Loading npm security reports…

@herjarsa/omo-meta-governor@0.50.2: AI-agent control-surface risk | LPM Firewall

registry / @herjarsa/omo-meta-governor / 0.50.2

@herjarsa/omo-meta-governor@0.50.2

Self-judging agent orchestration layer for OpenCode. Reads memory, scores sessions, dispatches decisions.

AI Security Review

scanned 13d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On npm install, postinstall writes binding agent instructions into the user OpenCode config and rewrites opencode.jsonc so those instructions load. The only skip is an environment variable set before install.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install or any lifecycle that runs the package postinstall script.

Impact

OpenCode sessions pick up unsolicited binding directives, and the global opencode.jsonc file is reformatted, which can drop comments and other JSONC-only content.

Mechanism

bootstrap-agents-md.mjs creates ~/.config/opencode/plugins/omo-meta-governor/instructions.md with mandatory SYSTEM-NUDGE text, strips a prior snippet from ~/.config/opencode/AGENTS.md, and appends the instruction path to ~/.config/opencode/opencode.jsonc after reparsing and rewriting the file.

Policy narrative

Installing @herjarsa/omo-meta-governor runs a postinstall script that edits the user OpenCode agent surface without a prompt. It writes a plugin instructions file that tells the agent SYSTEM-NUDGE directives are binding, removes an older snippet from AGENTS.md, and rewrites opencode.jsonc so the new file is loaded. Skipping requires OMO_META_GOVERNOR_NO_BOOTSTRAP=1 before install. Failures are swallowed so the install still succeeds.

AI rationale

The postinstall hook unconsentedly mutates the user-wide OpenCode instruction config and injects binding agent directives. An opt-out environment variable does not make that install-time control-surface write consensual.

Evidence

package.jsonscripts/bootstrap-agents-md.mjs~/.config/opencode/plugins/omo-meta-governor/instructions.md~/.config/opencode/AGENTS.md

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/bootstrap-agents-md.mjs || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/bootstrap-agents-md.mjs || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/lib.jsView file

2`)n++;continue}if(s==="/"&&a==="*"){n+=2;while(n<e.length&&!(e[n]==="*"&&e[n+1]==="/"))n++;n+=2;continue}t+=s,n++}return t}function Xx(e,t){let n=xh(e);if(!n.exists)return{changed:... L3: `;return yh(e,s,"utf8"),{changed:!0,wrote:!0}}catch(s){return{changed:!1,wrote:!1,error:s instanceof Error?s.message:String(s)}}}var Yt=()=>{};import{spawn as Sh,spawnSync as ft}fr... L4: `}catch{l=JSON.stringify({timestamp:a.timestamp,level:e,message:t,data:"[unserializable]"})+`

High

Child Process

Package source references child process execution.

dist/lib.jsView on unpkg · L2

2`)n++;continue}if(s==="/"&&a==="*"){n+=2;while(n<e.length&&!(e[n]==="*"&&e[n+1]==="/"))n++;n+=2;continue}t+=s,n++}return t}function Xx(e,t){let n=xh(e);if(!n.exists)return{changed:... L3: `;return yh(e,s,"utf8"),{changed:!0,wrote:!0}}catch(s){return{changed:!1,wrote:!1,error:s instanceof Error?s.message:String(s)}}}var Yt=()=>{};import{spawn as Sh,spawnSync as ft}fr... L4: `}catch{l=JSON.stringify({timestamp:a.timestamp,level:e,message:t,data:"[unserializable]"})+`

High

Shell

Package source references shell execution.

dist/lib.jsView on unpkg · L2

4`}catch{l=JSON.stringify({timestamp:a.timestamp,level:e,message:t,data:"[unserializable]"})+` L5: `}try{Th(Ne,l)}catch{}if(e==="error")console.error(`[meta-governor] ${t}`)}function w(e,t,n){Nh(e,t,n)}var Ch,Mh,Ne,zh=10485760,bd=5;var it=Be(()=>{Yt();Ch=[/eyJ[a-zA-Z0-9_-]+\.[a-... L6: const OMO_MG_WATCH = 1;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib.jsView on unpkg · L4

169content_hash = excluded.content_hash L170: `).run(e.id,e.name,e.description,e.repo_url,e.installs??0,e.skill_id,e.download_count??0,e.last_synced??t,e.content_hash),Promise.resolve(e.id)}setSkillMaterializedAt(e,t){this.db.... L171: `)}var Et=(e)=>(t,n,i,r)=>{let o=i?Object.assign(i,{async:!1}):{async:!1},s=t._zod.run({value:n,issues:[]},o);if(s instanceof Promise)throw new Le;if(s.issues.length){let a=new(r?....

