registry / @herjarsa/omo-meta-governor / 0.38.6

@herjarsa/omo-meta-governor@0.38.6

⚠ Under review

Self-judging agent orchestration layer for OpenCode. Reads memory, scores sessions, dispatches decisions.

AI Security Review

scanned 28d ago · by lpm-firewall-ai

Readable entrypoints are an OpenCode plugin and MCP server with no npm lifecycle hook or self-dependency. The required skill archive is binary and could not be cited, so a clean decision cannot be finalized from source.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

The archive would matter only if a plugin first-run bootstrap extracts it; that call was not found in the published JavaScript.

Impact

Impact of the archive is unknown. The inspected JavaScript does not show an install hook, secret theft, or a self-install chain.

Mechanism

Readable code loads as an OpenCode plugin or MCP bin. The gzip archive has no citable printable bytes, so its contents were not verified.

AI rationale

Evidence

dist/skills/chore.tar.gzdist/skills-bootstrap.d.ts

Decision evidence

public snapshot

AI called this Manual Review at 62.0% confidence as Unknown with medium false-positive risk.

AI review observations

package.json scripts are only build, typecheck, test, and release; there is no preinstall, install, or postinstall hook and no runtime dependency on this package name.
dist/index.js ends by exporting a plugin function whose id is omo-meta-governor, so the bundle is a host-loaded OpenCode plugin rather than an install-time script.
dist/mcp-server.js names the bin omo-meta-governor-mcp and resolves the working directory from OMO_CWD, an argv path, or the process cwd.
dist/lib.js is a library export of governor helpers, matching the package exports map.
dist/skills/chore.tar.gz is binary and yielded no printable excerpt to cite, while dist/skills-bootstrap.d.ts says bundled skills are extracted to ~/.agents/skills on first run; that archive could not be reviewed.

Evidence against

Searched entry bundles contain no lifecycle hook name, no dependency on @herjarsa/omo-meta-governor, and no reference to the chore.tar.gz path or bootstrapChoreSkills.
Network and process use that was found is tied to optional graph, CI, and skill-hub features of the plugin, not to an npm install script.

Behavioral surface

Source & flagged code

12 flagged

dist/lib.jsView file

1import{createRequire as r9}from"node:module";var y9=Object.defineProperty;var c9=($)=>$;function h9($,v){this[$]=c9.bind(null,v)}var L$=($,v)=>{for(var z in v)y9($,z,{get:v[z],enum... L2: `}catch{X=JSON.stringify({timestamp:_.timestamp,level:$,message:v,data:"[unserializable]"})+`

High

Child Process

Package source references child process execution.

dist/lib.jsView on unpkg · L1

2`}catch{X=JSON.stringify({timestamp:_.timestamp,level:$,message:v,data:"[unserializable]"})+` L3: `}try{d9(V$,X)}catch{}if($==="error")console.error(`[meta-governor] ${v}`)}function w($,v,z){DJ($,v,z)}function b8($){DJ($.level,$.message,$.data,$.event,$.sessionID)}function N8()... L4: const OMO_MG_WATCH = 1;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib.jsView on unpkg · L2

•matchType = normalized_sha256 matchedPackage = @herjarsa/omo-meta-governor@0.38.9 matchedPath = dist/index.js matchedIdentity = npm:[redacted]:0.38.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib.jsView on unpkg

167content_hash = excluded.content_hash L168: `).run($.id,$.name,$.description,$.repo_url,$.installs??0,$.skill_id,$.download_count??0,$.last_synced??v,$.content_hash),Promise.resolve($.id)}setSkillMaterializedAt($,v){this.db.... L169: `)}var Mv=($)=>(v,z,b,U)=>{let N=b?Object.assign(b,{async:!1}):{async:!1},J=v._zod.run({value:z,issues:[]},N);if(J instanceof Promise)throw new R$;if(J.issues.length){let _=new(U?....

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/lib.jsView on unpkg · L167

dist/mcp-server.jsView file

4|| (${Q} === "string" && ${z} && ${z} == +${z} && !(${z} % 1))`).assign(Y,c._`+${z}`);return;case"boolean":X.elseIf(c._`${z} === "false" || ${z} === 0 || ${z} === null`).assign(Y,!... L5: || ${Q} === "boolean" || ${z} === null`).assign(Y,c._`[${z}]`)}}}function FF({gen:$,parentData:U,parentDataProperty:J},X){$.if(c._`${U} !== undefined`,()=>$.assign(c._`${U}[${J}]`,... L6: missingProperty: ${X}, L7: depsCount: ${U}, L8: deps: ${J}}`};var NP={keyword:"dependencies",type:"object",schemaType:"object",error:HO.error,code($){let[U,J]=OP($);OO($,U),BO($,J)}};function OP({schema:$}){let U={},J={};for(let... L9: `}catch{b=JSON.stringify({timestamp:Y.timestamp,level:$,message:U,data:"[unserializable]"})+`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mcp-server.jsView on unpkg · L4

1import{createRequire as ow}from"node:module";var hw=Object.create;var{getPrototypeOf:uw,defineProperty:m9,getOwnPropertyNames:mw}=Object;var lw=Object.prototype.hasOwnProperty;func... L2: `:""},this._extScope=$,this._scope=new Y6.Scope({parent:$}),this._nodes=[new b3]}toString(){return this._root.render(this.opts)}name($){return this._scope.name($)}scopeName($){retu... L3: || (${Q} == "string" && ${z} && ${z} == +${z})`).assign(Y,c._`+${z}`);return;case"integer":X.elseIf(c._`${Q} === "boolean" || ${z} === null L4: || (${Q} === "string" && ${z} && ${z} == +${z} && !(${z} % 1))`).assign(Y,c._`+${z}`);return;case"boolean":X.elseIf(c._`${z} === "false" || ${z} === 0 || ${z} === null`).assign(Y,!... L5: || ${Q} === "boolean" || ${z} === null`).assign(Y,c._`[${z}]`)}}}function FF({gen:$,pare

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/mcp-server.jsView on unpkg · L1

dist/skills/chore.tar.gzView file

•path = dist/skills/chore.tar.gz kind = high_entropy_blob sizeBytes = 131389 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/skills/chore.tar.gzView on unpkg

•path = dist/skills/chore.tar.gz kind = compressed_blob sizeBytes = 131389 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/skills/chore.tar.gzView on unpkg

dist/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

12 flagged · loading source

dist/lib.jsView file

High

Child Process

Package source references child process execution.

dist/lib.jsView on unpkg · L1

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib.jsView on unpkg · L2

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

Findings

10 High4 Medium4 Low

HighChild Processdist/lib.js

HighSame File Env Network Executiondist/mcp-server.js

HighCommand Output Exfiltrationdist/mcp-server.js

HighObfuscated Payload Loaderdist/mcp-server.js

HighTrigger Reachable Command Output Exfiltrationdist/mcp-server.js

HighRuntime Package Installdist/lib.js

HighShips High Entropy Blobdist/skills/chore.tar.gz

HighKnown Malware Source Similaritydist/index.js

HighKnown Malware Source Similaritydist/lib.js

HighKnown Malware Source Similaritydist/mcp-server.js

MediumNetwork

MediumEnvironment Vars

Medium

Affected versions and remediation

This report applies to @herjarsa/omo-meta-governor@0.38.6.

See all versions of @herjarsa/omo-meta-governor for other recorded verdicts.

Review the evidence and your use of @herjarsa/omo-meta-governor@0.38.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-25 08:54:40.922Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.