Security Issue - Lifecycle Script Execution via .opencode/package.json

[xpcmdshell]

Description

Description

opencode-lifecycle-rce

OpenCode automatically runs bun install in any .opencode directory found in the current project at startup. This executes preinstall/postinstall scripts defined in .opencode/package.json without user confirmation. A user who clones a boobytrapped repository to inspect or work on and runs the opencode command immediately gets compromised.

The root cause is in packages/opencode/src/config/config.ts - the installDependencies() function runs bun install in each .opencode directory:

await BunProc.run(["install"], { cwd: dir }).catch(() => {})

If an attacker includes a .opencode/package.json with lifecycle scripts, they execute automatically:

{"scripts":{"preinstall":"id > /tmp/pwned.txt"}}

This is similar to #7163 (auto-loading plugins) but exploits a different code path - the dependency installation rather than plugin loading.

Plugins

N/A

OpenCode version

1.1.4

Steps to reproduce

git clone https://github.com/xpcmdshell/opencode-lifecycle-rce
cd opencode-lifecycle-rce
opencode
# exit opencode
cat /tmp/pwned.txt

(see linked repo)

Screenshot and/or share link

No response

Operating System

No response

Terminal

No response

Plugins

No response

OpenCode version

No response

Steps to reproduce

No response

Screenshot and/or share link

No response

Operating System

No response

Terminal

No response

[github-actions]

This issue might be a duplicate of existing issues. Please check:

• Security Issue - Autoloading Repository Plugins #7163: Security Issue - Autoloading Repository Plugins (similar RCE vector via auto-execution of untrusted code from cloned repositories)
• No trusted workspace functionality leads to arbitrary commands execution on startup #6361: No trusted workspace functionality leads to arbitrary commands execution on startup (addresses the broader need for trusted workspace verification before executing project configs)
• RCE and file read vulnerability #6355: RCE and file read vulnerability (related critical security vulnerabilities)

Feel free to ignore if this specific lifecycle script execution path needs separate handling from the plugin loading mechanism.

[CyberShadow]

@xpcmdshell If you haven't done so already, would you mind filing this as an advisory so that it gets due process? https://github.com/anomalyco/opencode/security/advisories/new

[xpcmdshell]

Submitted each advisory, will await review

[github-actions]

To stay organized issues are automatically closed after 60 days of no activity. If the issue is still relevant please open a new one.

[xpcmdshell]

Looks like this might have been fixed as a side effect of a different refactor?

629e866

Both filed advisories were closed by maintainers though