@herjarsa/omo-meta-governor@0.32.0: Suspicious npm security | LPM Firewall

Loading npm security reports…

@herjarsa/omo-meta-governor@0.32.0: Suspicious npm security | LPM Firewall

Source & flagged code

8 flagged · loading source

dist/lib.jsView file

1import{createRequire as rX}from"node:module";var{defineProperty:VU,getOwnPropertyNames:PX,getOwnPropertyDescriptor:qX}=Object,BX=Object.prototype.hasOwnProperty;function LX($){retu... L2: `}catch{J=JSON.stringify({timestamp:O.timestamp,level:$,message:U,data:"[unserializable]"})+`

High

Child Process

Package source references child process execution.

dist/lib.jsView on unpkg · L1

1import{createRequire as rX}from"node:module";var{defineProperty:VU,getOwnPropertyNames:PX,getOwnPropertyDescriptor:qX}=Object,BX=Object.prototype.hasOwnProperty;function LX($){retu... L2: `}catch{J=JSON.stringify({timestamp:O.timestamp,level:$,message:U,data:"[unserializable]"})+`

High

Shell

Package source references shell execution.

dist/lib.jsView on unpkg · L1

1Cross-file remote execution chain: dist/lib.js spawns dist/index.js; helper contains network access plus dynamic code execution. L1: import{createRequire as rX}from"node:module";var{defineProperty:VU,getOwnPropertyNames:PX,getOwnPropertyDescriptor:qX}=Object,BX=Object.prototype.hasOwnProperty;function LX($){retu... L2: `}catch{J=JSON.stringify({timestamp:O.timestamp,level:$,message:U,data:"[unserializable]"})+` L3: `}try{ZX(O$,J)}catch{}if($==="error")console.error(`[meta-governor] ${U}`)}function H($,U,b){u2($,U,b)}function yX($){u2($.level,$.message,$.data,$.event,$.sessionID)}function fX()... L4: const OMO_MG_WATCH = 1; ... L18: setInterval(run, 30_000); L19: `],{stdio:"ignore",detached:!0,shell:!1,env:{...process.env,OMO_MG_SPAWN:"1"}});else z=y2("python3",["-m","graphify",".","--no-vi

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/lib.jsView on unpkg · L1

2`}catch{J=JSON.stringify({timestamp:O.timestamp,level:$,message:U,data:"[unserializable]"})+` L3: `}try{ZX(O$,J)}catch{}if($==="error")console.error(`[meta-governor] ${U}`)}function H($,U,b){u2($,U,b)}function yX($){u2($.level,$.message,$.data,$.event,$.sessionID)}function fX()... L4: const OMO_MG_WATCH = 1;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib.jsView on unpkg · L2

166content_hash = excluded.content_hash L167: `).run($.id,$.name,$.description,$.repo_url,$.installs??0,$.skill_id,$.download_count??0,$.last_synced??U,$.content_hash),Promise.resolve($.id)}sk[redacted]($,U){this.db.exec("... L168: `)}var Qv=($)=>(U,b,z,v)=>{let _=z?Object.assign(z,{async:!1}):{async:!1},N=U._zod.run({value:b,issues:[]},_);if(N instanceof Promise)throw new H$;if(N.issues.length){let O=new(v?....

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/lib.jsView on unpkg · L166

dist/mcp-server.jsView file

4|| (${W} === "string" && ${v} && ${v} == +${v} && !(${v} % 1))`).assign(b,c._`+${v}`);return;case"boolean":J.elseIf(c._`${v} === "false" || ${v} === 0 || ${v} === null`).assign(b,!... L5: || ${W} === "boolean" || ${v} === null`).assign(b,c._`[${v}]`)}}}function kD({gen:$,parentData:U,parentDataProperty:z},J){$.if(c._`${U} !== undefined`,()=>$.assign(c._`${U}[${z}]`,... L6: missingProperty: ${J}, L7: depsCount: ${U}, L8: deps: ${z}}`};var VM={keyword:"dependencies",type:"object",schemaType:"object",error:tO.error,code($){let[U,z]=AM($);pO($,U),dO($,z)}};function AM({schema:$}){let U={},z={};for(let... L9: `}catch{Q=JSON.stringify({timestamp:b.timestamp,level:$,message:U,data:"[unserializable]"})+`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mcp-server.jsView on unpkg · L4

