registry / Remote code execution / @compr/opscontext-mcp / 2.5.2

@compr/opscontext-mcp@2.5.2

OpsContext for AI Agents — read-only fleet visibility (PM2/nginx/Docker/git/cron) + tamper-evident audit log + policy-as-code hooks. The ops + compliance layer Claude Code can't grow natively.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package contains a real remote-code delivery path and sensitive AI-agent instrumentation. Its persistence and hook setup are explicit user commands rather than npm lifecycle behavior, so the source does not establish malicious install-time conduct.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

The user runs activate, install-claude-hook, or install-autostart.

Impact

A compromised activation service could run arbitrary code; opted-in hooks retain sensitive agent activity locally.

Mechanism

Remote module loading, AI-agent hook installation, and user-level persistence.

AI rationale

Evidence

package.jsondist/activation.jsdist/install-claude-hook.jsdefaults/claude-code-hook.shdist/install-autostart.js~/.contextengine/delta/*.mjs~/.contextengine/license.json~/.claude/hooks/opscontext-emit.sh~/.claude/settings.json~/Library/LaunchAgents/com.opscontext.mcp.plist

Network endpoints3

api.compr.ch/contextengine/activateapi.compr.ch/contextengine/heartbeat127.0.0.1:7842/events

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Activation downloads encrypted JavaScript, decrypts it, writes it under the user home directory, and dynamically imports it.
An explicit command installs hooks that capture Claude Code prompts and tool-call details.
An explicit command creates a persistent macOS LaunchAgent for the package server.

Evidence against

package.json has no preinstall, install, or postinstall hook.
The Claude hook and autostart changes require explicit CLI commands.
The hook posts to a localhost endpoint rather than an external endpoint.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 33 file(s), 642 KB of source, external domains: 127.0.0.1, api.compr.ch, chatgpt.com, claude.ai, raw.githubusercontent.com, www.apple.com, www.npmjs.com

Source & flagged code

7 flagged

dist/adapters.jsView file

46} L47: const mod = await import(moduleSpecifier); L48: // Check for factory function

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/adapters.jsView on unpkg · L46

dist/install-autostart.jsView file

13Trigger-reachable persistence chain: manifest.bin -> dist/cli.js -> dist/install-autostart.js L13: // forever — defeating the whole point. L14: // FIX: To add platform support beyond macOS, branch on process.platform and L15: // add equivalent systemd / NSSM logic. Keep `gui/$UID` and KeepAlive ... L19: import { homedir, platform } from "os"; L20: import { execSync } from "child_process"; L21: import { createRequire } from "module"; ... L34: const __filename_esm = fileURLToPath(import.meta.url); L35: const __dirname_esm = dirname(__filename_esm); L36: const requireFromHere = createRequire(import.meta.url); ... L126: <key>StandardOutPath</key> L127: <string>${join(LOG_DIR, "mcp-stdout.log")}</string> L128:

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/install-autostart.jsView on unpkg · L13

13// forever — defeating the whole point. L14: // FIX: To add platform support beyond macOS, branch on process.platform and L15: // add equivalent systemd / NSSM logic. Keep `gui/$UID` and KeepAlive ... L19: import { homedir, platform } from "os"; L20: import { execSync } from "child_process"; L21: import { createRequire } from "module"; ... L34: const __filename_esm = fileURLToPath(import.meta.url); L35: const __dirname_esm = dirname(__filename_esm); L36: const requireFromHere = createRequire(import.meta.url); ... L126: <key>StandardOutPath</key> L127: <string>${join(LOG_DIR, "mcp-stdout.log")}</string> L128:

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/install-autostart.jsView on unpkg · L13

dist/activation.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/activation.js: import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, unlinkSync } from "fs"; const ACTIVATION_API_BASE = process.env.CONTEXTENGINE_API || "https://api.compr.ch/contextengine"; `Reactivate at https://api.compr.ch/contextengine/pricing if this surprises you.`); writeFileSync(LICENSE_FILE, JSON.stringify(license, null, 2)); writeFileSync(join(DELTA_DIR, `${mod.name}.mjs`), content); writeFileSync(join(DELTA_DIR, "manifest.json"), JSON.stringify({ `Get a license: https://api.compr.ch/contextengine/pricing\n\n` +

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/activation.jsView on unpkg

dist/install-claude-hook.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { existssync, readfilesync, writefilesync, copyfilesync, chmodsync, mkdirsync } from "fs"; import { join } from "path"; import { homedir } from "os"; const claude_dir = join(homedir(), ".claude"); const settings_file = join(claude_dir, "settings.json"); const hooks_dir = join(claude_dir, "hooks"); const hook_script = join(hooks_dir, "opscontext-emit.sh"); const event_kinds = ["userpromptsubmit", "posttooluse", "sessionstart"]; function readsettings() { if (!existssync(settings_file)) return {}; try { return json.parse(readfilesync(settings_file, "utf-8")); } catch (err) { throw new error(`${settings_file} is not valid json — refusin

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/install-claude-hook.jsView on unpkg

defaults/claude-code-hook.shView file

•path = defaults/claude-code-hook.sh kind = build_helper sizeBytes = 3337 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

defaults/claude-code-hook.shView on unpkg

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @compr/opscontext-mcp@2.4.1 matchedIdentity = npm:QGNvbXByL29wc2NvbnRleHQtbWNw:2.4.1 similarity = 0.774 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/adapters.jsView file

46} L47: const mod = await import(moduleSpecifier); L48: // Check for factory function

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/adapters.jsView on unpkg · L46

dist/install-autostart.jsView file

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/install-autostart.jsView on unpkg · L13

Findings

4 High6 Medium5 Low

HighEntrypoint Foreign Package Code Overwritedist/activation.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/install-claude-hook.js

HighTrigger Reachable Persistencedist/install-autostart.js

HighPrevious Version Dangerous Deltadist/cli.js

MediumDynamic Requiredist/adapters.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/install-autostart.js

MediumShips Build Helperdefaults/claude-code-hook.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

Low

Affected versions and remediation

This report applies to @compr/opscontext-mcp@2.5.2.

See all versions of @compr/opscontext-mcp for other recorded verdicts.

Review the evidence and your use of @compr/opscontext-mcp@2.5.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-26 21:20:54.004Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code