Loading npm security reports…

@herjarsa/omo-meta-governor@0.40.0: AI-agent control-surface risk | LPM Firewall

registry / @herjarsa/omo-meta-governor / 0.40.0

@herjarsa/omo-meta-governor@0.40.0

Self-judging agent orchestration layer for OpenCode. Reads memory, scores sessions, dispatches decisions.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies OpenCode's agent instruction control surface. It inserts mandatory package-authored directives and registers them in the user's OpenCode configuration.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation, through the postinstall lifecycle hook.

Impact

An unconsented package can influence future AI-agent behavior outside the consumer project.

Mechanism

Postinstall writes agent instructions and patches OpenCode configuration.

Policy narrative

On npm installation, package.json launches the bootstrap script. That script creates or edits an OpenCode plugin instruction file containing directives described as binding, then adds that file to the user's OpenCode instructions configuration. This is an automatic mutation of a broad AI-agent control surface rather than an explicit user-command setup.

Rationale

The postinstall hook unconsentedly persists mandatory package instructions into OpenCode's configuration. This concrete agent-control mutation warrants blocking.

Evidence

package.jsonscripts/bootstrap-agents-md.mjs~/.config/opencode/plugins/omo-meta-governor/instructions.md~/.config/opencode/AGENTS.md~/.config/opencode/opencode.jsonc

Decision evidence

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/bootstrap-agents-md.mjs || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/bootstrap-agents-md.mjs || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/lib.jsView file

2`)n++;continue}if(s==="/"&&a==="*"){n+=2;while(n<e.length&&!(e[n]==="*"&&e[n+1]==="/"))n++;n+=2;continue}t+=s,n++}return t}function oh(e,t){let n=Dd(e);if(!n.exists)return{changed:... L3: `;return Qg(e,s,"utf8"),{changed:!0,wrote:!0}}catch(s){return{changed:!1,wrote:!1,error:s instanceof Error?s.message:String(s)}}}var Yt=()=>{};import{spawn as ah,spawnSync as ut}fr... L4: `}catch{l=JSON.stringify({timestamp:a.timestamp,level:e,message:t,data:"[unserializable]"})+`

High

Child Process

Package source references child process execution.

dist/lib.jsView on unpkg · L2

2`)n++;continue}if(s==="/"&&a==="*"){n+=2;while(n<e.length&&!(e[n]==="*"&&e[n+1]==="/"))n++;n+=2;continue}t+=s,n++}return t}function oh(e,t){let n=Dd(e);if(!n.exists)return{changed:... L3: `;return Qg(e,s,"utf8"),{changed:!0,wrote:!0}}catch(s){return{changed:!1,wrote:!1,error:s instanceof Error?s.message:String(s)}}}var Yt=()=>{};import{spawn as ah,spawnSync as ut}fr... L4: `}catch{l=JSON.stringify({timestamp:a.timestamp,level:e,message:t,data:"[unserializable]"})+`

High

Shell

Package source references shell execution.

dist/lib.jsView on unpkg · L2

4`}catch{l=JSON.stringify({timestamp:a.timestamp,level:e,message:t,data:"[unserializable]"})+` L5: `}try{ch(ve,l)}catch{}if(e==="error")console.error(`[meta-governor] ${t}`)}function S(e,t,n){zd(e,t,n)}function bh(e){zd(e.level,e.message,e.data,e.event,e.sessionID)}function _h()... L6: const OMO_MG_WATCH = 1;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib.jsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = @herjarsa/omo-meta-governor@0.39.6 matchedPath = dist/index.js matchedIdentity = npm:[redacted]:0.39.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib.jsView on unpkg

169content_hash = excluded.content_hash L170: `).run(e.id,e.name,e.description,e.repo_url,e.installs??0,e.skill_id,e.download_count??0,e.last_synced??t,e.content_hash),Promise.resolve(e.id)}setSkillMaterializedAt(e,t){this.db.... L171: `)}var Rt=(e)=>(t,n,i,r)=>{let o=i?Object.assign(i,{async:!1}):{async:!1},s=t._zod.run({value:n,issues:[]},o);if(s instanceof Promise)throw new Ae;if(s.issues.length){let a=new(r?....

