@compr/opscontext-mcp@2.4.1
OpsContext for AI Agents — read-only fleet visibility (PM2/nginx/Docker/git/cron) + tamper-evident audit log + policy-as-code hooks. The ops + compliance layer Claude Code can't grow natively.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package is not conclusively malicious, but its activation flow executes opaque server-delivered JavaScript that cannot be audited from the npm package. This is a concrete remote-code-execution risk and should be warned rather than published as clean.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs the activate CLI command with a license key and email.
Impact
A compromised or malicious activation service can execute arbitrary code in the activating user's context.
Mechanism
Remote encrypted module delivery followed by local dynamic import.
AI rationale
The package is not conclusively malicious, but its activation flow executes opaque server-delivered JavaScript that cannot be audited from the npm package. This is a concrete remote-code-execution risk and should be warned rather than published as clean.
Evidence
package.jsondist/activation.jsdist/cli.jsdist/install-claude-hook.jsdist/install-autostart.js~/.contextengine/delta/*.mjs~/.contextengine/delta/manifest.json
Network endpoints1
api.compr.ch/contextengine
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for warning
- User activation posts license and machine details to the vendor API.
- The activation response supplies encrypted modules that are decrypted and written locally.
- The package dynamically imports those server-supplied modules without a package-embedded signature check.
Evidence against
- The manifest has no npm install lifecycle hook.
- Activation requires an explicit CLI command with a license key and email.
- Claude hook and autostart changes are reached only through explicit CLI commands.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
7 flagged · loading sourcedist/adapters.jsView file
46}
L47: const mod = await import(moduleSpecifier);
L48: // Check for factory function
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/adapters.jsView on unpkg · L46dist/install-autostart.jsView file
13Trigger-reachable persistence chain: manifest.bin -> dist/cli.js -> dist/install-autostart.js
L13: // forever — defeating the whole point.
L14: // FIX: To add platform support beyond macOS, branch on process.platform and
L15: // add equivalent systemd / NSSM logic. Keep `gui/$UID` and KeepAlive
...
L19: import { homedir, platform } from "os";
L20: import { execSync } from "child_process";
L21: import { createRequire } from "module";
...
L34: const __filename_esm = fileURLToPath(import.meta.url);
L35: const __dirname_esm = dirname(__filename_esm);
L36: const requireFromHere = createRequire(import.meta.url);
...
L126: <key>StandardOutPath</key>
L127: <string>${join(LOG_DIR, "mcp-stdout.log")}</string>
L128:
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/install-autostart.jsView on unpkg · L13Findings
4 High6 Medium5 Low
HighEntrypoint Foreign Package Code Overwritedist/activation.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/install-claude-hook.js
HighTrigger Reachable Persistencedist/install-autostart.js
HighPrevious Version Dangerous Deltadist/cli.js
MediumDynamic Requiredist/adapters.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/install-autostart.js
MediumShips Build Helperdefaults/claude-code-hook.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Low
Affected versions and remediation
This report applies to @compr/opscontext-mcp@2.4.1.
See all versions of @compr/opscontext-mcp for other recorded verdicts.
- Review the evidence and your use of @compr/opscontext-mcp@2.4.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.