Loading npm security reports…

@herjarsa/omo-meta-governor@0.38.9: AI-agent control-surface risk | LPM Firewall

registry / @herjarsa/omo-meta-governor / 0.38.9

@herjarsa/omo-meta-governor@0.38.9

Self-judging agent orchestration layer for OpenCode. Reads memory, scores sessions, dispatches decisions.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm installation automatically changes the user's global OpenCode agent-instruction file. The injected directives apply to agents that do not load this package.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package, which invokes its postinstall hook unless the user pre-sets the opt-out variable.

Impact

Unconsented persistent modification of a broad AI-agent control surface can influence future agent behavior.

Mechanism

Postinstall writes SYSTEM-NUDGE directives into global AGENTS.md.

Policy narrative

During npm installation, package.json launches the bootstrap script. It resolves the user's home directory and targets ~/.config/opencode/AGENTS.md, creating its directory if needed. It appends a managed block of SYSTEM-NUDGE directives explicitly intended to affect agents outside the plugin process, then writes the result. The opt-out only works if set before installation, so ordinary installation mutates a global agent control file without an explicit setup command or consent prompt.

AI rationale

This is a concrete automatic postinstall mutation of a foreign, global AI-agent control surface. The behavior meets the install-control-surface blocking rule regardless of the absence of observed credential exfiltration.

Evidence

package.jsonscripts/bootstrap-agents-md.mjs~/.config/opencode/AGENTS.md

Decision evidence

public snapshot

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/bootstrap-agents-md.mjs || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/bootstrap-agents-md.mjs || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/lib.jsView file

1import{createRequire as i9}from"node:module";var h9=Object.defineProperty;var r9=($)=>$;function n9($,v){this[$]=r9.bind(null,v)}var L$=($,v)=>{for(var z in v)h9($,z,{get:v[z],enum... L2: `}catch{_=JSON.stringify({timestamp:X.timestamp,level:$,message:v,data:"[unserializable]"})+`

High

Child Process

Package source references child process execution.

dist/lib.jsView on unpkg · L1

2`}catch{_=JSON.stringify({timestamp:X.timestamp,level:$,message:v,data:"[unserializable]"})+` L3: `}try{o9(V$,_)}catch{}if($==="error")console.error(`[meta-governor] ${v}`)}function A($,v,z){xJ($,v,z)}function J8($){xJ($.level,$.message,$.data,$.event,$.sessionID)}function X8()... L4: const OMO_MG_WATCH = 1;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib.jsView on unpkg · L2

167content_hash = excluded.content_hash L168: `).run($.id,$.name,$.description,$.repo_url,$.installs??0,$.skill_id,$.download_count??0,$.last_synced??v,$.content_hash),Promise.resolve($.id)}setSkillMaterializedAt($,v){this.db.... L169: `)}var Fv=($)=>(v,z,b,U)=>{let N=b?Object.assign(b,{async:!1}):{async:!1},J=v._zod.run({value:z,issues:[]},N);if(J instanceof Promise)throw new R$;if(J.issues.length){let X=new(U?....

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/lib.jsView on unpkg · L167

dist/mcp-server.jsView file

4|| (${Q} === "string" && ${z} && ${z} == +${z} && !(${z} % 1))`).assign(Y,c._`+${z}`);return;case"boolean":X.elseIf(c._`${z} === "false" || ${z} === 0 || ${z} === null`).assign(Y,!... L5: || ${Q} === "boolean" || ${z} === null`).assign(Y,c._`[${z}]`)}}}function FF({gen:$,parentData:U,parentDataProperty:J},X){$.if(c._`${U} !== undefined`,()=>$.assign(c._`${U}[${J}]`,... L6: missingProperty: ${X}, L7: depsCount: ${U}, L8: deps: ${J}}`};var NP={keyword:"dependencies",type:"object",schemaType:"object",error:HO.error,code($){let[U,J]=OP($);OO($,U),BO($,J)}};function OP({schema:$}){let U={},J={};for(let... L9: `}catch{b=JSON.stringify({timestamp:Y.timestamp,level:$,message:U,data:"[unserializable]"})+`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mcp-server.jsView on unpkg · L4

1import{createRequire as ow}from"node:module";var hw=Object.create;var{getPrototypeOf:uw,defineProperty:m9,getOwnPropertyNames:mw}=Object;var lw=Object.prototype.hasOwnProperty;func... L2: `:""},this._extScope=$,this._scope=new Y6.Scope({parent:$}),this._nodes=[new b3]}toString(){return this._root.render(this.opts)}name($){return this._scope.name($)}scopeName($){retu... L3: || (${Q} == "string" && ${z} && ${z} == +${z})`).assign(Y,c._`+${z}`);return;case"integer":X.elseIf(c._`${Q} === "boolean" || ${z} === null L4: || (${Q} === "string" && ${z} && ${z} == +${z} && !(${z} % 1))`).assign(Y,c._`+${z}`);return;case"boolean":X.elseIf(c._`${z} === "false" || ${z} === 0 || ${z} === null`).assign(Y,!... L5: || ${Q} === "boolean" || ${z} === null`).assign(Y,c._`[${z}]`)}}}function FF({gen:$,pare