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/lib.jsView on unpkg · L169

dist/mcp-server.jsView file

4|| (${s} === "string" && ${r} && ${r} == +${r} && !(${r} % 1))`).assign(a,V._`+${r}`);return;case"boolean":o.elseIf(V._`${r} === "false" || ${r} === 0 || ${r} === null`).assign(a,!... L5: || ${s} === "boolean" || ${r} === null`).assign(a,V._`[${r}]`)}}}function jE({gen:e,parentData:t,parentDataProperty:n},o){e.if(V._`${t} !== undefined`,()=>e.assign(V._`${t}[${n}]`,... L6: missingProperty: ${o}, L7: depsCount: ${t}, L8: deps: ${n}}`};var $C={keyword:"dependencies",type:"object",schemaType:"object",error:xk.error,code(e){let[t,n]=xC(e);kk(e,t),$k(e,n)}};function xC({schema:e}){let t={},n={};for(let... L9: `}catch{c=JSON.stringify({timestamp:a.timestamp,level:e,message:t,data:"[unserializable]"})+`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mcp-server.jsView on unpkg · L4

1import{createRequire as iS}from"node:module";var Kw=Object.create;var{getPrototypeOf:Xw,defineProperty:Jl,getOwnPropertyNames:Yw}=Object;var Qw=Object.prototype.hasOwnProperty;func... L2: `:""},this._extScope=e,this._scope=new lt.Scope({parent:e}),this._nodes=[new yv]}toString(){return this._root.render(this.opts)}name(e){return this._scope.name(e)}scopeName(e){retu... L3: || (${s} == "string" && ${r} && ${r} == +${r})`).assign(a,V._`+${r}`);return;case"integer":o.elseIf(V._`${s} === "boolean" || ${r} === null L4: || (${s} === "string" && ${r} && ${r} == +${r} && !(${r} % 1))`).assign(a,V._`+${r}`);return;case"boolean":o.elseIf(V._`${r} === "false" || ${r} === 0 || ${r} === null`).assign(a,!... L5: || ${s} === "boolean" || ${r} === null`).assign(a,V._`[${r}]`)}}}function jE({gen:e,pare

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/mcp-server.jsView on unpkg · L1

scripts/bootstrap-agents-md.mjsView file

8* opencode process still see the plugin's directives. Also strips the L9: * old AGENTS.md snippet (v0.38.x backward-compat) and patches L10: * opencode.jsonc `instructions` array. L11: * ... L25: */ L26: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; L27: import { homedir } from "node:os"; ... L34: const TARGET = join(homedir(), ".config", "opencode", "plugins", "omo-meta-governor", "instructions.md"); L35: const OLD_TARGET = join(homedir(), ".config", "opencode", "AGENTS.md"); L36: const OPENCODE_JSONC = join(homedir(), ".config", "opencode", "opencode.jsonc"); L37: const INSTRUCTION_REL = "plugins/omo-meta-governor/instructions.md"; ... L251: const newRaw = JSON.stringify(data, null, 2) + "\n";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/bootstrap-agents-md.mjsView on unpkg · L8

dist/skills/chore.tar.gzView file

•path = dist/skills/chore.tar.gz kind = high_entropy_blob sizeBytes = 132677 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/skills/chore.tar.gzView on unpkg

•path = dist/skills/chore.tar.gz kind = compressed_blob sizeBytes = 132677 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/skills/chore.tar.gzView on unpkg

dist/index.jsView file

•matchType = normalized_sha256 matchedPackage = @herjarsa/omo-meta-governor@0.39.6 matchedPath = dist/index.js matchedIdentity = npm:[redacted]:0.39.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = f4b0b019b6e4be75 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @herjarsa/omo-meta-governor@0.39.6 matchedPath = dist/index.js matchedIdentity = npm:[redacted]:0.39.6 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

17 flagged

package.jsonView file

Lines 34-59json

34 "omo-meta-governor-mcp": "dist/mcp-server.js",

35 "omg": "dist/cli-doctor.js"

36 },

37 "description": "Self-judging agent orchestration layer for OpenCode. Reads memory, scores sessions, dispatches decisions.",

38 "files": [

39 "dist",

40 "README.md",

41 "scripts/bootstrap-agents-md.mjs"

42 ],

43 "license": "MIT",

44 "publishConfig": {

45 "access": "public",

46 "registry": "https://registry.npmjs.org/"

47 },

48 "scripts": {

49 "build": "bun build.ts",

50 "build:skills": "bun run build.ts skills",

51 "typecheck": "tsc --noEmit",

52 "test": "bun test",

53 "release": "bun scripts/release.ts",

54 "postinstall": "node scripts/bootstrap-agents-md.mjs || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L54

