@herjarsa/omo-meta-governor@0.30.0: Agent extension lifecycle

AI Security Review

scanned 24d ago · by lpm-firewall-ai

The package has no npm install lifecycle hook, so blocking is not supported. Its normal plugin activation nevertheless defaults to global external tooling setup and synthetic agent directives, creating a concrete non-blocking agent-extension risk.

Static reason

One or more suspicious static signals were detected.

Trigger

Loading the exported plugin and invoking its factory with CLI Anything enabled, which is the default.

Impact

This can alter the user's agent tooling and influence agent actions without a separate setup command. No confirmed credential theft, remote payload execution, or install lifecycle hook was identified.

Mechanism

The factory calls CLI setup with automatic installation and global scope; the installer runs Python package-manager commands. Session handling adds synthetic commit instructions.

AI rationale

The package has no npm install lifecycle hook, so blocking is not supported. Its normal plugin activation nevertheless defaults to global external tooling setup and synthetic agent directives, creating a concrete non-blocking agent-extension risk.

Evidence

dist/index.jsdist/lib.js

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The package exports both bundled JavaScript entrypoints.
The main bundle invokes its CLI setup during plugin initialization with automatic installation, upgrades, and global scope as defaults.
The secondary bundle contains the same automatic CLI setup path.
The setup tries multiple Python package installation commands for cli-anything-hub.
The plugin injects a synthetic user message directing commits to local, fork, and upstream repositories.

Evidence against

package.json has no preinstall, install, or postinstall lifecycle script.

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 774 KB of source, external domains: github.com, json-schema.org, pypi.org, raw.githubusercontent.com, registry.npmjs.org

Source & flagged code

7 flagged

dist/lib.jsView file

1import{createRequire as WI}from"node:module";var{defineProperty:KU,getOwnPropertyNames:OI,getOwnPropertyDescriptor:kI}=Object,II=Object.prototype.hasOwnProperty;function JI($){retu... L2: `}catch{O=JSON.stringify({timestamp:r.timestamp,level:$,message:U,data:"[unserializable]"})+`

High

Child Process

Package source references child process execution.

dist/lib.jsView on unpkg · L1

1import{createRequire as WI}from"node:module";var{defineProperty:KU,getOwnPropertyNames:OI,getOwnPropertyDescriptor:kI}=Object,II=Object.prototype.hasOwnProperty;function JI($){retu... L2: `}catch{O=JSON.stringify({timestamp:r.timestamp,level:$,message:U,data:"[unserializable]"})+`

High

Shell

Package source references shell execution.

dist/lib.jsView on unpkg · L1

2`}catch{O=JSON.stringify({timestamp:r.timestamp,level:$,message:U,data:"[unserializable]"})+` L3: `}try{VI(X$,O)}catch{}if($==="error")console.error(`[meta-governor] ${U}`)}function A($,U,b){mr($,U,b)}function ZI($){mr($.level,$.message,$.data,$.event,$.sessionID)}function DI()... L4: const OMO_MG_WATCH = 1;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib.jsView on unpkg · L2

112`)}}saveMemory($){let U=QO("M"),b=($.concepts[0]??"memory").slice(0,80);return this.stmts.insertEntry.run(U,"memory",b,$.content,"",null,0.5,JSON.stringify($.concepts),JSON.stringi... L113: `)[0]??"lesson").slice(0,80);return this.stmts.insertEntry.run(U,"lesson",z,$.content,$.context,null,b,JSON.stringify($.tags??[]),JSON.stringify([]),"","",Date.now()),Promise.resol... L114: `)}var Jv=($)=>(U,b,z,v)=>{let _=z?Object.assign(z,{async:!1}):{async:!1},N=U._zod.run({value:b,issues:[]},_);if(N instanceof Promise)throw new A$;if(N.issues.length){let r=new(v?....

