Loading npm security reports…

@kl-c/matrixos@0.3.42: AI-agent control-surface risk | LPM Firewall

registry / @kl-c/matrixos / 0.3.42

@kl-c/matrixos@0.3.42

MaTrixOS — Agentic OS for OpenCode. Personalizable, communicating, self-improving, resilient.

AI Security Review

scanned 21d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall silently installs package-authored agent commands into the user's global OpenCode command surface and invalidates related cache entries. Those commands direct future agent behavior and can trigger release or shell workflows.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation with lifecycle scripts enabled

Impact

Future OpenCode sessions may load package-authored instructions and perform consequential workflows.

Mechanism

unconsented postinstall mutation of global AI-agent commands

Policy narrative

Installing the package invokes postinstall.mjs. It copies bundled command-instruction Markdown into the user's global OpenCode command directory without an explicit setup command, then clears matching OpenCode cache directories. The injected commands govern later agent actions, including release and shell workflows, creating an unconsented foreign AI-agent control surface.

Rationale

Source inspection confirms the policy-blocking install-time mutation of a broad, user-level OpenCode command surface. No separate encrypted payload execution or exfiltration was confirmed, but it is unnecessary for this verdict.

Evidence

package.jsonpostinstall.mjs.opencode/command/publish.md.agents/command/publish.md.agents/command/adopt.mddist/cli-node/index.js.opencode/command/*.md.agents/command/*.md$XDG_CONFIG_HOME/opencode/command

Source & flagged code

21 flagged

package.jsonView file

Lines 78-118json

78 },

79 "./server": "./dist/index.js",

80 "./tui": "./dist/tui.js",

81 "./features": "./dist/features/matrix-inventory/features.js",

82 "./schema.json": "./dist/matrixos.schema.json"

83 },

84 "scripts": {

85 "build": "bun run script/build.ts",

86 "build:cli-node": "bun run script/build-cli-node.ts",

87 "build:dashboard-frontend": "rm -rf dist/features/dashboard/frontend && mkdir -p dist/features/dashboard/frontend && cp -R packages/omo-opencode/src/features/dashboard/frontend/. dist/features/dashboard/frontend/",

88 "build:shared-skills-assets": "rm -rf dist/skills && cp -R packages/shared-skills/skills dist/skills && mkdir -p dist/cli && rm -rf dist/cli/skills && cp -R packages/shared-skills/skills dist/cli/skills",

89 "build:lsp-tools-mcp": "npm --prefix packages/lsp-tools-mcp ci && npm --prefix packages/lsp-tools-mcp run build",

90 "build:lsp-daemon": "npm --prefix packages/lsp-daemon ci && npm --prefix packages/lsp-daemon run build",

91 "build:node-require-shim": "bun run script/patch-node-require-shim.ts",

92 "build:binaries": "bun run script/build-binaries.ts",

93 "build:features-inventory": "bun build packages/omo-opencode/src/features/matrix-inventory/features.ts --outdir dist/features/matrix-inventory --target bun --format esm --external zod",

94 "build:schema": "bun run script/build-schema.ts",

95 "build:model-capabilities": "bun run script/build-model-capabilities.ts",

96 "clean": "rm -rf dist",

97 "prepare": "bun run build",

98 "postinstall": "node postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L98

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L98

99 "prepublishOnly": "bun run clean && bun run build:lsp-tools-mcp && bun run build:lsp-daemon && bun run build",

100 "test:model-capabilities": "bun test packages/model-core/src/model-capability-aliases.test.ts packages/model-core/src/model-capability-guardrails.test.ts packages/model-core/src/model-capabilities.test.ts packages/omo-opencode/src/cli/doctor/checks/model-resolution.test.ts --bail",

101 "typecheck": "tsgo --noEmit && bun run typecheck:script && bun run typecheck:packages",

102 "typecheck:packages": "tsgo --noEmit -p packages/rules-engine/tsconfig.json && tsgo --noEmit -p packages/delegate-core/tsconfig.json && tsgo --noEmit -p packages/mcp-stdio-core/tsconfig.json && tsgo --noEmit -p packages/mcp-client-core/tsconfig.json && tsgo --noEmit -p packages/git-bash-mcp/tsconfig.json && tsgo --noEmit -p packages/lsp-core/tsconfig.json && tsgo --noEmit -p packages/utils/tsconfig.json && tsgo --noEmit -p packages/model-core/tsconfig.json && tsgo --noEmit -p packages/omo-config-core/tsconfig.json && tsgo --noEmit -p packages/prompts-core/tsconfig.json && tsgo --noEmit -p ...

