@compr/opscontext-mcp@2.19.1
OpsContext for AI Agents — read-only fleet visibility (PM2/nginx/Docker/git/cron) + tamper-evident audit log + policy-as-code hooks. The ops + compliance layer Claude Code can't grow natively.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package has no install lifecycle trigger, but init defaults to installing a post-commit hook in noninteractive use. Because that hook pushes commits to configured remotes without per-commit confirmation, this presents a concrete residual risk and warrants a warning.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A user runs the package's init command; this setup also proceeds by default when standard input is noninteractive.
Impact
Later commits may be sent to configured remotes without a separate confirmation for each push.
Mechanism
The command writes a project Git post-commit hook that runs background pushes to origin and gdrive after each commit.
AI rationale
The package has no install lifecycle trigger, but init defaults to installing a post-commit hook in noninteractive use. Because that hook pushes commits to configured remotes without per-commit confirmation, this presents a concrete residual risk and warrants a warning.
Evidence
dist/cli.js.git/hooks/post-commit
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json has no install-time lifecycle hook; its prepublishOnly script is release work.
- The init command is an explicit CLI action, and noninteractive mode automatically answers yes to setup prompts.
- The post-commit prompt labels the hook as auto-push and allows an interactive user to decline; otherwise init writes .git/hooks/post-commit.
- The generated hook asynchronously pushes the current branch to the configured origin and gdrive remotes after commits.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
7 flagged · loading sourcedist/install-autostart.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @compr/opscontext-mcp@2.18.0
matchedIdentity = npm:QGNvbXByL29wc2NvbnRleHQtbWNw:2.18.0
similarity = 0.882
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/install-autostart.jsView on unpkg13// forever — defeating the whole point.
L14: // FIX: To add platform support beyond macOS, branch on process.platform and
L15: // add equivalent systemd / NSSM logic. Keep `gui/$UID` and KeepAlive
...
L19: import { homedir, platform } from "os";
L20: import { execFileSync } from "child_process";
L21: import { createRequire } from "module";
...
L34: const __filename_esm = fileURLToPath(import.meta.url);
L35: const __dirname_esm = dirname(__filename_esm);
L36: const requireFromHere = createRequire(import.meta.url);
...
L102: // [LOCKED] [AUTOSTART-ARGV-AND-XML-ESCAPED] - 2026-09-25
L103: // [NEVER] paste a path into a launchctl/lsof/curl command string, or into the plist unescaped.
L104: // WHY: with a home folder named "John Smith", `launchctl bootstrap gui/501 ${PLIST_FILE}` han
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/install-autostart.jsView on unpkg · L13Findings
5 High5 Medium5 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/install-claude-hook.js
HighTrigger Reachable Persistencedist/agent-restart.js
HighSemantic Analysis Limiteddist/activation.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/install-claude-hook.js
HighPrevious Version Dangerous Deltadist/install-autostart.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/install-autostart.js
MediumShips Build Helperdefaults/claude-code-hook.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @compr/opscontext-mcp@2.19.1.
See all versions of @compr/opscontext-mcp for other recorded verdicts.
- Review the evidence and your use of @compr/opscontext-mcp@2.19.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.