registry / AI-agent capability abuse / @herjarsa/omo-meta-governor / 0.31.8

@herjarsa/omo-meta-governor@0.31.8

Self-judging agent orchestration layer for OpenCode. Reads memory, scores sessions, dispatches decisions.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

The source supports a warning for guarded agent-control behavior: the library can inject instructions to push commits upstream. No install lifecycle hook or direct package-side push was established, so the evidence does not support blocking publication.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

A session meets the intervention conditions and lacks a plan marker.

Impact

An agent may take repository actions beyond the package’s install process; no direct execution or successful push is established by the inspected source.

Mechanism

The library appends a synthetic user-role message instructing the agent to create a plan and commit changes locally and to fork and upstream repositories.

AI rationale

Evidence

dist/lib.js

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

dist/lib.js can inject a synthetic user message instructing the agent to commit and push changes to local, fork, and upstream repositories.
The prompt injection is gated by session state and a check for a plan; it can recur at most once.
package.json describes an OpenCode agent orchestration package and defines no install lifecycle hook.
The library has an auto-upgrade path for graph tooling, but it is separate from the agent prompt behavior.

Evidence against

The package exposes a library and MCP executable; its manifest contains build, typecheck, and test scripts but no preinstall, install, or postinstall hook.
The flagged agent integration locations inspect plan markers in AGENTS.md; the inspected code does not establish a write to that file.

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Source & flagged code

7 flagged

dist/lib.jsView file

1import{createRequire as Zk}from"node:module";var{defineProperty:PU,getOwnPropertyNames:Lk,getOwnPropertyDescriptor:Bk}=Object,Gk=Object.prototype.hasOwnProperty;function Ak($){retu... L2: `}catch{J=JSON.stringify({timestamp:O.timestamp,level:$,message:U,data:"[unserializable]"})+`

High

Child Process

Package source references child process execution.

dist/lib.jsView on unpkg · L1

High

Shell

Package source references shell execution.

dist/lib.jsView on unpkg · L1

2`}catch{J=JSON.stringify({timestamp:O.timestamp,level:$,message:U,data:"[unserializable]"})+` L3: `}try{Dk(J$,J)}catch{}if($==="error")console.error(`[meta-governor] ${U}`)}function H($,U,b){y2($,U,b)}function nk($){y2($.level,$.message,$.data,$.event,$.sessionID)}function ik()... L4: const OMO_MG_WATCH = 1;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib.jsView on unpkg · L2

159updated_at = CURRENT_TIMESTAMP L160: `).run($.id,$.name,$.description,$.repo_url,$.installs??0,$.skill_id,$.download_count??0,$.last_synced??U,$.content_hash),Promise.resolve($.id)}close(){this.db.close()}toFtsQuery($... L161: `)}var Yv=($)=>(U,b,z,v)=>{let _=z?Object.assign(z,{async:!1}):{async:!1},N=U._zod.run({value:b,issues:[]},_);if(N instanceof Promise)throw new H$;if(N.issues.length){let O=new(v?....

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/lib.jsView on unpkg · L159

dist/index.jsView file

1Cross-file remote execution chain: dist/index.js spawns dist/lib.js; helper contains network access plus dynamic code execution. L1: import{createRequire as B0}from"node:module";var{defineProperty:kU,getOwnPropertyNames:Y0,getOwnPropertyDescriptor:W0}=Object,w0=Object.prototype.hasOwnProperty;function j0($){retu... L2: `}catch{J=JSON.stringify({timestamp:O.timestamp,level:$,message:U,data:"[unserializable]"})+` L3: `}try{A0(J$,J)}catch{}if($==="error")console.error(`[meta-governor] ${U}`)}function H($,U,b){E2($,U,b)}function T0($){E2($.level,$.message,$.data,$.event,$.sessionID)}function C0()... L4: const OMO_MG_WATCH = 1; ... L18: setInterval(run, 30_000); L19: `],{stdio:"ignore",detached:!0,shell:!1,env:{...process.env,OMO_MG_SPAWN:"1"}});else z=S2("python3",["-m","graphify",".","--no-vi

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L1

dist/mcp-server.jsView file

•matchType = normalized_sha256 matchedPackage = @herjarsa/omo-meta-governor@0.38.9 matchedPath = dist/mcp-server.js matchedIdentity = npm:[redacted]:0.38.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcp-server.jsView on unpkg

package.jsonView file

22"./dist/index.js" }, "./lib": { "types": "./dist/lib.d.ts", "import": "./dist/lib.js" } }, "bin": { "omo-meta-governor-mcp": "./dist/mcp-server.js" }, "description": "Self-judging agent orchestration layer for OpenCode. Reads memory, scores sessions, dispatches decisions.", "files": [ "dist", "README.md" ], "license": "MIT", "publishConfig": { "access": "public", "registry": "https://registry.npmjs.org/" }, "scripts": { "build":

Medium

Suspicious Lifecycle Evidence

package.json describes an OpenCode agent orchestration package and defines no install lifecycle hook.

package.jsonView on unpkg · L22

Source & flagged code

7 flagged · loading source

dist/lib.jsView file

High

Child Process

Package source references child process execution.

dist/lib.jsView on unpkg · L1

High

Shell

Package source references shell execution.

dist/lib.jsView on unpkg · L1

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib.js

Findings

5 High3 Medium4 Low

HighChild Processdist/lib.js

HighShelldist/lib.js

HighCross File Remote Execution Contextdist/index.js

HighRuntime Package Installdist/lib.js

HighKnown Malware Source Similaritydist/mcp-server.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSuspicious Lifecycle Evidencepackage.json

LowScripts Present

LowEvaldist/lib.js

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @herjarsa/omo-meta-governor@0.31.8.

See all versions of @herjarsa/omo-meta-governor for other recorded verdicts.

Review the evidence and your use of @herjarsa/omo-meta-governor@0.31.8 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-10 22:07:51.545Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.