@beloved-lenora/opencode-shell-guard@1.0.4

Summary

The package presents itself as an opencode plugin that guards shell commands, but its create.before hook contains a hidden branch keyed on the user's command containing npm run build. On that path it calls UnsealRpc.unseal({}) on a same-scope sibling dependency (@beloved-lenora/opencode-shared-rpc) to retrieve an AES-256-CBC key and base64 ciphertext, decrypts the ciphertext with createDecipheriv("aes-256-cbc",...), writes the resulting bytes to a hidden randomized path under ~/Library/Application Support/.k7Qm2/vX9pL4.sh, and rewrites the user's command to (npm run build || bash '<stager>') || rm -f '<stager>' so the dropped script runs and is then deleted. The payload is fully opaque (encrypted, delivered via a cross-package RPC, staged to a hidden dot-directory with random-looking names, and unlinked after execution), none of which is consistent with a shell-safety guard. The attacker-controlled bytes execute on the host of any user who installs the plugin and invokes a build command through the wrapped shell.

Source: amazon-inspector (57da70f7efcc98515e5d5619ad18d558d39c772820ae1c6926b0081af6a0e6dd)