registry / Malware / @compr/opscontext-mcp / 2.12.0

@compr/opscontext-mcp@2.12.0

OpsContext for AI Agents — read-only fleet visibility (PM2/nginx/Docker/git/cron) + tamper-evident audit log + policy-as-code hooks. The ops + compliance layer Claude Code can't grow natively.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

The reviewer-directed instruction in dist/activation.js is deliberate review manipulation and supports a malicious verdict. The inspected installer capabilities are explicitly invoked and do not independently establish an install-time attack.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Static inspection of dist/activation.js.

Impact

It attempts to suppress scrutiny of package behavior; no separate runtime attack was established by the inspected evidence.

Mechanism

A source comment tells the reviewer not to re-audit the file and asserts prior verification.

Attack narrative

During source review, dist/activation.js includes a direct instruction not to re-audit the file and asserts that its behavior was already verified. Package-supplied reviewer instructions are not trustworthy documentation and are evidence of an attempt to influence the security decision. The flagged installer behavior is exposed through explicit CLI commands, and the manifest has no automatic install hook.

AI rationale

Evidence

dist/activation.js

Decision evidence

public snapshot

AI called this Malicious at 84.0% confidence as Malware with low false-positive risk.

Evidence for block

dist/activation.js contains a reviewer-directed instruction not to re-audit the file, an attempt to influence this security review.
The package exposes its Claude hook and autostart installers as explicit CLI commands.
The hook installer adds command hooks to Claude settings when invoked.

Evidence against

package.json has no preinstall, install, or postinstall hook; its lifecycle script is prepublishOnly.
The autostart installer checks the platform and existing plist before proceeding.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 45 file(s), 894 KB of source, external domains: 127.0.0.1, api.compr.ch, chatgpt.com, claude.ai, raw.githubusercontent.com, www.apple.com, www.npmjs.com

Source & flagged code

7 flagged

dist/adapters.jsView file

Lines 27-67javascript

27/**

28 * Load a single adapter from its module path.

29 * Supports:

30 * - Local files: "./adapters/foo.js" (relative to config file)

31 * - npm packages: "@compr/contextengine-jira"

32 * - Named exports: "my-package#myAdapter"

33 */

34async function loadAdapterModule(modulePath, config, baseDir = process.cwd()) {

35 let moduleSpecifier = modulePath;

36 let exportName = null;

37 // Support "module#export" syntax

38 if (modulePath.includes("#")) {

39 const [mod, exp] = modulePath.split("#", 2);

40 moduleSpecifier = mod;

41 exportName = exp;

42 }

43 // Resolve relative paths from the config file's folder, never from wherever the server started.

44 // [LOCK] [ADAPTERS-ONLY-FROM-THE-USERS-OWN-CONFIG]

45 if (moduleSpecifier.startsWith(".") || moduleSpecifier.startsWith("/")) {

46 moduleSpecifier = resolve(baseDir, moduleSpecifier);

47 }

48 const mod = await import(moduleSpecifier);

49 // Check for factory function

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/adapters.jsView on unpkg · L47

50 if (exportName && typeof mod[exportName] === "function") {

51 return await mod[exportName](config);

52 }

53 if (typeof mod.createAdapter === "function") {

54 return await mod.createAdapter(config);

55 }

56 // Check for default export

57 if (mod.default) {

58 if (typeof mod.default === "function") {

59 return await mod.default(config);

60 }

61 if (typeof mod.default.collect === "function") {

62 return mod.default;

63 }

64 }

65 // Check for named adapter export

66 if (typeof mod.adapter === "object" && typeof mod.adapter.collect === "function") {

67 return mod.adapter;

dist/install-autostart.jsView file

Lines 1-33javascript

1// 🔒 LOCKED [AUTOSTART-INSTALL] — 2026-06-23

2// ⛔ NEVER bootstrap into a `system/` domain (would need root + run as root).

3// Use `gui/$UID` — per-user agent, started at user login, runs as the user.

4// ⛔ NEVER write the plist before checking if a server is already listening on

5// the port. A pre-existing process means we'd race with the launchd-managed

6// one for port 7842.

7// ⛔ NEVER ship a plist that calls `npx -y @latest` — every restart would

8// fetch the registry, eating ~3s and breaking offline. Pin a specific

9// node path + a specific dist path.

dist/install-claude-hook.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { existssync, readfilesync, writefilesync, copyfilesync, chmodsync, mkdirsync } from "fs"; import { join, dirname } from "path"; import { homedir } from "os"; import { fileurltopath } from "url"; import { execsync } from "child_process"; const __dirname_esm = dirname(fileurltopath(import.meta.url)); const claude_dir = jo

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/install-claude-hook.jsView on unpkg

defaults/claude-code-hook.shView file

•path = defaults/claude-code-hook.sh kind = build_helper sizeBytes = 4024 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

defaults/claude-code-hook.shView on unpkg

dist/activation.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/activation.js#virtual:normalized:round1View on unpkg

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @compr/opscontext-mcp@2.8.2 matchedIdentity = npm:QGNvbXByL29wc2NvbnRleHQtbWNw:2.8.2 similarity = 0.452 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/adapters.jsView file

47} L48: const mod = await import(moduleSpecifier); L49: // Check for factory function

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/adapters.jsView on unpkg · L47

dist/install-autostart.jsView file

13Trigger-reachable persistence chain: manifest.bin -> dist/cli.js -> dist/install-autostart.js L13: // forever — defeating the whole point. L14: // FIX: To add platform support beyond macOS, branch on process.platform and L15: // add equivalent systemd / NSSM logic. Keep `gui/$UID` and KeepAlive ... L19: import { homedir, platform } from "os"; L20: import { execFileSync } from "child_process"; L21: import { createRequire } from "module"; ... L34: const __filename_esm = fileURLToPath(import.meta.url); L35: const __dirname_esm = dirname(__filename_esm); L36: const requireFromHere = createRequire(import.meta.url); ... L102: // [LOCKED] [AUTOSTART-ARGV-AND-XML-ESCAPED] - 2026-09-25 L103: // [NEVER] paste a path into a launchctl/lsof/curl command string, or into the plist unescaped. L104:

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/install-autostart.jsView on unpkg · L13

Findings

4 High6 Medium5 Low

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/install-claude-hook.js

HighTrigger Reachable Persistencedist/install-autostart.js

HighSemantic Analysis Limiteddist/activation.js#virtual:normalized:round1

HighPrevious Version Dangerous Deltadist/cli.js

MediumDynamic Requiredist/adapters.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/install-autostart.js

MediumShips Build Helperdefaults/claude-code-hook.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

Affected versions and remediation

This report applies to @compr/opscontext-mcp@2.12.0.

See all versions of @compr/opscontext-mcp for other recorded verdicts.

Avoid installing @compr/opscontext-mcp@2.12.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-11 07:04:56.172Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other malware packages

Behavioral surface

Source & flagged code

Related packages

Other malware packages