103 "typecheck:script": "tsgo --noEmit -p script/tsconfig.json",

104 "test": "bun test",

105 "build:git-bash-mcp": "bun run --cwd packages/git-bash-mcp build",

106 "build:slash-commands": "rm -rf dist/cli/slash-commands && mkdir -p dist/cli/slash-commands && cp packages/omo-opencode/src/cli/slash-commands/*.md dist/cli/slash-commands/"

107 },

108 "keywords": [

109 "opencode",

110 "plugin",

111 "agentic-os",

112 "agents",

113 "ai",

114 "llm",

115 "matrixos"

116 ],

117 "author": "KL-Consulting",

118 "license": "SEE LICENSE IN LICENSE.md",

Long lines were clipped for display.

bin/oh-my-opencode.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

2// bin/oh-my-opencode.js

3// Wrapper script that detects platform and spawns the correct binary

5import { spawnSync } from "node:child_process";

6import { existsSync, readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/oh-my-opencode.jsView on unpkg · L4

dist/tui.jsView file

681for (;index < max; index++) { L682: if (!isHexCode(data.charCodeAt(index))) L683: return false; ... L4234: const osProvider = options.osProvider ?? os; L4235: const env = options.env ?? process.env; L4236: const preferredDir = env.XDG_DATA_HOME ?? path.join(osProvider.homedir(), ".local", "share"); L4237: return resolveWritableDirectory(preferredDir, `${appName}-data`, osProvider); ... L4518: // [redacted].ts L4519: import { execFile } from "child_process"; L4520: import { promisify } from "util"; ... L6322: error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config()))) L6323: } : { success: true, data: result.value };

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/tui.jsView on unpkg · L681

681Trigger-reachable chain: manifest.exports -> dist/tui.js L681: for (;index < max; index++) { L682: if (!isHexCode(data.charCodeAt(index))) L683: return false; ... L4234: const osProvider = options.osProvider ?? os; L4235: const env = options.env ?? process.env; L4236: const preferredDir = env.XDG_DATA_HOME ?? path.join(osProvider.homedir(), ".local", "share"); L4237: return resolveWritableDirectory(preferredDir, `${appName}-data`, osProvider); ... L4518: // [redacted].ts L4519: import { execFile } from "child_process"; L4520: import { promisify } from "util"; ... L6322: error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config()))) L6323: } : { success: true, data: result.value };

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/tui.jsView on unpkg · L681

63412this.args = manager.shardArgs ?? []; L63413: this.execArgv = manager.execArgv; L63414: this.env = Object.assign({}, process3.env, {

dist/skills/superpowers-brainstorming/scripts/server.cjsView file

Lines 1-21javascript

1const crypto = require('crypto');

2const http = require('http');

3const fs =

dist/cli-node/index.jsView file

•context = *: Use \`getAISnapshot()\` to discover elements and \`selectSnapshotRef()\` to interact with them\n- **Visual feedback**: Take screenshots to see what the user sees\n\n## Setup\n\n**IMPORTANT**: Before using this skill, ensure the server is running. See [references/installation.md](references/installation.md) for platform-specific setup instructions (macOS, Linux, Windows).\n\nTwo modes available. Ask the user if unclear which to use.\n\n### Standalone Mode (Default)\n\nLaunches a new Chromium browser for fresh automation sessions.\n\n**macOS/Linux:**\n\`\`\`bash\n./skills/dev-browser/server.sh &\n\`\`\`\n\n**Windows (PowerShell):**\n\`\`\`powershell\nStart-Process -NoNewWindow -FilePath "node" -ArgumentList "skills/dev-browser/server.js"\n\`\`\`\n\nAdd \`--headless\` flag if use

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/cli-node/index.jsView on unpkg

•path = dist/cli-node/index.js kind = oversized_source_file sizeBytes = 6551131 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli-node/index.jsView on unpkg

•path = dist/cli-node/index.js kind = oversized_cli_entrypoint sizeBytes = 6551131 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli-node/index.js

postinstall.mjsView file

1Install-time AI-agent control hijack evidence: L3: L4: import { readdirSync, rmSync, cpSync, mkdirSync, existsSync } from "node:fs"; L5: import { createRequire } from "node:module"; ... L19: * so OpenCode discovers them at startup. OpenCode scans L20: * `~/.config/opencode/command/*.md` (user-level) and `.opencode/command/*.md` L21: * (project-level), but NOT package internals under node_modules. Without this ... L28: const commandSources = [ L29: join(__dirname, ".opencode", "command"), L30: join(__dirname, ".agents", "command"), ... L35: if (!existsSync(sourceDir)) continue; L36: mkdirSync(targetDir, { recursive: true }); L37: for (const entry of readdirSync(sourceDir, { withFileTypes: true })) { Payload evidence from dist/features/builtin-skills/skills/playwright-mcp-skill.d.ts: L1: ex

