@herjarsa/omo-meta-governor@0.38.7: Suspicious npm security | LPM Firewall

Loading npm security reports…

@herjarsa/omo-meta-governor@0.38.7: Suspicious npm security | LPM Firewall

Source & flagged code

10 flagged · loading source

dist/lib.jsView file

1import{createRequire as i9}from"node:module";var h9=Object.defineProperty;var r9=($)=>$;function n9($,v){this[$]=r9.bind(null,v)}var L$=($,v)=>{for(var z in v)h9($,z,{get:v[z],enum... L2: `}catch{X=JSON.stringify({timestamp:_.timestamp,level:$,message:v,data:"[unserializable]"})+`

High

Child Process

Package source references child process execution.

dist/lib.jsView on unpkg · L1

1import{createRequire as i9}from"node:module";var h9=Object.defineProperty;var r9=($)=>$;function n9($,v){this[$]=r9.bind(null,v)}var L$=($,v)=>{for(var z in v)h9($,z,{get:v[z],enum... L2: `}catch{X=JSON.stringify({timestamp:_.timestamp,level:$,message:v,data:"[unserializable]"})+`

High

Shell

Package source references shell execution.

dist/lib.jsView on unpkg · L1

2`}catch{X=JSON.stringify({timestamp:_.timestamp,level:$,message:v,data:"[unserializable]"})+` L3: `}try{o9(V$,X)}catch{}if($==="error")console.error(`[meta-governor] ${v}`)}function A($,v,z){xJ($,v,z)}function J8($){xJ($.level,$.message,$.data,$.event,$.sessionID)}function _8()... L4: const OMO_MG_WATCH = 1;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib.jsView on unpkg · L2

167content_hash = excluded.content_hash L168: `).run($.id,$.name,$.description,$.repo_url,$.installs??0,$.skill_id,$.download_count??0,$.last_synced??v,$.content_hash),Promise.resolve($.id)}setSkillMaterializedAt($,v){this.db.... L169: `)}var Fv=($)=>(v,z,b,U)=>{let N=b?Object.assign(b,{async:!1}):{async:!1},J=v._zod.run({value:z,issues:[]},N);if(J instanceof Promise)throw new R$;if(J.issues.length){let _=new(U?....

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/lib.jsView on unpkg · L167

dist/mcp-server.jsView file

4|| (${Q} === "string" && ${z} && ${z} == +${z} && !(${z} % 1))`).assign(Y,c._`+${z}`);return;case"boolean":X.elseIf(c._`${z} === "false" || ${z} === 0 || ${z} === null`).assign(Y,!... L5: || ${Q} === "boolean" || ${z} === null`).assign(Y,c._`[${z}]`)}}}function FF({gen:$,parentData:U,parentDataProperty:J},X){$.if(c._`${U} !== undefined`,()=>$.assign(c._`${U}[${J}]`,... L6: missingProperty: ${X}, L7: depsCount: ${U}, L8: deps: ${J}}`};var NP={keyword:"dependencies",type:"object",schemaType:"object",error:HO.error,code($){let[U,J]=OP($);OO($,U),BO($,J)}};function OP({schema:$}){let U={},J={};for(let... L9: `}catch{b=JSON.stringify({timestamp:Y.timestamp,level:$,message:U,data:"[unserializable]"})+`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mcp-server.jsView on unpkg · L4

1import{createRequire as ow}from"node:module";var hw=Object.create;var{getPrototypeOf:uw,defineProperty:m9,getOwnPropertyNames:mw}=Object;var lw=Object.prototype.hasOwnProperty;func... L2: `:""},this._extScope=$,this._scope=new Y6.Scope({parent:$}),this._nodes=[new b3]}toString(){return this._root.render(this.opts)}name($){return this._scope.name($)}scopeName($){retu... L3: || (${Q} == "string" && ${z} && ${z} == +${z})`).assign(Y,c._`+${z}`);return;case"integer":X.elseIf(c._`${Q} === "boolean" || ${z} === null L4: || (${Q} === "string" && ${z} && ${z} == +${z} && !(${z} % 1))`).assign(Y,c._`+${z}`);return;case"boolean":X.elseIf(c._`${z} === "false" || ${z} === 0 || ${z} === null`).assign(Y,!... L5: || ${Q} === "boolean" || ${z} === null`).assign(Y,c._`[${z}]`)}}}function FF({gen:$,pare

