CLAIM-2026-09-29-05

The mechanism is a content-type confusion: the /global/upgrade endpoint parsed the request body as JSON without validating Content-Type, so an HTML form with enctype text/plain - which browsers permit cross-origin - reached it, and the endpoint then ran npm install -g opencode-ai@${target} where npm interprets the target as a package specifier that may be a URL to a tarball, whose preinstall script executes.

Why it matters

Three ordinary behaviours compose into remote code execution: a permissive parser, a browser rule, and a package manager's specifier syntax. Each is defensible alone.

Sources

• datadogsecu2026discoveri