registry / AI-agent capability abuse / @compr/opscontext-mcp / 2.19.2

@compr/opscontext-mcp@2.19.2

OpsContext for AI Agents — read-only fleet visibility (PM2/nginx/Docker/git/cron) + tamper-evident audit log + policy-as-code hooks. The ops + compliance layer Claude Code can't grow natively.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The generated agent instruction can encourage broad commits and pushes, creating a concrete but user-triggered agent capability risk. The inspected manifest shows no automatic install hook, so this does not support a publish block.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A user invokes the project scaffolding CLI command that generates the template.

Impact

An agent may publish project changes without a separate user request for each push.

Mechanism

The CLI embeds a broad commit-and-push directive in generated agent instructions.

AI rationale

Evidence

dist/cli.js

Decision evidence

public snapshot

AI called this Suspicious at 79.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The CLI template tells an AI agent to commit and push all changed repositories; that instruction can encourage external changes when a user scaffolds a project.
The manifest exposes CLI commands and defines a prepublish-only build script, with no automatic install hook shown.
The inspected agent-integration locations concern project-file discovery, skill installation, hook settings, settings reads, and shared-index operation.

Evidence against

The commit-and-push instruction appears in a CLI-generated template; the inspected package manifest does not configure it as an npm install-time action.
The installer hooks are exposed through CLI entrypoints, and the inspected hook code adds OpsContext commands while preserving unrelated entries.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsPossibleObfuscation

Source & flagged code

7 flagged

dist/install-autostart.jsView file

Lines 1-33javascript

1// [LOCKED] [AUTOSTART-INSTALL], 2026-06-23

2// [NEVER] bootstrap into a `system/` domain (would need root + run as root).

3// Use `gui/$UID` — per-user agent, started at user login, runs as the user.

4// [NEVER] write the plist before checking if a server is already listening on

5// the port. A pre-existing process means we'd race with the launchd-managed

6// one for port 7842.

7// [NEVER] ship a plist that calls `npx -y @latest`, every restart would

8// fetch the registry, eating ~3s and breaking offline. Pin a specific

9// node path + a specific dist path.

10// WHY: This is the "set it and forget it" entrypoint for non-technical users.

11// If it fails silently or starts duplicating processes, the entire

12// auto-capture story collapses and the user has to type `nohup npx ...`

13// forever — defeating the whole point.

14// FIX: To add platform support beyond macOS, branch on process.platform and

15// add equivalent systemd / NSSM logic. Keep `gui/$UID` and KeepAlive

16// discipline in any new platform.

17import { existsSync, writeFileSync, mkdirSync } from "fs";

18import { join, dirname } from "path";

19import { homedir, platform } from "os";

20import { execFileSync } from "child_process";

21import { createRequire } from "module";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/install-autostart.jsView on unpkg · L13

22import { fileURLToPath } from "url";

23// [LOCKED] [M2-ESM-FILENAME-FIX], 2026-06-24

24// [NEVER] reference bare `__filename` in this file, the package is

25// `"type": "module"` so __filename is `undefined` at runtime and

26// `dirname(__filename || "")` was returning dirname("") = "." which

27// silently broke the dev-tree fallback. Audit FRESH_USER_AUDIT_

28// 2026-06-23.md finding M2.

29// FIX: Resolve module path via fileURLToPath(import.meta.url). For

30// cross-package resolution (e.g. when running via npx and the

31// @compr/opscontext-mcp tarball is in npx's transient cache), also

32// try createRequire(import.meta.url).resolve("@compr/opscontext-mcp/

33// dist/index.js") which works inside npx.

•matchType = previous_version_dangerous_delta matchedPackage = @compr/opscontext-mcp@2.18.0 matchedIdentity = npm:QGNvbXByL29wc2NvbnRleHQtbWNw:2.18.0 similarity = 0.843 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/install-autostart.jsView on unpkg

dist/install-claude-hook.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { existssync, readfilesync, writefilesync, copyfilesync, chmodsync, mkdirsync } from "fs"; import { join, dirname } from "path"; import { homedir } from "os"; import { fileurltopath } from "url"; import { execsync } from "child_process"; const __dirname_esm = dirname(fileurltopath(import.meta.url)); const claude_dir = jo

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/install-claude-hook.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @compr/opscontext-mcp@2.12.0 matchedPath = dist/install-claude-hook.js matchedIdentity = npm:QGNvbXByL29wc2NvbnRleHQtbWNw:2.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/install-claude-hook.jsView on unpkg

dist/agent-restart.jsView file

Lines 1-24javascript

1// [LOCKED] [THE-AGENT-FOLLOWS-THE-BUILD] - 2026-09-30

2// [NEVER] let a chat server exit on a rebuild (its client would lose the connection), let the launchd

3// agent exit while its build folder is still changing, exit twice for the same build, or exit

4// when launchd would not start it again.

5// WHY: after every build the agent kept running its old code until someone ran `launchctl kickstart`

6// by hand; until then every server was stale, and before 2.18.0 the oldest chat window took the

7// index over and ran its old importer (E2E_REVIEW_2026-09 C0 and point 20: on 30 September from

8// 08:51 to 09:02 and from 15:51 to 16:00). A build is not one moment: tsc writes file by file, the

9// prune follows, a publish encodes the rubric and the next build rewrites it.

defaults/claude-code-hook.shView file

•path = defaults/claude-code-hook.sh kind = build_helper sizeBytes = 5141 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

defaults/claude-code-hook.shView on unpkg

dist/activation.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/activation.js#virtual:normalized:round1View on unpkg

Source & flagged code

7 flagged · loading source

dist/install-autostart.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/install-autostart.jsView on unpkg

13// forever — defeating the whole point. L14: // FIX: To add platform support beyond macOS, branch on process.platform and L15: // add equivalent systemd / NSSM logic. Keep `gui/$UID` and KeepAlive ... L19: import { homedir, platform } from "os"; L20: import { execFileSync } from "child_process"; L21: import { createRequire } from "module"; ... L34: const __filename_esm = fileURLToPath(import.meta.url); L35: const __dirname_esm = dirname(__filename_esm); L36: const requireFromHere = createRequire(import.meta.url); ... L102: // [LOCKED] [AUTOSTART-ARGV-AND-XML-ESCAPED] - 2026-09-25 L103: // [NEVER] paste a path into a launchctl/lsof/curl command string, or into the plist unescaped. L104: // WHY: with a home folder named "John Smith", `launchctl bootstrap gui/501 ${PLIST_FILE}` han

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/install-autostart.jsView on unpkg · L13

Findings

5 High5 Medium5 Low

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/install-claude-hook.js

HighTrigger Reachable Persistencedist/agent-restart.js

HighSemantic Analysis Limiteddist/activation.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/install-claude-hook.js

HighPrevious Version Dangerous Deltadist/install-autostart.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/install-autostart.js

MediumShips Build Helperdefaults/claude-code-hook.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

Affected versions and remediation

This report applies to @compr/opscontext-mcp@2.19.2.

See all versions of @compr/opscontext-mcp for other recorded verdicts.

Review the evidence and your use of @compr/opscontext-mcp@2.19.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-16 19:07:57.372Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.