1import{createRequire as $w}from"node:module";var iB=Object.create;var{getPrototypeOf:rB,defineProperty:MX,getOwnPropertyNames:oB}=Object;var pB=Object.prototype.hasOwnProperty;func... L2: `:""},this._extScope=$,this._scope=new W6.Scope({parent:$}),this._nodes=[new c5]}toString(){return this._root.render(this.opts)}name($){return this._scope.name($)}scopeName($){retu... L3: || (${W} == "string" && ${v} && ${v} == +${v})`).assign(b,c._`+${v}`);return;case"integer":J.elseIf(c._`${W} === "boolean" || ${v} === null L4: || (${W} === "string" && ${v} && ${v} == +${v} && !(${v} % 1))`).assign(b,c._`+${v}`);return;case"boolean":J.elseIf(c._`${v} === "false" || ${v} === 0 || ${v} === null`).assign(b,!... L5: || ${W} === "boolean" || ${v} === null`).assign(b,c._`[${v}]`)}}}function kD({gen:$,pare

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/mcp-server.jsView on unpkg · L1

Source & flagged code

8 flagged

dist/lib.jsView file

Lines 1-22javascript

1import{createRequire as rX}from"node:module";var{defineProperty:VU,getOwnPropertyNames:PX,getOwnPropertyDescriptor:qX}=Object,BX=Object.prototype.hasOwnProperty;function LX($){return this[$]}var GX=($)=>{var U=(T2??=new WeakMap).get($),b;if(U)return U;if(U=VU({},"__esModule",{value:!0}),$&&typeof $==="object"||typeof $==="function"){for(var z of PX($))if(!BX.call(U,z))VU(U,z,{get:LX.bind($,z),enumerable:!(b=qX($,z))||b.enumerable})}return T2.set($,U),U},T2,AX=($,U)=>()=>(U||$((U={exports:{}}).exports,U),U.exports);var HX=($)=>$;function EX($,U){this[$]=HX.bind(null,U)}var k$=($,U)=>{for(var b ...

2`}catch{J=JSON.stringify({timestamp:O.timestamp,level:$,message:U,data:"[unserializable]"})+`

High

Child Process

Package source references child process execution.

dist/lib.jsView on unpkg · L1

High

Shell

Package source references shell execution.

dist/lib.jsView on unpkg · L1

3`}try{ZX(O$,J)}catch{}if($==="error")console.error(`[meta-governor] ${U}`)}function H($,U,b){u2($,U,b)}function yX($){u2($.level,$.message,$.data,$.event,$.sessionID)}function fX(){try{if(T4(O$))return h2(O$).size}catch{}return 0}function nX(){let $=0;for(let U=1;U<=BU;U++)if(T4(`${O$}.${U}`))$=U;else break;return $}var mX,CX,O$,hX=10485760,BU=5;var gv=n$(()=>{mX=[/eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+/g,/sk-(?:proj-|svc-|)[a-zA-Z0-9]{20,}/g,/pk-[a-zA-Z0-9]{20,}/g,/ghp_[a-zA-Z0-9]{36,}/g,/ghs_[a-zA-Z0-9]{36,}/g,/github_pat_[a-zA-Z0-9]{22,}/g,/Bearer\s+[a-zA-Z0-9_\-]{20,}/gi,/(?:key ...

4 const OMO_MG_WATCH = 1;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib.jsView on unpkg · L2

5 const {spawn} = require("child_process");

6 const run = () => {

7 try {

8 const c = spawn("npx", ["codegraph", "update"], {

9 cwd: ${JSON.stringify($)},

10 stdio: "ignore",

11 windowsHide: true,

12 shell: false,

13 });

14 c.unref();

15 } catch(e) { /* best effort */ }

16 };

17 run();

18 setInterval(run, 30_000);

19 `],{stdio:"ignore",detached:!0,shell:!1,env:{...process.env,OMO_MG_SPAWN:"1"}});else z=y2("python3",["-m","graphify",".","--no-viz","--watch"],{cwd:$,stdio:"ignore",detached:!0

20`)[0]??"").match(/graphifyy\s*\(?([0-9]+\.[0-9]+\.[0-9]+[^\s)]*)/);if(v)return v[1]}catch{}for(let U of["python","python3"])try{let z=o(U,["-c","import urllib.request, json; d=json.load(urllib.request.urlopen('https://pypi.org/pypi/graphifyy/json')); print(d['info']['version'])"],{timeoutMs:1e4}).stdout.trim();if(z.length>0)return z}catch{}return null}async function SU($){let U=[{bin:"npx",args:["--yes","codegraph","--version"]},{bin:"node",args:["node_modules/.bin/codegraph","--version"]}];for(let{bin:b,args:z}of U)try{let v;if($){let N=$(`${b} ${z.join(" ")}`,{stdio:"ignore",timeout:1e4});v= ...

