Loading npm security reports…

@herjarsa/omo-meta-governor@0.45.0: AI-agent control-surface risk | LPM Firewall

registry / @herjarsa/omo-meta-governor / 0.45.0

@herjarsa/omo-meta-governor@0.45.0

Self-judging agent orchestration layer for OpenCode. Reads memory, scores sessions, dispatches decisions.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package changes the user's OpenCode control surface. It injects binding agent directives and registers them in the OpenCode configuration.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm automatically runs postinstall when this package is installed.

Impact

Future OpenCode agents can load package-authored directives without a separate user setup command.

Mechanism

Postinstall writes agent instructions and patches OpenCode configuration.

Policy narrative

The npm postinstall hook invokes a script that creates a home-directory OpenCode plugin instruction file. The file declares its directives binding, then the script patches the user's OpenCode configuration to load it. This is automatic mutation of a broad AI-agent control surface during installation rather than explicit user-command setup.

Rationale

The package performs unconsented postinstall mutation of OpenCode configuration and injects binding instructions into future agent sessions. This is concrete install-hook abuse even though no secret theft was confirmed.

Evidence

package.jsonscripts/bootstrap-agents-md.mjs~/.config/opencode/plugins/omo-meta-governor/instructions.md~/.config/opencode/opencode.jsonc~/.config/opencode/AGENTS.md

Decision evidence

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/bootstrap-agents-md.mjs || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/bootstrap-agents-md.mjs || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/lib.jsView file

2`)n++;continue}if(s==="/"&&a==="*"){n+=2;while(n<e.length&&!(e[n]==="*"&&e[n+1]==="/"))n++;n+=2;continue}t+=s,n++}return t}function ph(e,t){let n=Ed(e);if(!n.exists)return{changed:... L3: `;return ah(e,s,"utf8"),{changed:!0,wrote:!0}}catch(s){return{changed:!1,wrote:!1,error:s instanceof Error?s.message:String(s)}}}var rr=()=>{};import{spawn as gh,spawnSync as gt}fr... L4: `}catch{l=JSON.stringify({timestamp:a.timestamp,level:e,message:t,data:"[unserializable]"})+`

High

Child Process

Package source references child process execution.

dist/lib.jsView on unpkg · L2

2`)n++;continue}if(s==="/"&&a==="*"){n+=2;while(n<e.length&&!(e[n]==="*"&&e[n+1]==="/"))n++;n+=2;continue}t+=s,n++}return t}function ph(e,t){let n=Ed(e);if(!n.exists)return{changed:... L3: `;return ah(e,s,"utf8"),{changed:!0,wrote:!0}}catch(s){return{changed:!1,wrote:!1,error:s instanceof Error?s.message:String(s)}}}var rr=()=>{};import{spawn as gh,spawnSync as gt}fr... L4: `}catch{l=JSON.stringify({timestamp:a.timestamp,level:e,message:t,data:"[unserializable]"})+`

High

Shell

Package source references shell execution.

dist/lib.jsView on unpkg · L2

4`}catch{l=JSON.stringify({timestamp:a.timestamp,level:e,message:t,data:"[unserializable]"})+` L5: `}try{vh(be,l)}catch{}if(e==="error")console.error(`[meta-governor] ${t}`)}function I(e,t,n){Ad(e,t,n)}function Th(e){Ad(e.level,e.message,e.data,e.event,e.sessionID)}function Dh()... L6: const OMO_MG_WATCH = 1;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib.jsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = @herjarsa/omo-meta-governor@0.42.0 matchedPath = dist/index.js matchedIdentity = npm:[redacted]:0.42.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib.jsView on unpkg

169content_hash = excluded.content_hash L170: `).run(e.id,e.name,e.description,e.repo_url,e.installs??0,e.skill_id,e.download_count??0,e.last_synced??t,e.content_hash),Promise.resolve(e.id)}setSkillMaterializedAt(e,t){this.db.... L171: `)}var Nt=(e)=>(t,n,i,r)=>{let o=i?Object.assign(i,{async:!1}):{async:!1},s=t._zod.run({value:n,issues:[]},o);if(s instanceof Promise)throw new Le;if(s.issues.length){let a=new(r?....

