@kl-c/matrixos@0.1.2: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@kl-c/matrixos@0.1.2: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/oh-my-opencode.jsView file

16L17: const require = createRequire(import.meta.url); L18:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/oh-my-opencode.jsView on unpkg · L16

bin/matrixos.jsView file

4Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, execution+network L4: L5: import { spawnSync } from "node:child_process"; L6: import { existsSync, readFileSync } from "node:fs"; ... L23: function getLibcFamily() { L24: if (process.platform !== "linux") { L25: return undefined; // Not needed on non-Linux ... L41: L42: if (process.env.OH_MY_OPENCODE_FORCE_BASELINE === "1") { L43: return false; ... L63: L64: return probe.stdout.toUpperCase().includes("AVX2"); L65: }

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/matrixos.jsView on unpkg · L4

•matchType = previous_version_dangerous_delta matchedPackage = @kl-c/matrixos@0.1.0 matchedIdentity = npm:QGtsLWMvbWF0cml4b3M:0.1.0 similarity = 0.992 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/matrixos.jsView on unpkg

dist/cli/skills/ast-grep/install.shView file

•path = dist/cli/skills/ast-grep/install.sh kind = build_helper sizeBytes = 7581 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/cli/skills/ast-grep/install.shView on unpkg

dist/cli/skills/ast-grep/tests/smoke.ps1View file

•path = dist/cli/skills/ast-grep/tests/smoke.ps1 kind = payload_in_excluded_dir sizeBytes = 5701 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/cli/skills/ast-grep/tests/smoke.ps1View on unpkg

dist/cli-node/index.jsView file

•path = dist/cli-node/index.js kind = oversized_source_file sizeBytes = 4651895 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli-node/index.jsView on unpkg

•path = dist/cli-node/index.js kind = oversized_cli_entrypoint sizeBytes = 4651895 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli-node/index.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 72-112json

72 ".": {

73 "types": "./dist/index.d.ts",

74 "import": "./dist/index.js"

75 },

76 "./server": "./dist/index.js",

77 "./tui": "./dist/tui.js",

78 "./schema.json": "./dist/matrixos.schema.json"

79 },

80 "scripts": {

81 "build": "bun run script/build.ts",

82 "build:cli-node": "bun run script/build-cli-node.ts",

83 "build:shared-skills-assets": "rm -rf dist/skills && cp -R packages/shared-skills/skills dist/skills && mkdir -p dist/cli && rm -rf dist/cli/skills && cp -R packages/shared-skills/skills dist/cli/skills",

84 "build:lsp-tools-mcp": "npm --prefix packages/lsp-tools-mcp ci && npm --prefix packages/lsp-tools-mcp run build",

85 "build:lsp-daemon": "npm --prefix packages/lsp-daemon ci && npm --prefix packages/lsp-daemon run build",

86 "build:node-require-shim": "bun run script/patch-node-require-shim.ts",

87 "build:binaries": "bun run script/build-binaries.ts",

88 "build:schema": "bun run script/build-schema.ts",

89 "build:model-capabilities": "bun run script/build-model-capabilities.ts",

90 "clean": "rm -rf dist",

91 "prepare": "bun run build",

92 "postinstall": "node postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L92

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L92

93 "prepublishOnly": "bun run clean && bun run build:lsp-tools-mcp && bun run build:lsp-daemon && bun run build",

94 "test:model-capabilities": "bun test packages/model-core/src/model-capability-aliases.test.ts packages/model-core/src/model-capability-guardrails.test.ts packages/model-core/src/model-capabilities.test.ts packages/omo-opencode/src/cli/doctor/checks/model-resolution.test.ts --bail",

95 "typecheck": "tsgo --noEmit && bun run typecheck:script && bun run typecheck:packages",

96 "typecheck:packages": "tsgo --noEmit -p packages/rules-engine/tsconfig.json && tsgo --noEmit -p packages/delegate-core/tsconfig.json && tsgo --noEmit -p packages/mcp-stdio-core/tsconfig.json && tsgo --noEmit -p packages/mcp-client-core/tsconfig.json && tsgo --noEmit -p packages/git-bash-mcp/tsconfig.json && tsgo --noEmit -p packages/lsp-core/tsconfig.json && tsgo --noEmit -p packages/utils/tsconfig.json && tsgo --noEmit -p packages/model-core/tsconfig.json && tsgo --noEmit -p packages/omo-config-core/tsconfig.json && tsgo --noEmit -p packages/prompts-core/tsconfig.json && tsgo --noEmit -p ...

97 "typecheck:script": "tsgo --noEmit -p script/tsconfig.json",

98 "test": "bun test",

99 "build:git-bash-mcp": "bun run --cwd packages/git-bash-mcp build"

100 },

101 "keywords": [

102 "opencode",

103 "plugin",

104 "agentic-os",

105 "agents",

106 "ai",

107 "llm",

108 "matrixos"

109 ],

110 "author": "KL-Consulting",

111 "license": "SEE LICENSE IN LICENSE.md",

112 "repository": {

Long lines were clipped for display.

bin/oh-my-opencode.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

2// bin/oh-my-opencode.js

3// Wrapper script that detects platform and spawns the correct binary

4

5import { spawnSync } from "node:child_process";

6import { existsSync, readFileSync } from "node:fs";

7import { createRequire } from

bin/matrixos.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2// bin/oh-my-opencode.js

3// Wrapper script that detects platform and spawns the correct binary

4

5import { spawnSync } from "node:child_process";

6import { existsSync, readFileSync } from "node:fs";

7import { createRequire } from

dist/cli/skills/ast-grep/install.shView file

•path = dist/cli/skills/ast-grep/install.sh kind = build_helper sizeBytes = 7581 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/cli/skills/ast-grep/install.shView on unpkg

dist/cli/skills/ast-grep/tests/smoke.ps1View file

•path = dist/cli/skills/ast-grep/tests/smoke.ps1 kind = payload_in_excluded_dir sizeBytes = 5701 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/cli/skills/ast-grep/tests/smoke.ps1View on unpkg

dist/cli-node/index.jsView file

•path = dist/cli-node/index.js kind = oversized_source_file sizeBytes = 4651895 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli-node/index.jsView on unpkg

•path = dist/cli-node/index.js kind = oversized_cli_entrypoint sizeBytes = 4651895 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli-node/index.jsView on unpkg