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/lib.jsView on unpkg · L169

dist/mcp-server.jsView file

4|| (${s} === "string" && ${r} && ${r} == +${r} && !(${r} % 1))`).assign(a,V._`+${r}`);return;case"boolean":o.elseIf(V._`${r} === "false" || ${r} === 0 || ${r} === null`).assign(a,!... L5: || ${s} === "boolean" || ${r} === null`).assign(a,V._`[${r}]`)}}}function q1({gen:e,parentData:t,parentDataProperty:n},o){e.if(V._`${t} !== undefined`,()=>e.assign(V._`${t}[${n}]`,... L6: missingProperty: ${o}, L7: depsCount: ${t}, L8: deps: ${n}}`};var Oj={keyword:"dependencies",type:"object",schemaType:"object",error:sk.error,code(e){let[t,n]=Ej(e);ok(e,t),ik(e,n)}};function Ej({schema:e}){let t={},n={};for(let... L9: `}catch{c=JSON.stringify({timestamp:a.timestamp,level:e,message:t,data:"[unserializable]"})+`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mcp-server.jsView on unpkg · L4

1var gw=Object.create;var{getPrototypeOf:_w,defineProperty:Nl,getOwnPropertyNames:yw}=Object;var Qf=Object.prototype.hasOwnProperty;function vw(e){return this[e]}var bw,kw,eh=(e,t,n... L2: `:""},this._extScope=e,this._scope=new st.Scope({parent:e}),this._nodes=[new ey]}toString(){return this._root.render(this.opts)}name(e){return this._scope.name(e)}scopeName(e){retu... L3: || (${s} == "string" && ${r} && ${r} == +${r})`).assign(a,V._`+${r}`);return;case"integer":o.elseIf(V._`${s} === "boolean" || ${r} === null L4: || (${s} === "string" && ${r} && ${r} == +${r} && !(${r} % 1))`).assign(a,V._`+${r}`);return;case"boolean":o.elseIf(V._`${r} === "false" || ${r} === 0 || ${r} === null`).assign(a,!... L5: || ${s} === "boolean" || ${r} === null`).assign(a,V._`[${r}]`)}}}function q1({gen:e,pare

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/mcp-server.jsView on unpkg · L1

scripts/bootstrap-agents-md.mjsView file

8* opencode process still see the plugin's directives. Also strips the L9: * old AGENTS.md snippet (v0.38.x backward-compat) and patches L10: * opencode.jsonc `instructions` array. L11: * ... L25: */ L26: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; L27: import { homedir } from "node:os"; ... L34: const TARGET = join(homedir(), ".config", "opencode", "plugins", "omo-meta-governor", "instructions.md"); L35: const OLD_TARGET = join(homedir(), ".config", "opencode", "AGENTS.md"); L36: const OPENCODE_JSONC = join(homedir(), ".config", "opencode", "opencode.jsonc"); L37: const INSTRUCTION_REL = "plugins/omo-meta-governor/instructions.md"; ... L251: const newRaw = JSON.stringify(data, null, 2) + "\n";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/bootstrap-agents-md.mjsView on unpkg · L8

dist/skills/chore.tar.gzView file

•path = dist/skills/chore.tar.gz kind = high_entropy_blob sizeBytes = 132533 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/skills/chore.tar.gzView on unpkg

•path = dist/skills/chore.tar.gz kind = compressed_blob sizeBytes = 132533 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/skills/chore.tar.gzView on unpkg

Source & flagged code

14 flagged

package.jsonView file

Lines 35-60json

35 "omo-meta-governor-mcp": "dist/mcp-server.js",

36 "omg": "dist/cli-doctor.js"

37 },

38 "description": "Self-judging agent orchestration layer for OpenCode. Reads memory, scores sessions, dispatches decisions.",

39 "files": [

40 "dist",

41 "README.md",

42 "scripts/bootstrap-agents-md.mjs"

43 ],

44 "license": "MIT",

45 "publishConfig": {

46 "access": "public",

47 "registry": "https://registry.npmjs.org/"