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/mcp-server.jsView on unpkg · L1

dist/skills/chore.tar.gzView file

•path = dist/skills/chore.tar.gz kind = high_entropy_blob sizeBytes = 131389 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/skills/chore.tar.gzView on unpkg

•path = dist/skills/chore.tar.gz kind = compressed_blob sizeBytes = 131389 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/skills/chore.tar.gzView on unpkg

Source & flagged code

10 flagged

dist/lib.jsView file

Lines 1-22javascript

1import{createRequire as i9}from"node:module";var h9=Object.defineProperty;var r9=($)=>$;function n9($,v){this[$]=r9.bind(null,v)}var L$=($,v)=>{for(var z in v)h9($,z,{get:v[z],enumerable:!0,configurable:!0,set:n9.bind(v,z)})};var d$=($,v)=>()=>($&&(v=$($=0)),v);var m$=i9(import.meta.url);import{spawn as d9,spawnSync as Jv}from"node:child_process";function MJ($){try{let v=Jv("pgrep",["-P",String($)],{encoding:"utf8"});for(let z of v.stdout.trim().split(/\s+/)){let b=Number(z);if(!b)continue;MJ(b);try{process.kill(b,"SIGKILL")}catch{}}}catch{}}function l$($){if(!$||$<=0)return;try{if(process.pla ...

2`}catch{X=JSON.stringify({timestamp:_.timestamp,level:$,message:v,data:"[unserializable]"})+`

High

Child Process

Package source references child process execution.

dist/lib.jsView on unpkg · L1

High

Shell

Package source references shell execution.

dist/lib.jsView on unpkg · L1

3`}try{o9(V$,X)}catch{}if($==="error")console.error(`[meta-governor] ${v}`)}function A($,v,z){xJ($,v,z)}function J8($){xJ($.level,$.message,$.data,$.event,$.sessionID)}function _8(){try{if(b4(V$))return EJ(V$).size}catch{}return 0}function X8(){let $=0;for(let v=1;v<=aU;v++)if(b4(`${V$}.${v}`))$=v;else break;return $}var v8,U8,V$,z8=10485760,aU=5;var o$=d$(()=>{v8=[/eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+/g,/sk-(?:proj-|svc-|)[a-zA-Z0-9]{20,}/g,/pk-[a-zA-Z0-9]{20,}/g,/ghp_[a-zA-Z0-9]{36,}/g,/ghs_[a-zA-Z0-9]{36,}/g,/github_pat_[a-zA-Z0-9]{22,}/g,/Bearer\s+[a-zA-Z0-9_\-]{20,}/gi,/(?:key ...

4 const OMO_MG_WATCH = 1;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib.jsView on unpkg · L2

5 const {spawn} = require("child_process");

6 const run = () => {

7 try {

8 const c = spawn("npx", ["codegraph", "update"], {

9 cwd: ${JSON.stringify($)},

10 stdio: "ignore",

11 windowsHide: true,

12 shell: false,

13 });

14 c.unref();

15 } catch(e) { /* best effort */ }

16 };

17 run();

18 setInterval(run, 30_000);

19 `],{stdio:"ignore",detached:!0,shell:!1,env:{...process.env,OMO_MG_SPAWN:"1"}});else b=SJ("python3",["-m","graphify",".","--no-viz","--watch"],{cwd:$,stdio:"ignore",detached:!0

20`)[0]??"").match(/graphifyy\s*\(?([0-9]+\.[0-9]+\.[0-9]+[^\s)]*)/);if(U)return U[1]}catch{}for(let v of["python","python3"])try{let b=$$(v,["-c","import urllib.request, json; d=json.load(urllib.request.urlopen('https://pypi.org/pypi/graphifyy/json')); print(d['info']['version'])"],{timeoutMs:1e4}).stdout.trim();if(b.length>0)return b}catch{}return null}async function U1($){let v=[{bin:"npx",args:["--yes","codegraph","--version"]},{bin:"node",args:["node_modules/.bin/codegraph","--version"]}];for(let{bin:z,args:b}of v)try{let U;if($){let J=$(`${z} ${b.join(" ")}`,{stdio:"ignore",timeout:1e4});U ...