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/lib.jsView on unpkg · L169

dist/mcp-server.jsView file

4|| (${s} === "string" && ${r} && ${r} == +${r} && !(${r} % 1))`).assign(a,V._`+${r}`);return;case"boolean":o.elseIf(V._`${r} === "false" || ${r} === 0 || ${r} === null`).assign(a,!... L5: || ${s} === "boolean" || ${r} === null`).assign(a,V._`[${r}]`)}}}function jE({gen:e,parentData:t,parentDataProperty:n},o){e.if(V._`${t} !== undefined`,()=>e.assign(V._`${t}[${n}]`,... L6: missingProperty: ${o}, L7: depsCount: ${t}, L8: deps: ${n}}`};var $C={keyword:"dependencies",type:"object",schemaType:"object",error:xk.error,code(e){let[t,n]=xC(e);kk(e,t),$k(e,n)}};function xC({schema:e}){let t={},n={};for(let... L9: `}catch{c=JSON.stringify({timestamp:a.timestamp,level:e,message:t,data:"[unserializable]"})+`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mcp-server.jsView on unpkg · L4

1import{createRequire as iS}from"node:module";var Kw=Object.create;var{getPrototypeOf:Xw,defineProperty:Jl,getOwnPropertyNames:Yw}=Object;var Qw=Object.prototype.hasOwnProperty;func... L2: `:""},this._extScope=e,this._scope=new lt.Scope({parent:e}),this._nodes=[new yv]}toString(){return this._root.render(this.opts)}name(e){return this._scope.name(e)}scopeName(e){retu... L3: || (${s} == "string" && ${r} && ${r} == +${r})`).assign(a,V._`+${r}`);return;case"integer":o.elseIf(V._`${s} === "boolean" || ${r} === null L4: || (${s} === "string" && ${r} && ${r} == +${r} && !(${r} % 1))`).assign(a,V._`+${r}`);return;case"boolean":o.elseIf(V._`${r} === "false" || ${r} === 0 || ${r} === null`).assign(a,!... L5: || ${s} === "boolean" || ${r} === null`).assign(a,V._`[${r}]`)}}}function jE({gen:e,pare

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/mcp-server.jsView on unpkg · L1

scripts/bootstrap-agents-md.mjsView file

8* opencode process still see the plugin's directives. Also strips the L9: * old AGENTS.md snippet (v0.38.x backward-compat) and patches L10: * opencode.jsonc `instructions` array. L11: * ... L25: */ L26: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; L27: import { homedir } from "node:os"; ... L34: const TARGET = join(homedir(), ".config", "opencode", "plugins", "omo-meta-governor", "instructions.md"); L35: const OLD_TARGET = join(homedir(), ".config", "opencode", "AGENTS.md"); L36: const OPENCODE_JSONC = join(homedir(), ".config", "opencode", "opencode.jsonc"); L37: const INSTRUCTION_REL = "plugins/omo-meta-governor/instructions.md"; ... L251: const newRaw = JSON.stringify(data, null, 2) + "\n";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/bootstrap-agents-md.mjsView on unpkg · L8

dist/skills/chore.tar.gzView file

•path = dist/skills/chore.tar.gz kind = high_entropy_blob sizeBytes = 132682 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/skills/chore.tar.gzView on unpkg

•path = dist/skills/chore.tar.gz kind = compressed_blob sizeBytes = 132682 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/skills/chore.tar.gzView on unpkg

dist/index.jsView file

•matchType = normalized_sha256 matchedPackage = @herjarsa/omo-meta-governor@0.42.0 matchedPath = dist/index.js matchedIdentity = npm:[redacted]:0.42.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = f4b0b019b6e4be75 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @herjarsa/omo-meta-governor@0.42.0 matchedPath = dist/index.js matchedIdentity = npm:[redacted]:0.42.0 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

17 flagged

package.jsonView file

Lines 34-59json

34 "omo-meta-governor-mcp": "dist/mcp-server.js",

35 "omg": "dist/cli-doctor.js"

36 },

37 "description": "Self-judging agent orchestration layer for OpenCode. Reads memory, scores sessions, dispatches decisions.",

38 "files": [

39 "dist",

40 "README.md",

41 "scripts/bootstrap-agents-md.mjs"

42 ],

43 "license": "MIT",

44 "publishConfig": {

45 "access": "public",

46 "registry": "https://registry.npmjs.org/"

47 },

48 "scripts": {

49 "build": "bun build.ts",

50 "build:skills": "bun run build.ts skills",

51 "typecheck": "tsc --noEmit",

52 "test": "bun test",

53 "release": "bun scripts/release.ts",

54 "postinstall": "node scripts/bootstrap-agents-md.mjs || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L54