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L54

55 },

56 "type": "module",

57 "types": "./dist/index.d.ts"

58}

59

dist/lib.jsView file

Lines 1-22javascript

1import{createRequire as Kg}from"node:module";var Vg=Object.defineProperty;var qg=(e)=>e;function Jg(e,t){this

dist/mcp-server.jsView file

4|| (${s} === "string" && ${r} && ${r} == +${r} && !(${r} % 1))`).assign(a,V._`+${r}`);return;case"boolean":o.elseIf(V._`${r} === "false" || ${r} === 0 || ${r} === null`).assign(a,!... L5: || ${s} === "boolean" || ${r} === null`).assign(a,V._`[${r}]`)}}}function jE({gen:e,parentData:t,parentDataProperty:n},o){e.if(V._`${t} !== undefined`,()=>e.assign(V._`${t}[${n}]`,... L6: missingProperty: ${o}, L7: depsCount: ${t}, L8: deps: ${n}}`};var $C={keyword:"dependencies",type:"object",schemaType:"object",error:xk.error,code(e){let[t,n]=xC(e);kk(e,t),$k(e,n)}};function xC({schema:e}){let t={},n={};for(let... L9: `}catch{c=JSON.stringify({timestamp:a.timestamp,level:e,message:t,data:"[unserializable]"})+`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mcp-server.jsView on unpkg · L4

1import{createRequire as iS}from"node:module";var Kw=Object.create;var{getPrototypeOf:Xw,defineProperty:Jl,getOwnPropertyNames:Yw}=Object;var Qw=Object.prototype.hasOwnProperty;func... L2: `:""},this._extScope=e,this._scope=new lt.Scope({parent:e}),this._nodes=[new yv]}toString(){return this._root.render(this.opts)}name(e){return this._scope.name(e)}scopeName(e){retu... L3: || (${s} == "string" && ${r} && ${r} == +${r})`).assign(a,V._`+${r}`);return;case"integer":o.elseIf(V._`${s} === "boolean" || ${r} === null L4: || (${s} === "string" && ${r} && ${r} == +${r} && !(${r} % 1))`).assign(a,V._`+${r}`);return;case"boolean":o.elseIf(V._`${r} === "false" || ${r} === 0 || ${r} === null`).assign(a,!... L5: || ${s} === "boolean" || ${r} === null`).assign(a,V._`[${r}]`)}}}function jE({gen:e,pare

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/mcp-server.jsView on unpkg · L1

scripts/bootstrap-agents-md.mjsView file

8* opencode process still see the plugin's directives. Also strips the L9: * old AGENTS.md snippet (v0.38.x backward-compat) and patches L10: * opencode.jsonc `instructions` array. L11: * ... L25: */ L26: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; L27: import { homedir } from "node:os"; ... L34: const TARGET = join(homedir(), ".config", "opencode", "plugins", "omo-meta-governor", "instructions.md"); L35: const OLD_TARGET = join(homedir(), ".config", "opencode", "AGENTS.md"); L36: const OPENCODE_JSONC = join(homedir(), ".config", "opencode", "opencode.jsonc"); L37: const INSTRUCTION_REL = "plugins/omo-meta-governor/instructions.md"; ... L251: const newRaw = JSON.stringify(data, null, 2) + "\n";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/bootstrap-agents-md.mjsView on unpkg · L8

dist/skills/chore.tar.gzView file

•path = dist/skills/chore.tar.gz kind = high_entropy_blob sizeBytes = 132677 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/skills/chore.tar.gzView on unpkg

•path = dist/skills/chore.tar.gz kind = compressed_blob sizeBytes = 132677 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/skills/chore.tar.gzView on unpkg

dist/index.jsView file

•matchType = normalized_sha256 matchedPackage = @herjarsa/omo-meta-governor@0.39.6 matchedPath = dist/index.js matchedIdentity = npm:[redacted]:0.39.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = f4b0b019b6e4be75 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @herjarsa/omo-meta-governor@0.39.6 matchedPath = dist/index.js matchedIdentity = npm:[redacted]:0.39.6 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

