Loading npm security reports…

@kl-c/matrixos@0.1.24: AI-agent policy block | LPM Firewall

registry / @kl-c/matrixos / 0.1.24

@kl-c/matrixos@0.1.24

MaTrixOS — Agentic OS for OpenCode. Personalizable, communicating, self-improving, resilient.

AI Security Review

scanned 12h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. Install-time code mutates the user-wide OpenCode command control surface without consent. It installs package-supplied agent instructions that direct later agent file and shell activity.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation invokes postinstall.

Impact

Future OpenCode command use can execute package-authored agent instructions outside the installed project.

Mechanism

Copies AI-agent command payloads into the global OpenCode command directory.

Policy narrative

On installation, postinstall.mjs copies all bundled Markdown commands into the user's global OpenCode command directory and deletes matching OpenCode package-cache directories. These commands become trusted AI-agent control inputs for future sessions; for example, adopt.md directs creation and editing of files under /root/MOS_Vault, while get-unpublished-changes.md contains shell substitutions invoking npm and git. This is an unconsented install-time mutation of a broad foreign AI-agent control surface.

Rationale

The postinstall hook establishes persistent, package-authored commands in a user-wide agent configuration location. This meets the blocking policy for unconsented install-time AI-agent control-surface mutation.

Evidence

package.jsonpostinstall.mjs.opencode/command/adopt.md.opencode/command/get-unpublished-changes.md.opencode/command/*.md.agents/command/*.md$XDG_CONFIG_HOME/opencode/command/*.md

Source & flagged code

20 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/oh-my-opencode.jsView file

4L5: import { spawnSync } from "node:child_process"; L6: import { existsSync, readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/oh-my-opencode.jsView on unpkg · L4

16L17: const require = createRequire(import.meta.url); L18:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/oh-my-opencode.jsView on unpkg · L16

dist/tui.jsView file

681for (;index < max; index++) { L682: if (!isHexCode(data.charCodeAt(index))) L683: return false; ... L4234: const osProvider = options.osProvider ?? os; L4235: const env = options.env ?? process.env; L4236: const preferredDir = env.XDG_DATA_HOME ?? path.join(osProvider.homedir(), ".local", "share"); L4237: return resolveWritableDirectory(preferredDir, `${appName}-data`, osProvider); ... L4518: // [redacted].ts L4519: import { execFile } from "child_process"; L4520: import { promisify } from "util"; ... L6322: error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config()))) L6323: } : { success: true, data: result.value };

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/tui.jsView on unpkg · L681

681Trigger-reachable chain: manifest.exports -> dist/tui.js L681: for (;index < max; index++) { L682: if (!isHexCode(data.charCodeAt(index))) L683: return false; ... L4234: const osProvider = options.osProvider ?? os; L4235: const env = options.env ?? process.env; L4236: const preferredDir = env.XDG_DATA_HOME ?? path.join(osProvider.homedir(), ".local", "share"); L4237: return resolveWritableDirectory(preferredDir, `${appName}-data`, osProvider); ... L4518: // [redacted].ts L4519: import { execFile } from "child_process"; L4520: import { promisify } from "util"; ... L6322: error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config()))) L6323: } : { success: true, data: result.value };

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/tui.jsView on unpkg · L681

63398this.args = manager.shardArgs ?? []; L63399: this.execArgv = manager.execArgv; L63400: this.env = Object.assign({}, process3.env, {

dist/cli/skills/superpowers-brainstorming/scripts/server.cjsView file

•matchType = normalized_sha256 matchedPackage = @kl-c/matrixos@0.1.21 matchedPath = dist/cli/skills/superpowers-brainstorming/scripts/server.cjs matchedIdentity = npm:QGtsLWMvbWF0cml4b3M:0.1.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/skills/superpowers-brainstorming/scripts/server.cjsView on unpkg

1const crypto = require('crypto'); L2: const http = require('http'); L3: const fs = require('fs'); ... L12: function computeAcceptKey(clientKey) { L13: return crypto.createHash('sha1').update(clientKey + WS_MAGIC).digest('base64'); L14: } ... L84: L85: const PORT_FILE = process.env.BRAINSTORM_PORT_FILE || null; L86: const randomPort = () => 49152 + Math.floor(Math.random() * 16383); ... L195: try { sessionStorage.setItem('brainstorm-session-key', ${jsonKey}); } catch (e) {} L196: location.replace('/'); L197: </script>

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/skills/superpowers-brainstorming/scripts/server.cjsView on unpkg · L1

postinstall.mjsView file

1Install-time AI-agent control hijack evidence: L3: L4: import { readdirSync, rmSync, cpSync, mkdirSync, existsSync } from "node:fs"; L5: import { createRequire } from "node:module"; ... L19: * so OpenCode discovers them at startup. OpenCode scans L20: * `~/.config/opencode/command/*.md` (user-level) and `.opencode/command/*.md` L21: * (project-level), but NOT package internals under node_modules. Without this ... L28: const commandSources = [ L29: join(__dirname, ".opencode", "command"), L30: join(__dirname, ".agents", "command"), ... L35: if (!existsSync(sourceDir)) continue; L36: mkdirSync(targetDir, { recursive: true }); L37: for (const entry of readdirSync(sourceDir, { withFileTypes: true })) { Payload evidence from dist/features/builtin-skills/skills/playwright-mcp-skill.d.ts: L1: ex

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

postinstall.mjsView on unpkg · L1

dist/cli/skills/ast-grep/install.shView file

•path = dist/cli/skills/ast-grep/install.sh kind = build_helper sizeBytes = 7581 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/cli/skills/ast-grep/install.shView on unpkg

dist/cli/skills/ast-grep/tests/smoke.ps1View file

•path = dist/cli/skills/ast-grep/tests/smoke.ps1 kind = payload_in_excluded_dir sizeBytes = 5701 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/cli/skills/ast-grep/tests/smoke.ps1View on unpkg

dist/cli-node/index.jsView file

•path = dist/cli-node/index.js kind = oversized_source_file sizeBytes = 4678084 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli-node/index.jsView on unpkg

•path = dist/cli-node/index.js kind = oversized_cli_entrypoint sizeBytes = 4678084 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli-node/index.jsView on unpkg

bin/matrixos.jsView file

•matchType = normalized_sha256 matchedPackage = @kl-c/matrixos@0.1.21 matchedPath = bin/matrixos.js matchedIdentity = npm:QGtsLWMvbWF0cml4b3M:0.1.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/matrixos.jsView on unpkg

dist/skills/superpowers-brainstorming/scripts/server.cjsView file

•matchType = normalized_sha256 matchedPackage = @kl-c/matrixos@0.1.21 matchedPath = dist/cli/skills/superpowers-brainstorming/scripts/server.cjs matchedIdentity = npm:QGtsLWMvbWF0cml4b3M:0.1.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/skills/superpowers-brainstorming/scripts/server.cjsView on unpkg

packages/lsp-daemon/dist/cli.jsView file

•matchType = normalized_sha256 matchedPackage = @kl-c/matrixos@0.1.21 matchedPath = packages/lsp-daemon/dist/cli.js matchedIdentity = npm:QGtsLWMvbWF0cml4b3M:0.1.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/lsp-daemon/dist/cli.jsView on unpkg

packages/lsp-daemon/dist/client.jsView file

•matchType = normalized_sha256 matchedPackage = @kl-c/matrixos@0.1.21 matchedPath = packages/lsp-daemon/dist/client.js matchedIdentity = npm:QGtsLWMvbWF0cml4b3M:0.1.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/lsp-daemon/dist/client.jsView on unpkg