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/lib.jsView on unpkg · L112

dist/index.jsView file

1Cross-file remote execution chain: dist/index.js spawns dist/lib.js; helper contains network access plus dynamic code execution. L1: import{createRequire as kI}from"node:module";var{defineProperty:rU,getOwnPropertyNames:vI,getOwnPropertyDescriptor:UI}=Object,bI=Object.prototype.hasOwnProperty;function rI($){retu... L2: `}catch{O=JSON.stringify({timestamp:N.timestamp,level:$,message:U,data:"[unserializable]"})+` L3: `}try{XI(X$,O)}catch{}if($==="error")console.error(`[meta-governor] ${U}`)}function H($,U,b){PN($,U,b)}function AI($){PN($.level,$.message,$.data,$.event,$.sessionID)}function GI()... L4: const OMO_MG_WATCH = 1; ... L18: setInterval(run, 30_000); L19: `],{stdio:"ignore",detached:!0,shell:!1,env:{...process.env,OMO_MG_SPAWN:"1"}});else r=qN("python3",["-m","graphify",".","--no-vi

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L1

191autoInstall:L?.autoInstall??!0,autoUpgrade:L?.autoUpgrade??!0,cachePath:L?.cachePath??`${process.env.HOME||process.env.USERPROFILE||"~"}/.config/opencode/omo-cli-anything-upgrade-check.json`,upgradeCheckTtlMs:L?.upgradeCheckTtlMs??86400000,projectDir:V$,installScope:L?.installScope??"global",cliHubBin:L?.cliHubBin??"cli-hub",skillsBin:L?.skillsBin??"npx skills"}).then((G)=>{if(G?.attempted&&G.availability.cliHub)tk.add(V$)}).catch((G)=>

Medium

Ai Review Evidence

The main bundle invokes its CLI setup during plugin initialization with automatic installation, upgrades, and global scope as defaults.

dist/index.jsView on unpkg · L191

package.jsonView file

6"exports": { ".": { "types": "./dist/index.d.ts", "import": "./dist/index.js" }, "./lib": { "types": "./dist/lib.d.ts", "import": "./dist

Medium

Ai Review Evidence

The package exports both bundled JavaScript entrypoints.

package.jsonView on unpkg · L6

Source & flagged code

7 flagged · loading source

dist/lib.jsView file

1import{createRequire as WI}from"node:module";var{defineProperty:KU,getOwnPropertyNames:OI,getOwnPropertyDescriptor:kI}=Object,II=Object.prototype.hasOwnProperty;function JI($){retu... L2: `}catch{O=JSON.stringify({timestamp:r.timestamp,level:$,message:U,data:"[unserializable]"})+`

High

Child Process

Package source references child process execution.

dist/lib.jsView on unpkg · L1

1import{createRequire as WI}from"node:module";var{defineProperty:KU,getOwnPropertyNames:OI,getOwnPropertyDescriptor:kI}=Object,II=Object.prototype.hasOwnProperty;function JI($){retu... L2: `}catch{O=JSON.stringify({timestamp:r.timestamp,level:$,message:U,data:"[unserializable]"})+`

High

Shell

Package source references shell execution.

dist/lib.jsView on unpkg · L1

2`}catch{O=JSON.stringify({timestamp:r.timestamp,level:$,message:U,data:"[unserializable]"})+` L3: `}try{VI(X$,O)}catch{}if($==="error")console.error(`[meta-governor] ${U}`)}function A($,U,b){mr($,U,b)}function ZI($){mr($.level,$.message,$.data,$.event,$.sessionID)}function DI()... L4: const OMO_MG_WATCH = 1;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib.js

Findings

4 High4 Medium4 Low

HighChild Processdist/lib.js

HighShelldist/lib.js

HighCross File Remote Execution Contextdist/index.js

HighRuntime Package Installdist/lib.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumAi Review Evidencepackage.json

MediumAi Review Evidencedist/index.js

LowScripts Present

LowEvaldist/lib.js

LowHigh Entropy Strings

LowUrl Strings

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Behavioral surface

Source & flagged code