Loading npm security reports…

@kl-c/matrixos@0.3.43: AI-agent control-surface risk | LPM Firewall

registry / @kl-c/matrixos / 0.3.43

@kl-c/matrixos@0.3.43

MaTrixOS — Agentic OS for OpenCode. Personalizable, communicating, self-improving, resilient.

AI Security Review

scanned 21d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall unconditionally installs package-supplied agent commands into OpenCode's user-level autoloaded command directory and overwrites same-named commands. Those commands can direct an AI agent to modify user files when invoked.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation of @kl-c/matrixos@0.3.43

Impact

Persistent package-controlled instructions become available to OpenCode at user scope without an explicit setup command.

Mechanism

install-time overwrite of a foreign AI-agent command surface

Policy narrative

On installation, postinstall.mjs copies all packaged Markdown command files from .opencode/command and .agents/command into ~/.config/opencode/command with force:true. OpenCode discovers that user-level directory at startup, so installation creates and overwrites an AI-agent control surface outside the package. The installed adopt command instructs the agent to create or edit /root/MOS_Vault files.

Rationale

The package performs unconsented postinstall mutation of a broad, user-level OpenCode command surface. This concrete lifecycle control-surface write meets the blocking policy even though the scanner's payload and exfiltration claims were not confirmed.

Evidence

package.jsonpostinstall.mjs.opencode/command/adopt.md.agents/command/adopt.md.opencode/command/*.md.agents/command/*.md~/.config/opencode/command/*.md~/.cache/opencode

Source & flagged code

21 flagged

package.jsonView file

Lines 78-118json

78 },

79 "./server": "./dist/index.js",

80 "./tui": "./dist/tui.js",

81 "./features": "./dist/features/matrix-inventory/features.js",

82 "./schema.json": "./dist/matrixos.schema.json"

83 },

84 "scripts": {

85 "build": "bun run script/build.ts",

86 "build:cli-node": "bun run script/build-cli-node.ts",

87 "build:dashboard-frontend": "rm -rf dist/features/dashboard/frontend && mkdir -p dist/features/dashboard/frontend && cp -R packages/omo-opencode/src/features/dashboard/frontend/. dist/features/dashboard/frontend/",

88 "build:shared-skills-assets": "rm -rf dist/skills && cp -R packages/shared-skills/skills dist/skills && mkdir -p dist/cli && rm -rf dist/cli/skills && cp -R packages/shared-skills/skills dist/cli/skills",

89 "build:lsp-tools-mcp": "npm --prefix packages/lsp-tools-mcp ci && npm --prefix packages/lsp-tools-mcp run build",

90 "build:lsp-daemon": "npm --prefix packages/lsp-daemon ci && npm --prefix packages/lsp-daemon run build",

91 "build:node-require-shim": "bun run script/patch-node-require-shim.ts",

92 "build:binaries": "bun run script/build-binaries.ts",

93 "build:features-inventory": "bun build packages/omo-opencode/src/features/matrix-inventory/features.ts --outdir dist/features/matrix-inventory --target bun --format esm --external zod",

94 "build:schema": "bun run script/build-schema.ts",

95 "build:model-capabilities": "bun run script/build-model-capabilities.ts",

96 "clean": "rm -rf dist",

97 "prepare": "bun run build",

98 "postinstall": "node postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L98

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L98

99 "prepublishOnly": "bun run clean && bun run build:lsp-tools-mcp && bun run build:lsp-daemon && bun run build",

100 "test:model-capabilities": "bun test packages/model-core/src/model-capability-aliases.test.ts packages/model-core/src/model-capability-guardrails.test.ts packages/model-core/src/model-capabilities.test.ts packages/omo-opencode/src/cli/doctor/checks/model-resolution.test.ts --bail",

101 "typecheck": "tsgo --noEmit && bun run typecheck:script && bun run typecheck:packages",

102 "typecheck:packages": "tsgo --noEmit -p packages/rules-engine/tsconfig.json && tsgo --noEmit -p packages/delegate-core/tsconfig.json && tsgo --noEmit -p packages/mcp-stdio-core/tsconfig.json && tsgo --noEmit -p packages/mcp-client-core/tsconfig.json && tsgo --noEmit -p packages/git-bash-mcp/tsconfig.json && tsgo --noEmit -p packages/lsp-core/tsconfig.json && tsgo --noEmit -p packages/utils/tsconfig.json && tsgo --noEmit -p packages/model-core/tsconfig.json && tsgo --noEmit -p packages/omo-config-core/tsconfig.json && tsgo --noEmit -p packages/prompts-core/tsconfig.json && tsgo --noEmit -p ...