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

postinstall.mjsView on unpkg · L1

dist/cli/skills/ast-grep/install.shView file

•path = dist/cli/skills/ast-grep/install.sh kind = build_helper sizeBytes = 7581 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/cli/skills/ast-grep/install.shView on unpkg

dist/cli/skills/ast-grep/tests/smoke.ps1View file

•path = dist/cli/skills/ast-grep/tests/smoke.ps1 kind = payload_in_excluded_dir sizeBytes = 5701 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/cli/skills/ast-grep/tests/smoke.ps1View on unpkg

bin/matrixos.jsView file

•matchType = normalized_sha256 matchedPackage = @kl-c/matrixos@0.1.26 matchedPath = bin/matrixos.js matchedIdentity = npm:QGtsLWMvbWF0cml4b3M:0.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/matrixos.jsView on unpkg

dist/cli/skills/superpowers-brainstorming/scripts/server.cjsView file

•matchType = normalized_sha256 matchedPackage = @kl-c/matrixos@0.1.26 matchedPath = dist/cli/skills/superpowers-brainstorming/scripts/server.cjs matchedIdentity = npm:QGtsLWMvbWF0cml4b3M:0.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/skills/superpowers-brainstorming/scripts/server.cjsView on unpkg

packages/lsp-daemon/dist/cli.jsView file

•matchType = normalized_sha256 matchedPackage = @kl-c/matrixos@0.1.26 matchedPath = packages/lsp-daemon/dist/cli.js matchedIdentity = npm:QGtsLWMvbWF0cml4b3M:0.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/lsp-daemon/dist/cli.jsView on unpkg

packages/lsp-daemon/dist/client.jsView file

•matchType = normalized_sha256 matchedPackage = @kl-c/matrixos@0.1.26 matchedPath = packages/lsp-daemon/dist/client.js matchedIdentity = npm:QGtsLWMvbWF0cml4b3M:0.1.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/lsp-daemon/dist/client.jsView on unpkg

Source & flagged code

21 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/oh-my-opencode.jsView file

4L5: import { spawnSync } from "node:child_process"; L6: import { existsSync, readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/oh-my-opencode.jsView on unpkg · L4

16L17: const require = createRequire(import.meta.url); L18:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/oh-my-opencode.jsView on unpkg · L16

dist/tui.jsView file

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/tui.jsView on unpkg · L681

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/tui.jsView on unpkg · L681

63412this.args = manager.shardArgs ?? []; L63413: this.execArgv = manager.execArgv; L63414: this.env = Object.assign({}, process3.env, {

dist/skills/superpowers-brainstorming/scripts/server.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/skills/superpowers-brainstorming/scripts/server.cjsView on unpkg

1const crypto = require('crypto'); L2: const http = require('http'); L3: const fs = require('fs'); ... L12: function computeAcceptKey(clientKey) { L13: return crypto.createHash('sha1').update(clientKey + WS_MAGIC).digest('base64'); L14: } ... L84: L85: const PORT_FILE = process.env.BRAINSTORM_PORT_FILE || null; L86: const randomPort = () => 49152 + Math.floor(Math.random() * 16383); ... L195: try { sessionStorage.setItem('brainstorm-session-key', ${jsonKey}); } catch (e) {} L196: location.replace('/'); L197: </script>

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/skills/superpowers-brainstorming/scripts/server.cjsView on unpkg · L1

dist/cli-node/index.jsView file

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/cli-node/index.jsView on unpkg

•path = dist/cli-node/index.js kind = oversized_source_file sizeBytes = 6551131 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli-node/index.jsView on unpkg

•path = dist/cli-node/index.js kind = oversized_cli_entrypoint sizeBytes = 6551131 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli-node/index.js

postinstall.mjsView file

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

postinstall.mjsView on unpkg · L1

dist/cli/skills/ast-grep/install.shView file

•path = dist/cli/skills/ast-grep/install.sh kind = build_helper sizeBytes = 7581 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/cli/skills/ast-grep/install.shView on unpkg

dist/cli/skills/ast-grep/tests/smoke.ps1View file

•path = dist/cli/skills/ast-grep/tests/smoke.ps1 kind = payload_in_excluded_dir sizeBytes = 5701 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/cli/skills/ast-grep/tests/smoke.ps1View on unpkg

bin/matrixos.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/matrixos.jsView on unpkg

dist/cli/skills/superpowers-brainstorming/scripts/server.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/skills/superpowers-brainstorming/scripts/server.cjsView on unpkg

packages/lsp-daemon/dist/cli.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/lsp-daemon/dist/cli.jsView on unpkg

packages/lsp-daemon/dist/client.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/lsp-daemon/dist/client.jsView on unpkg