48 },

49 "scripts": {

50 "build": "bun build.ts",

51 "build:skills": "bun run build.ts skills",

52 "typecheck": "tsc --noEmit",

53 "test": "bun test",

54 "release": "bun scripts/release.ts",

55 "postinstall": "node scripts/bootstrap-agents-md.mjs || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L55

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L55

56 },

57 "type": "module",

58 "types": "./dist/index.d.ts"

59}

60

dist/lib.jsView file

Lines 1-22javascript

1import{createRequire as gh}from"node:module";var mh=Object.defineProperty;var ph=(e)=>e;function fh(e,t){this

dist/mcp-server.jsView file

4|| (${s} === "string" && ${r} && ${r} == +${r} && !(${r} % 1))`).assign(a,V._`+${r}`);return;case"boolean":o.elseIf(V._`${r} === "false" || ${r} === 0 || ${r} === null`).assign(a,!... L5: || ${s} === "boolean" || ${r} === null`).assign(a,V._`[${r}]`)}}}function q1({gen:e,parentData:t,parentDataProperty:n},o){e.if(V._`${t} !== undefined`,()=>e.assign(V._`${t}[${n}]`,... L6: missingProperty: ${o}, L7: depsCount: ${t}, L8: deps: ${n}}`};var Oj={keyword:"dependencies",type:"object",schemaType:"object",error:sk.error,code(e){let[t,n]=Ej(e);ok(e,t),ik(e,n)}};function Ej({schema:e}){let t={},n={};for(let... L9: `}catch{c=JSON.stringify({timestamp:a.timestamp,level:e,message:t,data:"[unserializable]"})+`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mcp-server.jsView on unpkg · L4

1var gw=Object.create;var{getPrototypeOf:_w,defineProperty:Nl,getOwnPropertyNames:yw}=Object;var Qf=Object.prototype.hasOwnProperty;function vw(e){return this[e]}var bw,kw,eh=(e,t,n... L2: `:""},this._extScope=e,this._scope=new st.Scope({parent:e}),this._nodes=[new ey]}toString(){return this._root.render(this.opts)}name(e){return this._scope.name(e)}scopeName(e){retu... L3: || (${s} == "string" && ${r} && ${r} == +${r})`).assign(a,V._`+${r}`);return;case"integer":o.elseIf(V._`${s} === "boolean" || ${r} === null L4: || (${s} === "string" && ${r} && ${r} == +${r} && !(${r} % 1))`).assign(a,V._`+${r}`);return;case"boolean":o.elseIf(V._`${r} === "false" || ${r} === 0 || ${r} === null`).assign(a,!... L5: || ${s} === "boolean" || ${r} === null`).assign(a,V._`[${r}]`)}}}function q1({gen:e,pare

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/mcp-server.jsView on unpkg · L1

scripts/bootstrap-agents-md.mjsView file

8* opencode process still see the plugin's directives. Also strips the L9: * old AGENTS.md snippet (v0.38.x backward-compat) and patches L10: * opencode.jsonc `instructions` array. L11: * ... L25: */ L26: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; L27: import { homedir } from "node:os"; ... L34: const TARGET = join(homedir(), ".config", "opencode", "plugins", "omo-meta-governor", "instructions.md"); L35: const OLD_TARGET = join(homedir(), ".config", "opencode", "AGENTS.md"); L36: const OPENCODE_JSONC = join(homedir(), ".config", "opencode", "opencode.jsonc"); L37: const INSTRUCTION_REL = "plugins/omo-meta-governor/instructions.md"; ... L251: const newRaw = JSON.stringify(data, null, 2) + "\n";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/bootstrap-agents-md.mjsView on unpkg · L8

dist/skills/chore.tar.gzView file

•path = dist/skills/chore.tar.gz kind = high_entropy_blob sizeBytes = 132533 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/skills/chore.tar.gzView on unpkg

•path = dist/skills/chore.tar.gz kind = compressed_blob sizeBytes = 132533 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/skills/chore.tar.gzView on unpkg

Lines 149-189javascript

149 ORDER BY priority ASC, updated_at_ms DESC

150 `)}}saveMemory(e){let t=lm("M"),n=(e.concepts[0]??"memory").slice(0,80);return this.stmts.insertEntry.run(t,"memory",n,e.content,"",null,0.5,JSON.stringify(e.concepts),JSON.stringify(e.files??[]),"","",Date.now()),Promise.resolve({id:t})}saveLesson(e){let t=lm("L"),n=e.confidence??0.5,i=(e.content.split(`

