@getoma/cli: Suspicious npm security report (Warn)

Loading npm security reports…

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 1.06 MB of source, external domains: 127.0.0.1, api.githubcopilot.com, api.slack.com, app.oma.duyet.net, cdn.agentclientprotocol.com, github.com, json-schema.org, mcp.airtable.com, mcp.amplitude.com, mcp.apollo.io, mcp.asana.com, mcp.atlassian.com, mcp.clickup.com, mcp.intercom.com, mcp.linear.app, mcp.notion.com, mcp.sentry.dev, mcp.slack.com, oma.duyet.net, opencode.ai, raw.githubusercontent.com, www.apple.com

Source & flagged code

4 flagged

dist/index.jsView file

3666import { dirname as dirname5 } from "node:path"; L3667: import { spawn } from "node:child_process"; L3668: async function install(opts) {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L3666

10107}); L10108: import { createServer } from "node:http"; L10109: import { spawn as spawn7 } from "node:child_process"; L10110: import { hostname } from "node:os"; ... L10120: async function runSetup(opts) { L10121: if (process.env.OMA_DEBUG_HANDLES) { L10122: let tick = 0;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L10107

50function currentProfile() { L51: const raw = (process.env.OMA_PROFILE ?? "").trim(); L52: if (raw === "") return ""; ... L60: function paths() { L61: const home = homedir(); L62: const p = currentPlatform(); ... L80: function osTag() { L81: return `${platform()}/${process.arch}`; L82: } ... L99: PKG_VERSION = (() => { L100: for (const path2 of ["../package.json", "../../package.json"]) { L101: try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L50

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L50

Source & flagged code

4 flagged · loading source

@getoma/cli: Suspicious npm security report (Warn) | LPM Firewall

@getoma/cli@0.1.7

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code