Source & flagged code

21 flagged

package.jsonView file

Lines 78-118json

78 },

79 "./server": "./dist/index.js",

80 "./tui": "./dist/tui.js",

81 "./features": "./dist/features/matrix-inventory/features.js",

82 "./schema.json": "./dist/matrixos.schema.json"

83 },

84 "scripts": {

85 "build": "bun run script/build.ts",

86 "build:cli-node": "bun run script/build-cli-node.ts",

89 "build:lsp-tools-mcp": "npm --prefix packages/lsp-tools-mcp ci && npm --prefix packages/lsp-tools-mcp run build",

90 "build:lsp-daemon": "npm --prefix packages/lsp-daemon ci && npm --prefix packages/lsp-daemon run build",

91 "build:node-require-shim": "bun run script/patch-node-require-shim.ts",

92 "build:binaries": "bun run script/build-binaries.ts",

93 "build:features-inventory": "bun build packages/omo-opencode/src/features/matrix-inventory/features.ts --outdir dist/features/matrix-inventory --target bun --format esm --external zod",

94 "build:schema": "bun run script/build-schema.ts",

95 "build:model-capabilities": "bun run script/build-model-capabilities.ts",

96 "clean": "rm -rf dist",

97 "prepare": "bun run build",

98 "postinstall": "node postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L98

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L98

99 "prepublishOnly": "bun run clean && bun run build:lsp-tools-mcp && bun run build:lsp-daemon && bun run build",

101 "typecheck": "tsgo --noEmit && bun run typecheck:script && bun run typecheck:packages",

103 "typecheck:script": "tsgo --noEmit -p script/tsconfig.json",

104 "test": "bun test",

105 "build:git-bash-mcp": "bun run --cwd packages/git-bash-mcp build",

106 "build:slash-commands": "rm -rf dist/cli/slash-commands && mkdir -p dist/cli/slash-commands && cp packages/omo-opencode/src/cli/slash-commands/*.md dist/cli/slash-commands/"

107 },

108 "keywords": [

109 "opencode",

110 "plugin",

111 "agentic-os",

112 "agents",

113 "ai",

114 "llm",

115 "matrixos"

116 ],

117 "author": "KL-Consulting",

118 "license": "SEE LICENSE IN LICENSE.md",

Long lines were clipped for display.

bin/oh-my-opencode.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

2// bin/oh-my-opencode.js

3// Wrapper script that detects platform and spawns the correct binary

5import { spawnSync } from "node:child_process";

6import { existsSync, readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/oh-my-opencode.jsView on unpkg · L4

dist/tui.jsView file

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/tui.jsView on unpkg · L681

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/tui.jsView on unpkg · L681

63412this.args = manager.shardArgs ?? []; L63413: this.execArgv = manager.execArgv; L63414: this.env = Object.assign({}, process3.env, {

dist/skills/superpowers-brainstorming/scripts/server.cjsView file

Lines 1-21javascript

1const crypto = require('crypto');

2const http = require('http');

3const fs =

dist/cli-node/index.jsView file

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/cli-node/index.jsView on unpkg

•path = dist/cli-node/index.js kind = oversized_source_file sizeBytes = 6551131 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli-node/index.jsView on unpkg

•path = dist/cli-node/index.js kind = oversized_cli_entrypoint sizeBytes = 6551131 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli-node/index.js

postinstall.mjsView file

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

postinstall.mjsView on unpkg · L1

dist/cli/skills/ast-grep/install.shView file

•path = dist/cli/skills/ast-grep/install.sh kind = build_helper sizeBytes = 7581 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/cli/skills/ast-grep/install.shView on unpkg

dist/cli/skills/ast-grep/tests/smoke.ps1View file

•path = dist/cli/skills/ast-grep/tests/smoke.ps1 kind = payload_in_excluded_dir sizeBytes = 5701 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/cli/skills/ast-grep/tests/smoke.ps1View on unpkg

bin/matrixos.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/matrixos.jsView on unpkg

dist/cli/skills/superpowers-brainstorming/scripts/server.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/skills/superpowers-brainstorming/scripts/server.cjsView on unpkg

packages/lsp-daemon/dist/cli.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/lsp-daemon/dist/cli.jsView on unpkg

packages/lsp-daemon/dist/client.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/lsp-daemon/dist/client.jsView on unpkg

@kl-c/matrixos@0.3.42

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code