registry / @herjarsa/omo-meta-governor / 0.35.1

@herjarsa/omo-meta-governor@0.35.1

Self-judging agent orchestration layer for OpenCode. Reads memory, scores sessions, dispatches decisions.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

The default plugin setup can add a development dependency automatically, which is a guarded package-owned integration capability warranting a warning. No install hook, confirmed exfiltration, or concrete malicious behavior was established.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Loading the package as an OpenCode plugin with graph synchronization enabled.

Impact

May add a development dependency to the consumer project without a separate install command.

Mechanism

Plugin setup invokes graph synchronization with autoInstall enabled by default; the installer runs npm with the -D option in the project directory.

AI rationale

Evidence

package.json

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package entrypoint is dist/index.js, which calls graph synchronization during plugin setup.
Plugin setup defaults graph synchronization to enabled and autoInstall to true.
When codegraph is missing, the installer runs npm install with -D for @colbymchenry/codegraph in the project directory.
The indicated index.js and lib.js locations only check AGENTS.md for a plan heading; they establish no agent-configuration mutation.

Evidence against

package.json declares no install lifecycle hook.
The MCP server exposes tools over stdio; the inspected startup path does not establish command-output exfiltration.

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 1.41 MB of source, external domains: 127.0.0.1, github.com, json-schema.org, pypi.org, raw.githubusercontent.com, skills-library.com, skills.sh

Source & flagged code

9 flagged

dist/lib.jsView file

1import{createRequire as MK}from"node:module";var AK=Object.defineProperty;var PK=($)=>$;function ZK($,v){this[$]=PK.bind(null,v)}var L$=($,v)=>{for(var b in v)AK($,b,{get:v[b],enum... L2: `}catch{X=JSON.stringify({timestamp:_.timestamp,level:$,message:v,data:"[unserializable]"})+`

High

Child Process

Package source references child process execution.

dist/lib.jsView on unpkg · L1

2`}catch{X=JSON.stringify({timestamp:_.timestamp,level:$,message:v,data:"[unserializable]"})+` L3: `}try{DK(Y$,X)}catch{}if($==="error")console.error(`[meta-governor] ${v}`)}function P($,v,b){AJ($,v,b)}function rK($){AJ($.level,$.message,$.data,$.event,$.sessionID)}function hK()... L4: const OMO_MG_WATCH = 1;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib.jsView on unpkg · L2

167content_hash = excluded.content_hash L168: `).run($.id,$.name,$.description,$.repo_url,$.installs??0,$.skill_id,$.download_count??0,$.last_synced??v,$.content_hash),Promise.resolve($.id)}setSkillMaterializedAt($,v){this.db.... L169: `)}var Mv=($)=>(v,b,z,U)=>{let N=z?Object.assign(z,{async:!1}):{async:!1},J=v._zod.run({value:b,issues:[]},N);if(J instanceof Promise)throw new R$;if(J.issues.length){let _=new(U?....

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/lib.jsView on unpkg · L167

dist/mcp-server.jsView file

4|| (${Q} === "string" && ${J} && ${J} == +${J} && !(${J} % 1))`).assign(b,c._`+${J}`);return;case"boolean":X.elseIf(c._`${J} === "false" || ${J} === 0 || ${J} === null`).assign(b,!... L5: || ${Q} === "boolean" || ${J} === null`).assign(b,c._`[${J}]`)}}}function YD({gen:$,parentData:U,parentDataProperty:z},X){$.if(c._`${U} !== undefined`,()=>$.assign(c._`${U}[${z}]`,... L6: missingProperty: ${X}, L7: depsCount: ${U}, L8: deps: ${z}}`};var UP={keyword:"dependencies",type:"object",schemaType:"object",error:wN.error,code($){let[U,z]=JP($);HN($,U),KN($,z)}};function JP({schema:$}){let U={},z={};for(let... L9: `}catch{Y=JSON.stringify({timestamp:b.timestamp,level:$,message:U,data:"[unserializable]"})+`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mcp-server.jsView on unpkg · L4

1import{createRequire as CK}from"node:module";var FK=Object.create;var{getPrototypeOf:SK,defineProperty:C9,getOwnPropertyNames:MK}=Object;var EK=Object.prototype.hasOwnProperty;func... L2: `:""},this._extScope=$,this._scope=new Y6.Scope({parent:$}),this._nodes=[new U3]}toString(){return this._root.render(this.opts)}name($){return this._scope.name($)}scopeName($){retu... L3: || (${Q} == "string" && ${J} && ${J} == +${J})`).assign(b,c._`+${J}`);return;case"integer":X.elseIf(c._`${Q} === "boolean" || ${J} === null L4: || (${Q} === "string" && ${J} && ${J} == +${J} && !(${J} % 1))`).assign(b,c._`+${J}`);return;case"boolean":X.elseIf(c._`${J} === "false" || ${J} === 0 || ${J} === null`).assign(b,!... L5: || ${Q} === "boolean" || ${J} === null`).assign(b,c._`[${J}]`)}}}function YD({gen:$,pare

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/mcp-server.jsView on unpkg · L1

dist/skills/chore.tar.gzView file

•path = dist/skills/chore.tar.gz kind = high_entropy_blob sizeBytes = 131389 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/skills/chore.tar.gzView on unpkg

•path = dist/skills/chore.tar.gz kind = compressed_blob sizeBytes = 131389 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/skills/chore.tar.gzView on unpkg

Source & flagged code

9 flagged · loading source

dist/lib.jsView file

High

Child Process

Package source references child process execution.

dist/lib.jsView on unpkg · L1

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib.jsView on unpkg · L2

Low

Findings

7 High4 Medium4 Low

HighChild Processdist/lib.js

HighSame File Env Network Executiondist/mcp-server.js

HighCommand Output Exfiltrationdist/mcp-server.js

HighTrigger Reachable Command Output Exfiltrationdist/mcp-server.js

HighRuntime Package Installdist/lib.js

HighShips High Entropy Blobdist/skills/chore.tar.gz

HighKnown Malware Source Similaritydist/mcp-server.js

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Blobdist/skills/chore.tar.gz

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/lib.js

Affected versions and remediation

This report applies to @herjarsa/omo-meta-governor@0.35.1.

See all versions of @herjarsa/omo-meta-governor for other recorded verdicts.

Review the evidence and your use of @herjarsa/omo-meta-governor@0.35.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-10 22:08:03.636Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.