103 "typecheck:script": "tsgo --noEmit -p script/tsconfig.json",

104 "test": "bun test",

105 "build:git-bash-mcp": "bun run --cwd packages/git-bash-mcp build",

106 "build:slash-commands": "rm -rf dist/cli/slash-commands && mkdir -p dist/cli/slash-commands && cp packages/omo-opencode/src/cli/slash-commands/*.md dist/cli/slash-commands/"

107 },

108 "keywords": [

109 "opencode",

110 "plugin",

111 "agentic-os",

112 "agents",

113 "ai",

114 "llm",

115 "matrixos"

116 ],

117 "author": "KL-Consulting",

118 "license": "SEE LICENSE IN LICENSE.md",

Long lines were clipped for display.

bin/oh-my-opencode.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

2// bin/oh-my-opencode.js

3// Wrapper script that detects platform and spawns the correct binary

5import { spawnSync } from "node:child_process";

6import { existsSync, readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/oh-my-opencode.jsView on unpkg · L4

dist/tui.jsView file

681for (;index < max; index++) { L682: if (!isHexCode(data.charCodeAt(index))) L683: return false; ... L4234: const osProvider = options.osProvider ?? os; L4235: const env = options.env ?? process.env; L4236: const preferredDir = env.XDG_DATA_HOME ?? path.join(osProvider.homedir(), ".local", "share"); L4237: return resolveWritableDirectory(preferredDir, `${appName}-data`, osProvider); ... L4518: // [redacted].ts L4519: import { execFile } from "child_process"; L4520: import { promisify } from "util"; ... L6322: error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config()))) L6323: } : { success: true, data: result.value };

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/tui.jsView on unpkg · L681

681Trigger-reachable chain: manifest.exports -> dist/tui.js L681: for (;index < max; index++) { L682: if (!isHexCode(data.charCodeAt(index))) L683: return false; ... L4234: const osProvider = options.osProvider ?? os; L4235: const env = options.env ?? process.env; L4236: const preferredDir = env.XDG_DATA_HOME ?? path.join(osProvider.homedir(), ".local", "share"); L4237: return resolveWritableDirectory(preferredDir, `${appName}-data`, osProvider); ... L4518: // [redacted].ts L4519: import { execFile } from "child_process"; L4520: import { promisify } from "util"; ... L6322: error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config()))) L6323: } : { success: true, data: result.value };

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/tui.jsView on unpkg · L681

63412this.args = manager.shardArgs ?? []; L63413: this.execArgv = manager.execArgv; L63414: this.env = Object.assign({}, process3.env, {

dist/skills/superpowers-brainstorming/scripts/server.cjsView file

Lines 1-21javascript

1const crypto = require('crypto');

2const http = require('http');

3const fs =

dist/cli-node/index.jsView file

•context = *: Use \`getAISnapshot()\` to discover elements and \`selectSnapshotRef()\` to interact with them\n- **Visual feedback**: Take screenshots to see what the user sees\n\n## Setup\n\n**IMPORTANT**: Before using this skill, ensure the server is running. See [references/installation.md](references/installation.md) for platform-specific setup instructions (macOS, Linux, Windows).\n\nTwo modes available. Ask the user if unclear which to use.\n\n### Standalone Mode (Default)\n\nLaunches a new Chromium browser for fresh automation sessions.\n\n**macOS/Linux:**\n\`\`\`bash\n./skills/dev-browser/server.sh &\n\`\`\`\n\n**Windows (PowerShell):**\n\`\`\`powershell\nStart-Process -NoNewWindow -FilePath "node" -ArgumentList "skills/dev-browser/server.js"\n\`\`\`\n\nAdd \`--headless\` flag if use

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/cli-node/index.jsView on unpkg

•path = dist/cli-node/index.js kind = oversized_source_file sizeBytes = 6551162 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli-node/index.jsView on unpkg

•path = dist/cli-node/index.js kind = oversized_cli_entrypoint sizeBytes = 6551162 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli-node/index.js

postinstall.mjsView file

1Install-time AI-agent control hijack evidence: L3: L4: import { readdirSync, rmSync, cpSync, mkdirSync, existsSync } from "node:fs"; L5: import { createRequire } from "node:module"; ... L19: * so OpenCode discovers them at startup. OpenCode scans L20: * `~/.config/opencode/command/*.md` (user-level) and `.opencode/command/*.md` L21: * (project-level), but NOT package internals under node_modules. Without this ... L28: const commandSources = [ L29: join(__dirname, ".opencode", "command"), L30: join(__dirname, ".agents", "command"), ... L35: if (!existsSync(sourceDir)) continue; L36: mkdirSync(targetDir, { recursive: true }); L37: for (const entry of readdirSync(sourceDir, { withFileTypes: true })) { Payload evidence from dist/features/builtin-skills/skills/playwright-mcp-skill.d.ts: L1: ex

