GHSA-632h-h47v-g4x4: A Web Page Can Make `opencode serve` npm-Install an Attacker Tarball and Run Its Preinstall Script

Datadog Security Labs (Christophe Tafani-Dereeper) published GHSA-632h-h47v-g4x4 on 24 September 2026, the same day Anomaly published the advisory for OpenCode. The local HTTP server started by `opencode serve` / `opencode web` (127.0.0.1:4096, unauthenticated unless OPENCODE_SERVER_PASSWORD is set) exposes POST /global/upgrade. On npm, pnpm or Bun installs the handler ran `npm install -g opencode-ai@${target}` with `target` taken straight from the request body, and npm accepts a remote tarball URL as a package spec, so any URL became an install whose preinstall lifecycle script ran on the developer machine. The handler also parsed the body as JSON without checking Content-Type, which made it reachable cross-site: a malicious page submits a top-level `enctype="text/plain"` HTML form whose name/value pair concatenates into valid JSON, and top-level navigations are not stopped by CORS preflight or the browsers' Local Network Access prompts. Visiting the page is enough. If a password is set, cached HTTP Basic credentials are replayed by the same navigation. Datadog counted more than 647,000 npm downloads of the 82 vulnerable versions in the week of 17 to 23 September (38.9 percent of OpenCode downloads that week). Anomaly fixed it in 1.18.22 on 24 August (semver-only target, Content-Type enforced) and did not request a CVE.

You are affected if you run OpenCode (opencode-ai) 1.14.30 through 1.18.21 installed via npm, pnpm or Bun, while `opencode serve` or `opencode web` is running without a password (or with Basic credentials cached in the browser). curl, Homebrew, Chocolatey and Scoop installs are not exposed to this path. Fixed in 1.18.22. No CVE assigned.. Versions 1.18.22 and later include the fix.

Upgrade OpenCode to 1.18.22 or later on every machine, and confirm how it was installed with `ls -l "$(command -v opencode)"`, since only npm/pnpm/Bun installs take the attacker tarball path. Do not leave `opencode serve` or `opencode web` running in the background; when you need it, set OPENCODE_SERVER_PASSWORD and close the browser afterwards so cached Basic credentials are dropped. Treat any local agent HTTP server that can upgrade, install or execute as reachable from every web page the developer opens, because top-level form posts bypass CORS and Local Network Access. If a vulnerable npm-managed install ran `serve`/`web` while the user browsed untrusted sites, check global npm packages and shell history for an unexpected opencode-ai tarball and rotate provider API keys held in the OpenCode config.

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run OpenCode and which version, then enforce a policy on it.