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L54

55 },

56 "type": "module",

57 "types": "./dist/index.d.ts"

58}

59

dist/lib.jsView file

Lines 1-22javascript

1import{createRequire as ih}from"node:module";var th=Object.defineProperty;var rh=(e)=>e;function nh(e,t){this

dist/mcp-server.jsView file

4|| (${s} === "string" && ${r} && ${r} == +${r} && !(${r} % 1))`).assign(a,V._`+${r}`);return;case"boolean":o.elseIf(V._`${r} === "false" || ${r} === 0 || ${r} === null`).assign(a,!... L5: || ${s} === "boolean" || ${r} === null`).assign(a,V._`[${r}]`)}}}function jE({gen:e,parentData:t,parentDataProperty:n},o){e.if(V._`${t} !== undefined`,()=>e.assign(V._`${t}[${n}]`,... L6: missingProperty: ${o}, L7: depsCount: ${t}, L8: deps: ${n}}`};var $C={keyword:"dependencies",type:"object",schemaType:"object",error:xk.error,code(e){let[t,n]=xC(e);kk(e,t),$k(e,n)}};function xC({schema:e}){let t={},n={};for(let... L9: `}catch{c=JSON.stringify({timestamp:a.timestamp,level:e,message:t,data:"[unserializable]"})+`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mcp-server.jsView on unpkg · L4

1import{createRequire as iS}from"node:module";var Kw=Object.create;var{getPrototypeOf:Xw,defineProperty:Jl,getOwnPropertyNames:Yw}=Object;var Qw=Object.prototype.hasOwnProperty;func... L2: `:""},this._extScope=e,this._scope=new lt.Scope({parent:e}),this._nodes=[new yv]}toString(){return this._root.render(this.opts)}name(e){return this._scope.name(e)}scopeName(e){retu... L3: || (${s} == "string" && ${r} && ${r} == +${r})`).assign(a,V._`+${r}`);return;case"integer":o.elseIf(V._`${s} === "boolean" || ${r} === null L4: || (${s} === "string" && ${r} && ${r} == +${r} && !(${r} % 1))`).assign(a,V._`+${r}`);return;case"boolean":o.elseIf(V._`${r} === "false" || ${r} === 0 || ${r} === null`).assign(a,!... L5: || ${s} === "boolean" || ${r} === null`).assign(a,V._`[${r}]`)}}}function jE({gen:e,pare

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/mcp-server.jsView on unpkg · L1

scripts/bootstrap-agents-md.mjsView file

8* opencode process still see the plugin's directives. Also strips the L9: * old AGENTS.md snippet (v0.38.x backward-compat) and patches L10: * opencode.jsonc `instructions` array. L11: * ... L25: */ L26: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; L27: import { homedir } from "node:os"; ... L34: const TARGET = join(homedir(), ".config", "opencode", "plugins", "omo-meta-governor", "instructions.md"); L35: const OLD_TARGET = join(homedir(), ".config", "opencode", "AGENTS.md"); L36: const OPENCODE_JSONC = join(homedir(), ".config", "opencode", "opencode.jsonc"); L37: const INSTRUCTION_REL = "plugins/omo-meta-governor/instructions.md"; ... L251: const newRaw = JSON.stringify(data, null, 2) + "\n";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/bootstrap-agents-md.mjsView on unpkg · L8

dist/skills/chore.tar.gzView file

•path = dist/skills/chore.tar.gz kind = high_entropy_blob sizeBytes = 132682 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/skills/chore.tar.gzView on unpkg

•path = dist/skills/chore.tar.gz kind = compressed_blob sizeBytes = 132682 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/skills/chore.tar.gzView on unpkg

dist/index.jsView file

•matchType = normalized_sha256 matchedPackage = @herjarsa/omo-meta-governor@0.42.0 matchedPath = dist/index.js matchedIdentity = npm:[redacted]:0.42.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = f4b0b019b6e4be75 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @herjarsa/omo-meta-governor@0.42.0 matchedPath = dist/index.js matchedIdentity = npm:[redacted]:0.42.0 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

Lines 149-189javascript

149 ORDER BY priority ASC, updated_at_ms DESC

150 `)}}saveMemory(e){let t=ym("M"),n=(e.concepts[0]??"memory").slice(0,80);return this.stmts.insertEntry.run(t,"memory",n,e.content,"",null,0.5,JSON.stringify(e.concepts),JSON.stringify(e.files??[]),"","",Date.now()),Promise.resolve({id:t})}saveLesson(e){let t=ym("L"),n=e.confidence??0.5,i=(e.content.split(`