21

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/lib.jsView on unpkg · L1

22Please call the \`${U.mcpTool}\` MCP tool with EXACTLY these args:

Long lines were clipped for display.

Lines 146-186javascript

146 ORDER BY priority ASC, updated_at_ms DESC

147 `)}}saveMemory($){let U=A0("M"),b=($.concepts[0]??"memory").slice(0,80);return this.stmts.insertEntry.run(U,"memory",b,$.content,"",null,0.5,JSON.stringify($.concepts),JSON.stringify($.files??[]),"","",Date.now()),Promise.resolve({id:U})}saveLesson($){let U=A0("L"),b=$.confidence??0.5,z=($.content.split(`

148`)[0]??"lesson").slice(0,80);return this.stmts.insertEntry.run(U,"lesson",z,$.content,$.context,null,b,JSON.stringify($.tags??[]),JSON.stringify([]),"","",Date.now()),Promise.resolve({id:U})}smartSearch($){let U=$.limit??10,b=this.toFtsQuery($.query),v=this.stmts.ftsSearch.all(b,U).map((_)=>({id:_.id,title:_.title,content:_.content,type:_.kind,concepts:H0(_.tags),confidence:_.confidence,files:H0(_.files),advice:_.advice??"info"}));return Promise.resolve({lessons:v,crystals:[]})}boulderRead($){let b=this.stmts.boulderSelect.all($.directory,$.sessionID).map((z)=>({id:z.id,title:z.title,priority: ...

149 FROM skills s

150 JOIN skills_fts f ON f.rowid = (SELECT rowid FROM skills WHERE id = s.id)

151 ${

dist/mcp-server.jsView file

4|| (${W} === "string" && ${v} && ${v} == +${v} && !(${v} % 1))`).assign(b,c._`+${v}`);return;case"boolean":J.elseIf(c._`${v} === "false" || ${v} === 0 || ${v} === null`).assign(b,!... L5: || ${W} === "boolean" || ${v} === null`).assign(b,c._`[${v}]`)}}}function kD({gen:$,parentData:U,parentDataProperty:z},J){$.if(c._`${U} !== undefined`,()=>$.assign(c._`${U}[${z}]`,... L6: missingProperty: ${J}, L7: depsCount: ${U}, L8: deps: ${z}}`};var VM={keyword:"dependencies",type:"object",schemaType:"object",error:tO.error,code($){let[U,z]=AM($);pO($,U),dO($,z)}};function AM({schema:$}){let U={},z={};for(let... L9: `}catch{Q=JSON.stringify({timestamp:b.timestamp,level:$,message:U,data:"[unserializable]"})+`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mcp-server.jsView on unpkg · L4

1import{createRequire as $w}from"node:module";var iB=Object.create;var{getPrototypeOf:rB,defineProperty:MX,getOwnPropertyNames:oB}=Object;var pB=Object.prototype.hasOwnProperty;func... L2: `:""},this._extScope=$,this._scope=new W6.Scope({parent:$}),this._nodes=[new c5]}toString(){return this._root.render(this.opts)}name($){return this._scope.name($)}scopeName($){retu... L3: || (${W} == "string" && ${v} && ${v} == +${v})`).assign(b,c._`+${v}`);return;case"integer":J.elseIf(c._`${W} === "boolean" || ${v} === null L4: || (${W} === "string" && ${v} && ${v} == +${v} && !(${v} % 1))`).assign(b,c._`+${v}`);return;case"boolean":J.elseIf(c._`${v} === "false" || ${v} === 0 || ${v} === null`).assign(b,!... L5: || ${W} === "boolean" || ${v} === null`).assign(b,c._`[${v}]`)}}}function kD({gen:$,pare

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/mcp-server.jsView on unpkg · L1