@emiliom/omp-dev-team
Equipo de agentes especializados (architect, backend, frontend, security-review, docs) para omp (Oh My Pi), listos para usar en cualquier proyecto con modelos gratuitos de OpenCode Zen.
This report shows the evidence for @emiliom/omp-dev-team@1.4.0. 1 of 2 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package contains no confirmed exfiltration or remote payload chain, but its automatic global omp-agent prompt/config mutation meets the install-time AI-agent control-hijack block boundary.
Decision evidence
public snapshot- package.json runs install.js automatically via postinstall.
- install.js writes into ~/.omp/agent, outside the package.
- install.js replaces ~/.omp/agent/AGENTS.md, loaded globally by omp.
- install.js drops agent prompts with enabled edit/bash capabilities.
- No network, credential harvesting, shell execution, or payload loading found.
- Bundled Markdown prompts are ordinary development guidance.
Source & flagged code
3 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to @emiliom/omp-dev-team@1.4.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @emiliom/omp-dev-team@1.4.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.