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/mcp-server.jsView on unpkg · L1

scripts/bootstrap-agents-md.mjsView file

2/** L3: * v0.38.9 — postinstall bootstrap for ~/.config/opencode/AGENTS.md. L4: * ... L6: * idempotent snippet of meta-governor [SYSTEM-NUDGE] directives to the L7: * user's global AGENTS.md so that sub-agents spawned outside the L8: * opencode process still see the plugin's directives. ... L23: */ L24: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; L25: import { homedir } from "node:os"; ... L31: const MARKER_CLOSE = ""; L32: const TARGET = join(homedir(), ".config", "opencode", "AGENTS.md"); L33:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/bootstrap-agents-md.mjsView on unpkg · L2

dist/skills/chore.tar.gzView file

•path = dist/skills/chore.tar.gz kind = high_entropy_blob sizeBytes = 131389 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/skills/chore.tar.gzView on unpkg

•path = dist/skills/chore.tar.gz kind = compressed_blob sizeBytes = 131389 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/skills/chore.tar.gzView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 33-58json

33 "bin": {

34 "omo-meta-governor-mcp": "./dist/mcp-server.js"

35 },

36 "description": "Self-judging agent orchestration layer for OpenCode. Reads memory, scores sessions, dispatches decisions.",

37 "files": [

38 "dist",

39 "README.md",

40 "scripts/bootstrap-agents-md.mjs"

41 ],

42 "license": "MIT",

43 "publishConfig": {

44 "access": "public",

45 "registry": "https://registry.npmjs.org/"

46 },

47 "scripts": {

48 "build": "bun build.ts",

49 "build:skills": "bun run build.ts skills",

50 "typecheck": "tsc --noEmit",

51 "test": "bun test",

52 "release": "bun scripts/release.ts",

53 "postinstall": "node scripts/bootstrap-agents-md.mjs || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L53

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L53

54 },

55 "type": "module",

56 "types": "./dist/index.d.ts"

57}

58

dist/lib.jsView file

Lines 1-21javascript

1import{createRequire as i9}from"node:module";var h9=Object.defineProperty;var r9=($)=>$;function n9($,v){this

dist/mcp-server.jsView file

4|| (${Q} === "string" && ${z} && ${z} == +${z} && !(${z} % 1))`).assign(Y,c._`+${z}`);return;case"boolean":X.elseIf(c._`${z} === "false" || ${z} === 0 || ${z} === null`).assign(Y,!... L5: || ${Q} === "boolean" || ${z} === null`).assign(Y,c._`[${z}]`)}}}function FF({gen:$,parentData:U,parentDataProperty:J},X){$.if(c._`${U} !== undefined`,()=>$.assign(c._`${U}[${J}]`,... L6: missingProperty: ${X}, L7: depsCount: ${U}, L8: deps: ${J}}`};var NP={keyword:"dependencies",type:"object",schemaType:"object",error:HO.error,code($){let[U,J]=OP($);OO($,U),BO($,J)}};function OP({schema:$}){let U={},J={};for(let... L9: `}catch{b=JSON.stringify({timestamp:Y.timestamp,level:$,message:U,data:"[unserializable]"})+`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mcp-server.jsView on unpkg · L4

1import{createRequire as ow}from"node:module";var hw=Object.create;var{getPrototypeOf:uw,defineProperty:m9,getOwnPropertyNames:mw}=Object;var lw=Object.prototype.hasOwnProperty;func... L2: `:""},this._extScope=$,this._scope=new Y6.Scope({parent:$}),this._nodes=[new b3]}toString(){return this._root.render(this.opts)}name($){return this._scope.name($)}scopeName($){retu... L3: || (${Q} == "string" && ${z} && ${z} == +${z})`).assign(Y,c._`+${z}`);return;case"integer":X.elseIf(c._`${Q} === "boolean" || ${z} === null L4: || (${Q} === "string" && ${z} && ${z} == +${z} && !(${z} % 1))`).assign(Y,c._`+${z}`);return;case"boolean":X.elseIf(c._`${z} === "false" || ${z} === 0 || ${z} === null`).assign(Y,!... L5: || ${Q} === "boolean" || ${z} === null`).assign(Y,c._`[${z}]`)}}}function FF({gen:$,pare

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/mcp-server.jsView on unpkg · L1

scripts/bootstrap-agents-md.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

2/**

3 * v0.38.9 — postinstall bootstrap for ~/.config/opencode/AGENTS.md.

4 *

5 * Runs after `npm install @herjarsa/omo-meta-governor`. Appends an

6 * idempotent snippet of meta-governor [SYSTEM-NUDGE] directives to the

7 * user's global AGENTS.md so that sub-agents spawned outside the

8 * opencode process still see the plugin's directives.

