registry / Staged payload carrier / @compr/opscontext-mcp / 2.5.3

@compr/opscontext-mcp@2.5.3

OpsContext for AI Agents — read-only fleet visibility (PM2/nginx/Docker/git/cron) + tamper-evident audit log + policy-as-code hooks. The ops + compliance layer Claude Code can't grow natively.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package contains a real staged remote-code execution path after explicit activation, so the delivered code cannot be fully assessed from this tarball. There is no install-time execution or demonstrated malicious action in the inspected source.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

The user runs the activate command with a license key and email, then invokes a premium feature.

Impact

The activation service could execute arbitrary code with the activating user's permissions.

Mechanism

Remote encrypted module delivery followed by local dynamic import.

AI rationale

Evidence

package.jsondist/activation.jsdist/cli.jsdist/install-claude-hook.jsdist/install-autostart.jsdist/http-server.js~/.contextengine/delta/*.mjs~/.contextengine/delta/manifest.json

Network endpoints1

api.compr.ch/contextengine

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Activation accepts a server response containing a delta bundle.
The package decrypts server-supplied module text and writes it under the user context directory.
It dynamically imports the decrypted module, allowing server-supplied code to run.

Evidence against

The manifest has no preinstall, install, or postinstall hook.
Activation requires an explicit CLI command with a license key and email.
Claude hook and autostart changes are separate explicit CLI commands.
The built-in event listener binds only to the loopback address.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 33 file(s), 645 KB of source, external domains: 127.0.0.1, api.compr.ch, chatgpt.com, claude.ai, raw.githubusercontent.com, www.apple.com, www.npmjs.com

Source & flagged code

7 flagged

dist/adapters.jsView file

Lines 26-66javascript

26}

27/**

28 * Load a single adapter from its module path.

29 * Supports:

30 * - Local files: "./adapters/foo.js" (relative to config file)

31 * - npm packages: "@compr/contextengine-jira"

32 * - Named exports: "my-package#myAdapter"

33 */

34async function loadAdapterModule(modulePath, config) {

35 let moduleSpecifier = modulePath;

36 let exportName = null;

37 // Support "module#export" syntax

38 if (modulePath.includes("#")) {

39 const [mod, exp] = modulePath.split("#", 2);

40 moduleSpecifier = mod;

41 exportName = exp;

42 }

43 // Resolve relative paths from CWD

44 if (moduleSpecifier.startsWith(".") || moduleSpecifier.startsWith("/")) {

45 moduleSpecifier = resolve(process.cwd(), moduleSpecifier);

46 }

47 const mod = await import(moduleSpecifier);

48 // Check for factory function

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/adapters.jsView on unpkg · L46

49 if (exportName && typeof mod[exportName] === "function") {

50 return await mod[exportName](config);

51 }

52 if (typeof mod.createAdapter === "function") {

53 return await mod.createAdapter(config);

54 }

55 // Check for default export

56 if (mod.default) {

57 if (typeof mod.default === "function") {

58 return await mod.default(config);

59 }

60 if (typeof mod.default.collect === "function") {

61 return mod.default;

62 }

63 }

64 // Check for named adapter export

65 if (typeof mod.adapter === "object" && typeof mod.adapter.collect === "function") {

66 return mod.adapter;

dist/install-autostart.jsView file

Lines 1-33javascript

1// 🔒 LOCKED [AUTOSTART-INSTALL] — 2026-06-23

2// ⛔ NEVER bootstrap into a `system/` domain (would need root + run as root).

3// Use `gui/$UID` — per-user agent, started at user login, runs as the user.

4// ⛔ NEVER write the plist before checking if a server is already listening on

5// the port. A pre-existing process means we'd race with the launchd-managed

6// one for port 7842.

7// ⛔ NEVER ship a plist that calls `npx -y @latest` — every restart would

8// fetch the registry, eating ~3s and breaking offline. Pin a specific

9// node path + a specific dist path.

dist/activation.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/activation.js: import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, unlinkSync } from "fs"; const ACTIVATION_API_BASE = process.env.CONTEXTENGINE_API || "https://api.compr.ch/contextengine"; `Reactivate at https://api.compr.ch/contextengine/pricing if this surprises you.`); writeFileSync(LICENSE_FILE, JSON.stringify(license, null, 2)); writeFileSync(join(DELTA_DIR, `${mod.name}.mjs`), content); writeFileSync(join(DELTA_DIR, "manifest.json"), JSON.stringify({ `Get a license: https://api.compr.ch/contextengine/pricing\n\n` +

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/activation.jsView on unpkg

dist/install-claude-hook.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { existssync, readfilesync, writefilesync, copyfilesync, chmodsync, mkdirsync } from "fs"; import { join } from "path"; import { homedir } from "os"; const claude_dir = join(homedir(), ".claude"); const settings_file = join(claude_dir, "settings.json"); const hooks_dir = join(claude_dir, "hooks"); const hook_script = join(hooks_dir, "opscontext-emit.sh"); const event_kinds = ["userpromptsubmit", "posttooluse", "sessionstart"]; function readsettings() { if (!existssync(settings_file)) return {}; try { return json.parse(readfilesync(settings_file, "utf-8")); } catch (err) { throw new error(`${settings_file} is not valid json — refusin

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/install-claude-hook.jsView on unpkg

defaults/claude-code-hook.shView file

•path = defaults/claude-code-hook.sh kind = build_helper sizeBytes = 3337 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

defaults/claude-code-hook.shView on unpkg

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @compr/opscontext-mcp@2.5.2 matchedIdentity = npm:QGNvbXByL29wc2NvbnRleHQtbWNw:2.5.2 similarity = 0.971 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/adapters.jsView file

46} L47: const mod = await import(moduleSpecifier); L48: // Check for factory function

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/adapters.jsView on unpkg · L46

dist/install-autostart.jsView file

13Trigger-reachable persistence chain: manifest.bin -> dist/cli.js -> dist/install-autostart.js L13: // forever — defeating the whole point. L14: // FIX: To add platform support beyond macOS, branch on process.platform and L15: // add equivalent systemd / NSSM logic. Keep `gui/$UID` and KeepAlive ... L19: import { homedir, platform } from "os"; L20: import { execSync } from "child_process"; L21: import { createRequire } from "module"; ... L34: const __filename_esm = fileURLToPath(import.meta.url); L35: const __dirname_esm = dirname(__filename_esm); L36: const requireFromHere = createRequire(import.meta.url); ... L126: <key>StandardOutPath</key> L127: <string>${join(LOG_DIR, "mcp-stdout.log")}</string> L128:

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/install-autostart.jsView on unpkg · L13

Findings

4 High6 Medium5 Low

HighEntrypoint Foreign Package Code Overwritedist/activation.js

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/install-claude-hook.js

HighTrigger Reachable Persistencedist/install-autostart.js

HighPrevious Version Dangerous Deltadist/cli.js

MediumDynamic Requiredist/adapters.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/install-autostart.js

MediumShips Build Helperdefaults/claude-code-hook.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

Low

Affected versions and remediation

This report applies to @compr/opscontext-mcp@2.5.3.

See all versions of @compr/opscontext-mcp for other recorded verdicts.

Review the evidence and your use of @compr/opscontext-mcp@2.5.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-26 21:20:05.945Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code