151`)[0]??"lesson").slice(0,80);return this.stmts.insertEntry.run(t,"lesson",i,e.content,e.context,null,n,JSON.stringify(e.tags??[]),JSON.stringify([]),"","",Date.now()),Promise.resolve({id:t})}smartSearch(e){let t=e.limit??10,n=this.toFtsQuery(e.query),r=this.stmts.ftsSearch.all(n,t).map((o)=>({id:o.id,title:o.title,content:o.content,type:o.kind,concepts:cm(o.tags),confidence:o.confidence,files:cm(o.files),advice:o.advice??"info"}));return Promise.resolve({lessons:r,crystals:[]})}boulderRead(e){let n=this.stmts.boulderSelect.all(e.directory,e.sessionID).map((i)=>({id:i.id,title:i.title,priority: ...

152 FROM skills s

153 JOIN skills_fts f ON f.rowid = (SELECT rowid FROM skills WHERE id = s.id)

154 ${i}

155 ORDER BY rank

156 LIMIT ?`).all(...n,r);return Promise.resolve(o)}skillGet(e){let t=this.db.prepare(`SELECT s.id, s.name, s.description, s.repo_url, s.installs, s.skill_id, s.download_count, s.last_synced, s.content_hash

157 FROM skills s

158 WHERE s.id = ?`).get(e);return Promise.resolve(t??null)}skillAddOrUpdate(e){let t=Date.now();return this.db.prepare(`

159 INSERT INTO skills (id, name, description, repo_url, installs, skill_id, download_count, last_synced, content_hash)

160 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)

161 ON CONFLICT(id) DO UPDATE SET

162 name = excluded.name,

163 description = excluded.description,

164 repo_url = excluded.repo_url,

165 installs = excluded.installs,

166 skill_id = excluded.skill_id,

167 download_count = excluded.download_count,

168 last_synced = excluded.last_synced,

169 content_hash = excluded.content_hash

170 `).run(e.id,e.name,e.description,e.repo_url,e.installs??0,e.skill_id,e.download_count??0,e.last_synced??t,e.content_hash),Promise.resolve(e.id)}setSkillMaterializedAt(e,t){this.db.prepare("UPDATE skills SET last_materialized_at = ? WHERE id LIKE ? OR id = ?").run(t,`%/${e}`,e)}getSkillMaterializedAt(e){return

171`)}var Et=(e)=>(t,n,i,r)=>{let o=i?Object.assign(i,{async:!1}):{async:!1},s=t._zod.run({value:n,issues:[]},o);if(s instanceof Promise)throw new Le;if(s.issues.length){let a=new(r?.Err??e)(s.issues.map((l)=>Ie(l,o,oe())));throw gn(a,r?.callee),a}return s.value},hn=Et(be),Rt=(e)=>async(t,n,i,r)=>{let o=i?Object.assign(i,{async:!0}):{async:!0},s=t._zod.run({value:n,issues:[]},o);if(s instanceof Promise)s=await s;if(s.issues.length){let a=new(r?.Err??e)(s.issues.map((l)=>Ie(l,o,oe())));throw gn(a,r?.callee),a}return s.value},vn=Rt(be),Ct=(e)=>(t,n,i)=>{let r=i?{...i,async:!1}:{async:!1},o=t._zod.r ...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/lib.jsView on unpkg · L169

172`).filter((o)=>o),i=Math.min(...n.map((o)=>o.length-o.trimStart().length)),r=n.map((o)=>o.slice

173`))}}var $s={major:4,minor:1,patch:8};var E=m("$ZodType",(e,t)=>{var n;e??(e={}),e._zod.def=t,e._zod.bag=e._zod.bag

174 if (${ae}.issues.length) {

175 payload.issues = payload.issues.concat(${ae}.issues.map(iss => ({

176 ...iss,

177 path: iss.path ? [${De}, ...iss.path] : [${De}]

178 })));

179 }

180

181

182 if (${ae}.value === undefined) {

183 if (${De} in input) {

184 newResult[${De}] = undefined;

185 }

186 } else {

187 newResult[${De}] = ${ae}.value;

188 }

189

Long lines were clipped for display.