRB6C+pAV/WcwbAvUf6hOw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/opencode-optimised-toolings/v/3.4.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/opencode-optimised-toolings/v/4.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/opencode-optimised-toolings/v/4.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016762","import_time":"2026-08-06T23:25:08.040199789Z","modified_time":"2026-08-06T19:20:26Z","sha256":"0d4488f61e4913693c997835e87c7cda48edd9b78ff2d46bcc7f63aac3add4de","source":"amazon-inspector","versions":["3.4.0"]},{"id":"IN-MAL-2026-016759","import_time":"2026-08-06T23:25:07.880051591Z","modified_time":"2026-08-06T19:19:17Z","sha256":"ae3527290ef726079347fab842fc46c8df96f07e2fa1734ebed7ee6ab10ed22c","source":"amazon-inspector","versions":["4.0.0"]},{"id":"IN-MAL-2026-016758","import_time":"2026-08-06T23:25:07.853193302Z","modified_time":"2026-08-06T19:19:05Z","sha256":"c75daf71b125e1c15e63f163138bf519bb16260cbb3bfe034c98bbff6e80feb1","source":"amazon-inspector","versions":["4.0.1"]}]}}