Malicious code in opencode-engos-ai (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (42180a034d43d3c6d16e223fe6fcd93f6e403f0c73c763e9b21b6aded0545274) On npm install, postinstall.mjs enumerates platform-specific sibling package names of the form opencode-engos-<platform>-<arch>[-baseline][-musl], resolves each to the current 'latest' tag via `npm view <name> version`, installs the resolved version into a temp directory, then copies the fetched 'opencode' binary into the wrapper's bin/ with chmod 755. The fetched artifact is not pinned to a specific version and is not hash- or signature-verified, so whatever the publisher of the sibling packages pushes to 'latest' at install time is what executes on the installer's host. The sibling package names are not declared in the manifest's optionalDependencies, so they are resolved by name rather than through the reviewable dependency graph. In addition, createSymlinks() writes symlinks at /usr/local/bin/innexarcode and /usr/bin/innexarcode pointing at the fetched binary — a name that matches neither the package name (opencode-engos-ai), its declared bin entry (opencode-engos), nor any documented CLI, placing an unrelated command into the installer's system PATH. The package name also resembles the existing 'opencode' AI CLI.
AI Analysis
Technical Summary
The opencode-engos-ai npm package, specifically versions 1.20.3, 1.20.4, 1.20.5, and 1.20.6, includes a post-install script that dynamically fetches and installs platform-specific sibling packages by resolving their 'latest' versions without pinning or verifying integrity. This allows the publisher of those sibling packages to push arbitrary code that will be executed on the installer's host. Additionally, the package creates symlinks named 'innexarcode' in system PATH locations (/usr/local/bin and /usr/bin) pointing to the fetched binary, which is unrelated to the package name or declared CLI commands, potentially misleading users and enabling stealthy execution of malicious code.
Potential Impact
Because the package fetches and executes unpinned, unverified binaries from sibling packages at install time, an attacker controlling those sibling packages can execute arbitrary code on the host system during installation. The creation of symlinks with unrelated command names in system PATH further increases the risk of stealthy execution and user confusion. This can lead to system compromise or persistence of malicious code.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing affected versions (=1.20.3, =1.20.4, =1.20.5, =1.20.6) of opencode-engos-ai. Verify package integrity and avoid packages that dynamically fetch unpinned dependencies or create unexpected system-wide symlinks. Monitor vendor advisories for updates or fixes addressing this issue.
Malicious code in opencode-engos-ai (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (42180a034d43d3c6d16e223fe6fcd93f6e403f0c73c763e9b21b6aded0545274) On npm install, postinstall.mjs enumerates platform-specific sibling package names of the form opencode-engos-<platform>-<arch>[-baseline][-musl], resolves each to the current 'latest' tag via `npm view <name> version`, installs the resolved version into a temp directory, then copies the fetched 'opencode' binary into the wrapper's bin/ with chmod 755. The fetched artifact is not pinned to a specific version and is not hash- or signature-verified, so whatever the publisher of the sibling packages pushes to 'latest' at install time is what executes on the installer's host. The sibling package names are not declared in the manifest's optionalDependencies, so they are resolved by name rather than through the reviewable dependency graph. In addition, createSymlinks() writes symlinks at /usr/local/bin/innexarcode and /usr/bin/innexarcode pointing at the fetched binary — a name that matches neither the package name (opencode-engos-ai), its declared bin entry (opencode-engos), nor any documented CLI, placing an unrelated command into the installer's system PATH. The package name also resembles the existing 'opencode' AI CLI.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The opencode-engos-ai npm package, specifically versions 1.20.3, 1.20.4, 1.20.5, and 1.20.6, includes a post-install script that dynamically fetches and installs platform-specific sibling packages by resolving their 'latest' versions without pinning or verifying integrity. This allows the publisher of those sibling packages to push arbitrary code that will be executed on the installer's host. Additionally, the package creates symlinks named 'innexarcode' in system PATH locations (/usr/local/bin and /usr/bin) pointing to the fetched binary, which is unrelated to the package name or declared CLI commands, potentially misleading users and enabling stealthy execution of malicious code.
Potential Impact
Because the package fetches and executes unpinned, unverified binaries from sibling packages at install time, an attacker controlling those sibling packages can execute arbitrary code on the host system during installation. The creation of symlinks with unrelated command names in system PATH further increases the risk of stealthy execution and user confusion. This can lead to system compromise or persistence of malicious code.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing affected versions (=1.20.3, =1.20.4, =1.20.5, =1.20.6) of opencode-engos-ai. Verify package integrity and avoid packages that dynamically fetch unpinned dependencies or create unexpected system-wide symlinks. Monitor vendor advisories for updates or fixes addressing this issue.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12405
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a735741bf8831d5391575c0
Added to database: 08/05/2026, 15:31:13 UTC
Last enriched: 08/05/2026, 17:04:19 UTC
Last updated: 09/07/2026, 22:19:53 UTC
Views: 21
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.