registry / @herjarsa/omo-meta-governor / 0.38.4
@herjarsa/omo-meta-governor@0.38.4
Self-judging agent orchestration layer for OpenCode. Reads memory, scores sessions, dispatches decisions.
AI Security Review
scanned 28d ago · by lpm-firewall-aiThis is a first-party OpenCode plugin whose session start installs third-party tooling and writes agent config by default, which is a guarded extension risk. It is not an install-hook or exfiltration attack, so it should be warned rather than blocked.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Import or session start of the OpenCode plugin entry, not npm install.
Impact
A consumer who loads the plugin gets unsolicited package and CLI installs plus writes in the OpenCode config area. No separate secret-theft or install-time hijack chain was shown.
Mechanism
graphSync and cliAnything init call npm to install @colbymchenry/codegraph and record CLI upgrade state under the user OpenCode config path unless the caller disables those flags.
AI rationale
This is a first-party OpenCode plugin whose session start installs third-party tooling and writes agent config by default, which is a guarded extension risk. It is not an install-hook or exfiltration attack, so it should be warned rather than blocked.
Evidence
dist/index.jsdist/lib.js~/.config/opencode/omo-cli-anything-upgrade-check.json
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json has only build, typecheck, test, and release scripts and no npm install lifecycle hooks.
- On OpenCode plugin session init, dist/index.js defaults graph sync autoInstall on and runs npm i -D @colbymchenry/codegraph in the project.
- The same init path defaults cli-anything autoInstall and autoUpgrade on and writes upgrade state under the user OpenCode config directory.
- dist/lib.js repeats the codegraph npm install when no injected runner is supplied.
Evidence against
- Activation is plugin or bin use, not an unconsented preinstall, install, or postinstall hook.
- No credential copy to an unrelated host or hidden self-install of another release was found.
- Remote skill catalog downloads stay behind skillHub, which defaults off.
Behavioral surface
ChildProcessEnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
12 flagged · loading sourcedist/lib.jsView file
1import{createRequire as r9}from"node:module";var y9=Object.defineProperty;var c9=($)=>$;function h9($,v){this[$]=c9.bind(null,v)}var L$=($,v)=>{for(var z in v)y9($,z,{get:v[z],enum...
L2: `}catch{X=JSON.stringify({timestamp:_.timestamp,level:$,message:v,data:"[unserializable]"})+`
High
2`}catch{X=JSON.stringify({timestamp:_.timestamp,level:$,message:v,data:"[unserializable]"})+`
L3: `}try{d9(V$,X)}catch{}if($==="error")console.error(`[meta-governor] ${v}`)}function w($,v,z){DJ($,v,z)}function b8($){DJ($.level,$.message,$.data,$.event,$.sessionID)}function N8()...
L4: const OMO_MG_WATCH = 1;
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/lib.jsView on unpkg · L2•matchType = normalized_sha256
matchedPackage = @herjarsa/omo-meta-governor@0.38.9
matchedPath = dist/index.js
matchedIdentity = npm:[redacted]:0.38.9
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
Findings
10 High4 Medium4 Low
HighChild Processdist/lib.js
HighSame File Env Network Executiondist/mcp-server.js
HighCommand Output Exfiltrationdist/mcp-server.js
HighObfuscated Payload Loaderdist/mcp-server.js
HighTrigger Reachable Command Output Exfiltrationdist/mcp-server.js
HighRuntime Package Installdist/lib.js
HighShips High Entropy Blobdist/skills/chore.tar.gz
HighKnown Malware Source Similaritydist/index.js
HighKnown Malware Source Similaritydist/lib.js
HighKnown Malware Source Similaritydist/mcp-server.js
MediumNetwork
MediumEnvironment Vars
Medium
Affected versions and remediation
This report applies to @herjarsa/omo-meta-governor@0.38.4.
See all versions of @herjarsa/omo-meta-governor for other recorded verdicts.
- Review the evidence and your use of @herjarsa/omo-meta-governor@0.38.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.