Lines 149-189javascript

149 ORDER BY priority ASC, updated_at_ms DESC

150 `)}}saveMemory(e){let t=gm("M"),n=(e.concepts[0]??"memory").slice(0,80);return this.stmts.insertEntry.run(t,"memory",n,e.content,"",null,0.5,JSON.stringify(e.concepts),JSON.stringify(e.files??[]),"","",Date.now()),Promise.resolve({id:t})}saveLesson(e){let t=gm("L"),n=e.confidence??0.5,i=(e.content.split(`

151`)[0]??"lesson").slice(0,80);return this.stmts.insertEntry.run(t,"lesson",i,e.content,e.context,null,n,JSON.stringify(e.tags??[]),JSON.stringify([]),"","",Date.now()),Promise.resolve({id:t})}smartSearch(e){let t=e.limit??10,n=this.toFtsQuery(e.query),r=this.stmts.ftsSearch.all(n,t).map((o)=>({id:o.id,title:o.title,content:o.content,type:o.kind,concepts:hm(o.tags),confidence:o.confidence,files:hm(o.files),advice:o.advice??"info"}));return Promise.resolve({lessons:r,crystals:[]})}boulderRead(e){let n=this.stmts.boulderSelect.all(e.directory,e.sessionID).map((i)=>({id:i.id,title:i.title,priority: ...

152 FROM skills s

153 JOIN skills_fts f ON f.rowid = (SELECT rowid FROM skills WHERE id = s.id)

154 ${i}

155 ORDER BY rank

156 LIMIT ?`).all(...n,r);return Promise.resolve(o)}skillGet(e){let t=this.db.prepare(`SELECT s.id, s.name, s.description, s.repo_url, s.installs, s.skill_id, s.download_count, s.last_synced, s.content_hash

157 FROM skills s

158 WHERE s.id = ?`).get(e);return Promise.resolve(t??null)}skillAddOrUpdate(e){let t=Date.now();return this.db.prepare(`

159 INSERT INTO skills (id, name, description, repo_url, installs, skill_id, download_count, last_synced, content_hash)

160 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)

161 ON CONFLICT(id) DO UPDATE SET

162 name = excluded.name,

163 description = excluded.description,

164 repo_url = excluded.repo_url,

165 installs = excluded.installs,

166 skill_id = excluded.skill_id,

167 download_count = excluded.download_count,

168 last_synced = excluded.last_synced,

169 content_hash = excluded.content_hash

170 `).run(e.id,e.name,e.description,e.repo_url,e.installs??0,e.skill_id,e.download_count??0,e.last_synced??t,e.content_hash),Promise.resolve(e.id)}setSkillMaterializedAt(e,t){this.db.prepare("UPDATE skills SET last_materialized_at = ? WHERE id LIKE ? OR id = ?").run(t,`%/${e}`,e)}getSkillMaterializedAt(e){return

171`)}var Rt=(e)=>(t,n,i,r)=>{let o=i?Object.assign(i,{async:!1}):{async:!1},s=t._zod.run({value:n,issues:[]},o);if(s instanceof Promise)throw new Ae;if(s.issues.length){let a=new(r?.Err??e)(s.issues.map((l)=>Se(l,o,ie())));throw bn(a,r?.callee),a}return s.value},_n=Rt(ye),Mt=(e)=>async(t,n,i,r)=>{let o=i?Object.assign(i,{async:!0}):{async:!0},s=t._zod.run({value:n,issues:[]},o);if(s instanceof Promise)s=await s;if(s.issues.length){let a=new(r?.Err??e)(s.issues.map((l)=>Se(l,o,ie())));throw bn(a,r?.callee),a}return s.value},kn=Mt(ye),At=(e)=>(t,n,i)=>{let r=i?{...i,async:!1}:{async:!1},o=t._zod.r ...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/lib.jsView on unpkg · L169

172`).filter((o)=>o),i=Math.min(...n.map((o)=>o.length-o.trimStart().length)),r=n.map((o)=>o.slice

173`))}}var Ms={major:4,minor:1,patch:8};var D=m("$ZodType",(e,t)=>{var n;e??(e={}),e._zod.def=t,e._zod.bag=e._zod.bag

174 if (${se}.issues.length) {

175 payload.issues = payload.issues.concat(${se}.issues.map(iss => ({

176 ...iss,

177 path: iss.path ? [${Te}, ...iss.path] : [${Te}]

178 })));

179 }

180

181

182 if (${se}.value === undefined) {

183 if (${Te} in input) {

184 newResult[${Te}] = undefined;

185 }

186 } else {

187 newResult[${Te}] = ${se}.value;

188 }

189

Long lines were clipped for display.