21

22Please call the \`${v.mcpTool}\` MCP tool with EXACTLY these args:

Long lines were clipped for display.

Lines 147-187javascript

147 ORDER BY priority ASC, updated_at_ms DESC

148 `)}}saveMemory($){let v=V_("M"),z=($.concepts[0]??"memory").slice(0,80);return this.stmts.insertEntry.run(v,"memory",z,$.content,"",null,0.5,JSON.stringify($.concepts),JSON.stringify($.files??[]),"","",Date.now()),Promise.resolve({id:v})}saveLesson($){let v=V_("L"),z=$.confidence??0.5,b=($.content.split(`

149`)[0]??"lesson").slice(0,80);return this.stmts.insertEntry.run(v,"lesson",b,$.content,$.context,null,z,JSON.stringify($.tags??[]),JSON.stringify([]),"","",Date.now()),Promise.resolve({id:v})}smartSearch($){let v=$.limit??10,z=this.toFtsQuery($.query),U=this.stmts.ftsSearch.all(z,v).map((N)=>({id:N.id,title:N.title,content:N.content,type:N.kind,concepts:W_(N.tags),confidence:N.confidence,files:W_(N.files),advice:N.advice??"info"}));return Promise.resolve({lessons:U,crystals:[]})}boulderRead($){let z=this.stmts.boulderSelect.all($.directory,$.sessionID).map((b)=>({id:b.id,title:b.title,priority: ...

150 FROM skills s

151 JOIN skills_fts f ON f.rowid = (SELECT rowid FROM skills WHERE id = s.id)

152 ${

dist/mcp-server.jsView file

4|| (${Q} === "string" && ${z} && ${z} == +${z} && !(${z} % 1))`).assign(Y,c._`+${z}`);return;case"boolean":X.elseIf(c._`${z} === "false" || ${z} === 0 || ${z} === null`).assign(Y,!... L5: || ${Q} === "boolean" || ${z} === null`).assign(Y,c._`[${z}]`)}}}function FF({gen:$,parentData:U,parentDataProperty:J},X){$.if(c._`${U} !== undefined`,()=>$.assign(c._`${U}[${J}]`,... L6: missingProperty: ${X}, L7: depsCount: ${U}, L8: deps: ${J}}`};var NP={keyword:"dependencies",type:"object",schemaType:"object",error:HO.error,code($){let[U,J]=OP($);OO($,U),BO($,J)}};function OP({schema:$}){let U={},J={};for(let... L9: `}catch{b=JSON.stringify({timestamp:Y.timestamp,level:$,message:U,data:"[unserializable]"})+`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mcp-server.jsView on unpkg · L4

1import{createRequire as ow}from"node:module";var hw=Object.create;var{getPrototypeOf:uw,defineProperty:m9,getOwnPropertyNames:mw}=Object;var lw=Object.prototype.hasOwnProperty;func... L2: `:""},this._extScope=$,this._scope=new Y6.Scope({parent:$}),this._nodes=[new b3]}toString(){return this._root.render(this.opts)}name($){return this._scope.name($)}scopeName($){retu... L3: || (${Q} == "string" && ${z} && ${z} == +${z})`).assign(Y,c._`+${z}`);return;case"integer":X.elseIf(c._`${Q} === "boolean" || ${z} === null L4: || (${Q} === "string" && ${z} && ${z} == +${z} && !(${z} % 1))`).assign(Y,c._`+${z}`);return;case"boolean":X.elseIf(c._`${z} === "false" || ${z} === 0 || ${z} === null`).assign(Y,!... L5: || ${Q} === "boolean" || ${z} === null`).assign(Y,c._`[${z}]`)}}}function FF({gen:$,pare

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/mcp-server.jsView on unpkg · L1

dist/skills/chore.tar.gzView file

•path = dist/skills/chore.tar.gz kind = high_entropy_blob sizeBytes = 131389 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/skills/chore.tar.gzView on unpkg

•path = dist/skills/chore.tar.gz kind = compressed_blob sizeBytes = 131389 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/skills/chore.tar.gzView on unpkg