151`)[0]??"lesson").slice(0,80);return this.stmts.insertEntry.run(t,"lesson",i,e.content,e.context,null,n,JSON.stringify(e.tags??[]),JSON.stringify([]),"","",Date.now()),Promise.resolve({id:t})}smartSearch(e){let t=e.limit??10,n=this.toFtsQuery(e.query),r=this.stmts.ftsSearch.all(n,t).map((o)=>({id:o.id,title:o.title,content:o.content,type:o.kind,concepts:bm(o.tags),confidence:o.confidence,files:bm(o.files),advice:o.advice??"info"}));return Promise.resolve({lessons:r,crystals:[]})}boulderRead(e){let n=this.stmts.boulderSelect.all(e.directory,e.sessionID).map((i)=>({id:i.id,title:i.title,priority: ...

152 FROM skills s

153 JOIN skills_fts f ON f.rowid = (SELECT rowid FROM skills WHERE id = s.id)

154 ${i}

155 ORDER BY rank

156 LIMIT ?`).all(...n,r);return Promise.resolve(o)}skillGet(e){let t=this.db.prepare(`SELECT s.id, s.name, s.description, s.repo_url, s.installs, s.skill_id, s.download_count, s.last_synced, s.content_hash

157 FROM skills s

158 WHERE s.id = ?`).get(e);return Promise.resolve(t??null)}skillAddOrUpdate(e){let t=Date.now();return this.db.prepare(`

159 INSERT INTO skills (id, name, description, repo_url, installs, skill_id, download_count, last_synced, content_hash)

160 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)

161 ON CONFLICT(id) DO UPDATE SET

162 name = excluded.name,

163 description = excluded.description,

164 repo_url = excluded.repo_url,

165 installs = excluded.installs,

166 skill_id = excluded.skill_id,

167 download_count = excluded.download_count,

168 last_synced = excluded.last_synced,

169 content_hash = excluded.content_hash

170 `).run(e.id,e.name,e.description,e.repo_url,e.installs??0,e.skill_id,e.download_count??0,e.last_synced??t,e.content_hash),Promise.resolve(e.id)}setSkillMaterializedAt(e,t){this.db.prepare("UPDATE skills SET last_materialized_at = ? WHERE id LIKE ? OR id = ?").run(t,`%/${e}`,e)}getSkillMaterializedAt(e){return

171`)}var Nt=(e)=>(t,n,i,r)=>{let o=i?Object.assign(i,{async:!1}):{async:!1},s=t._zod.run({value:n,issues:[]},o);if(s instanceof Promise)throw new Le;if(s.issues.length){let a=new(r?.Err??e)(s.issues.map((l)=>Te(l,o,oe())));throw wn(a,r?.callee),a}return s.value},xn=Nt(_e),Ut=(e)=>async(t,n,i,r)=>{let o=i?Object.assign(i,{async:!0}):{async:!0},s=t._zod.run({value:n,issues:[]},o);if(s instanceof Promise)s=await s;if(s.issues.length){let a=new(r?.Err??e)(s.issues.map((l)=>Te(l,o,oe())));throw wn(a,r?.callee),a}return s.value},$n=Ut(_e),Lt=(e)=>(t,n,i)=>{let r=i?{...i,async:!1}:{async:!1},o=t._zod.r ...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/lib.jsView on unpkg · L169

172`).filter((o)=>o),i=Math.min(...n.map((o)=>o.length-o.trimStart().length)),r=n.map((o)=>o.slice

173`))}}var Ns={major:4,minor:1,patch:8};var P=m("$ZodType",(e,t)=>{var n;e??(e={}),e._zod.def=t,e._zod.bag=e._zod.bag

174 if (${ae}.issues.length) {

175 payload.issues = payload.issues.concat(${ae}.issues.map(iss => ({

176 ...iss,

177 path: iss.path ? [${Pe}, ...iss.path] : [${Pe}]

178 })));

179 }

180

181

182 if (${ae}.value === undefined) {

183 if (${Pe} in input) {

184 newResult[${Pe}] = undefined;

185 }

186 } else {

187 newResult[${Pe}] = ${ae}.value;

188 }

189

Long lines were clipped for display.