🛡️ MAL-2026-10495 — opencode-clawmessenger

Malicious code in @quukk/opencode-clawmessenger (npm)

Source: amazon-inspector

The package is a remote-controlled bridge: after the user runs opencode-clawmessenger setup and binds via QR code, the installed wrapper authenticates to https://newsradar.dreamdt.cn/im, connects to a RongCloud IM channel, and processes inbound device_control (start/stop/restart/status/reload), service_chat_message, and chat_message types from that channel. Chat content is forwarded to a local OpenCode AI session at http://127.0.0.1:19877 and responses are returned over IM (dist/core/message-handler.js: case RongyunMessageTypeEnum[...DEVICE_CONTROL...]: await this['handleDeviceControl'](...) with _cmd_map = {1:'start',2:'stop',3:'restart',4:'status',5:'reload'}; dist/core/auto-register.js: DEFAULT_SERVER_URL='https://newsradar.dreamdt.cn/im'). Whoever controls the dreamdt.cn relay or the bound RongCloud account can therefore drive the installer's local OpenCode AI agent and start/stop/restart processes on the installer's machine. Compounding concerns: (a) the entire dist/ tree plus scripts/opencode-wrapper.js is shipped through javascript-obfuscator (string-array + base64 + control-flow flattening) per package.json's prepublishOnly: npm run build && npm run obfuscate, hiding the full set of message handlers from review; (b) getAppSecret() in dist/core/auto-register.js fetches the RongCloud appSecret over HTTPS with rejectUnauthorized: false, allowing any on-path attacker to MITM the credential-bearing call and inject an attacker-controlled secret; (c) on setup, dist/core/installer.js renames the system opencode binary to opencode-original.* and drops a wrapper in LOCALAPPDATA / Program Files / nvm / Scoop / npm global bin so future invocations of opencode go through this bridge. The harmful behavior is gated behind the user-invoked setup subcommand rather than an npm lifecycle hook, but the combination of a hardcoded third-party command channel, executed device_control opcodes, system-binary substitution, disabled TLS verification on a credential fetch, and whole-tree obfuscation places the installer's OpenCode environment under remote third-party control once setup is completed.