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/bootstrap-agents-md.mjsView on unpkg · L2

dist/skills/chore.tar.gzView file

•path = dist/skills/chore.tar.gz kind = high_entropy_blob sizeBytes = 131389 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/skills/chore.tar.gzView on unpkg

•path = dist/skills/chore.tar.gz kind = compressed_blob sizeBytes = 131389 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/skills/chore.tar.gzView on unpkg

Lines 147-187javascript

147 ORDER BY priority ASC, updated_at_ms DESC

148 `)}}saveMemory($){let v=VX("M"),z=($.concepts[0]??"memory").slice(0,80);return this.stmts.insertEntry.run(v,"memory",z,$.content,"",null,0.5,JSON.stringify($.concepts),JSON.stringify($.files??[]),"","",Date.now()),Promise.resolve({id:v})}saveLesson($){let v=VX("L"),z=$.confidence??0.5,b=($.content.split(`

149`)[0]??"lesson").slice(0,80);return this.stmts.insertEntry.run(v,"lesson",b,$.content,$.context,null,z,JSON.stringify($.tags??[]),JSON.stringify([]),"","",Date.now()),Promise.resolve({id:v})}smartSearch($){let v=$.limit??10,z=this.toFtsQuery($.query),U=this.stmts.ftsSearch.all(z,v).map((N)=>({id:N.id,title:N.title,content:N.content,type:N.kind,concepts:WX(N.tags),confidence:N.confidence,files:WX(N.files),advice:N.advice??"info"}));return Promise.resolve({lessons:U,crystals:[]})}boulderRead($){let z=this.stmts.boulderSelect.all($.directory,$.sessionID).map((b)=>({id:b.id,title:b.title,priority: ...

150 FROM skills s

151 JOIN skills_fts f ON f.rowid = (SELECT rowid FROM skills WHERE id = s.id)

152 ${b}

153 ORDER BY rank

154 LIMIT ?`).all(...z,U);return Promise.resolve(N)}skillGet($){let v=this.db.prepare(`SELECT s.id, s.name, s.description, s.repo_url, s.installs, s.skill_id, s.download_count, s.last_synced, s.content_hash

155 FROM skills s

156 WHERE s.id = ?`).get($);return Promise.resolve(v??null)}skillAddOrUpdate($){let v=Date.now();return this.db.prepare(`

157 INSERT INTO skills (id, name, description, repo_url, installs, skill_id, download_count, last_synced, content_hash)

158 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)

159 ON CONFLICT(id) DO UPDATE SET

160 name = excluded.name,

161 description = excluded.description,

162 repo_url = excluded.repo_url,

163 installs = excluded.installs,

164 skill_id = excluded.skill_id,

165 download_count = excluded.download_count,

166 last_synced = excluded.last_synced,

167 content_hash = excluded.content_hash

168 `).run($.id,$.name,$.description,$.repo_url,$.installs??0,$.skill_id,$.download_count??0,$.last_synced??v,$.content_hash),Promise.resolve($.id)}setSkillMaterializedAt($,v){this.db.prepare("UPDATE skills SET last_materialized_at = ? WHERE id LIKE ? OR id = ?").run(v,`%/${$}`,$)}getSkillMaterializedAt($){return

169`)}var Fv=($)=>(v,z,b,U)=>{let N=b?Object.assign(b,{async:!1}):{async:!1},J=v._zod.run({value:z,issues:[]},N);if(J instanceof Promise)throw new R$;if(J.issues.length){let X=new(U?.Err??$)(J.issues.map((_)=>w$(_,N,U$())));throw j4(X,U?.callee),X}return J.value},G4=Fv(W$),Ev=($)=>async(v,z,b,U)=>{let N=b?Object.assign(b,{async:!0}):{async:!0},J=v._zod.run({value:z,issues:[]},N);if(J instanceof Promise)J=await J;if(J.issues.length){let X=new(U?.Err??$)(J.issues.map((_)=>w$(_,N,U$())));throw j4(X,U?.callee),X}return J.value},k4=Ev(W$),Dv=($)=>(v,z,b)=>{let U=b?{...b,async:!1}:{async:!1},N=v._zod.r ...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/lib.jsView on unpkg · L167

170`).filter((N)=>N),b=Math.min(...z.map((N)=>N.length-N.trimStart().length)),U=z.map((N

171`))}}var Dz={major:4,minor:1,patch:8};var M=Y("$ZodType",($,v)=>{var z;$??($={}),$._zod.def=v,$._zod.bag=$._zod.bag

172 if (${b$}.issues.length) {

173 payload.issues = payload.issues.concat(${b$}.issues.map(iss => ({

174 ...iss,

175 path: iss.path ? [${A$}, ...iss.path] : [${A$}]

176 })));

177 }

178

179

180 if (${b$}.value === undefined) {

181 if (${A$} in input) {

182 newResult[${A$}] = undefined;

183 }

184 } else {

185 newResult[${A$}] = ${b$}.value;

186 }

187

Long lines were clipped for display.