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

postinstall.mjsView on unpkg · L1

dist/cli/skills/ast-grep/install.shView file

•path = dist/cli/skills/ast-grep/install.sh kind = build_helper sizeBytes = 7581 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/cli/skills/ast-grep/install.shView on unpkg

dist/cli/skills/ast-grep/tests/smoke.ps1View file

•path = dist/cli/skills/ast-grep/tests/smoke.ps1 kind = payload_in_excluded_dir sizeBytes = 5701 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/cli/skills/ast-grep/tests/smoke.ps1View on unpkg

bin/matrixos.jsView file

•matchType = normalized_sha256 matchedPackage = @kl-c/matrixos@0.3.42 matchedPath = bin/matrixos.js matchedIdentity = npm:QGtsLWMvbWF0cml4b3M:0.3.42 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/matrixos.jsView on unpkg

dist/cli/skills/superpowers-brainstorming/scripts/server.cjsView file

•matchType = normalized_sha256 matchedPackage = @kl-c/matrixos@0.3.42 matchedPath = dist/cli/skills/superpowers-brainstorming/scripts/server.cjs matchedIdentity = npm:QGtsLWMvbWF0cml4b3M:0.3.42 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/skills/superpowers-brainstorming/scripts/server.cjsView on unpkg

packages/lsp-daemon/dist/cli.jsView file

•matchType = normalized_sha256 matchedPackage = @kl-c/matrixos@0.3.42 matchedPath = packages/lsp-daemon/dist/cli.js matchedIdentity = npm:QGtsLWMvbWF0cml4b3M:0.3.42 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/lsp-daemon/dist/cli.jsView on unpkg

packages/lsp-daemon/dist/client.jsView file

•matchType = normalized_sha256 matchedPackage = @kl-c/matrixos@0.3.42 matchedPath = packages/lsp-daemon/dist/client.js matchedIdentity = npm:QGtsLWMvbWF0cml4b3M:0.3.42 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/lsp-daemon/dist/client.jsView on unpkg

Source & flagged code

21 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/oh-my-opencode.jsView file

4L5: import { spawnSync } from "node:child_process"; L6: import { existsSync, readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/oh-my-opencode.jsView on unpkg · L4

16L17: const require = createRequire(import.meta.url); L18:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/oh-my-opencode.jsView on unpkg · L16

dist/tui.jsView file

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/tui.jsView on unpkg · L681

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/tui.jsView on unpkg · L681

63412this.args = manager.shardArgs ?? []; L63413: this.execArgv = manager.execArgv; L63414: this.env = Object.assign({}, process3.env, {

dist/skills/superpowers-brainstorming/scripts/server.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/skills/superpowers-brainstorming/scripts/server.cjsView on unpkg

1const crypto = require('crypto'); L2: const http = require('http'); L3: const fs = require('fs'); ... L12: function computeAcceptKey(clientKey) { L13: return crypto.createHash('sha1').update(clientKey + WS_MAGIC).digest('base64'); L14: } ... L84: L85: const PORT_FILE = process.env.BRAINSTORM_PORT_FILE || null; L86: const randomPort = () => 49152 + Math.floor(Math.random() * 16383); ... L195: try { sessionStorage.setItem('brainstorm-session-key', ${jsonKey}); } catch (e) {} L196: location.replace('/'); L197: </script>

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/skills/superpowers-brainstorming/scripts/server.cjsView on unpkg · L1

dist/cli-node/index.jsView file

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/cli-node/index.jsView on unpkg

•path = dist/cli-node/index.js kind = oversized_source_file sizeBytes = 6551162 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli-node/index.jsView on unpkg

•path = dist/cli-node/index.js kind = oversized_cli_entrypoint sizeBytes = 6551162 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli-node/index.js

postinstall.mjsView file

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

postinstall.mjsView on unpkg · L1

dist/cli/skills/ast-grep/install.shView file

•path = dist/cli/skills/ast-grep/install.sh kind = build_helper sizeBytes = 7581 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/cli/skills/ast-grep/install.shView on unpkg

dist/cli/skills/ast-grep/tests/smoke.ps1View file

•path = dist/cli/skills/ast-grep/tests/smoke.ps1 kind = payload_in_excluded_dir sizeBytes = 5701 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/cli/skills/ast-grep/tests/smoke.ps1View on unpkg

bin/matrixos.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/matrixos.jsView on unpkg

dist/cli/skills/superpowers-brainstorming/scripts/server.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/skills/superpowers-brainstorming/scripts/server.cjsView on unpkg

packages/lsp-daemon/dist/cli.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/lsp-daemon/dist/cli.jsView on unpkg

packages/lsp-daemon/dist/client.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/lsp-daemon/dist/client.jsView on unpkg

Source & flagged code

21 flagged

package.jsonView file

Lines 78-118json

78 },

79 "./server": "./dist/index.js",

80 "./tui": "./dist/tui.js",

81 "./features": "./dist/features/matrix-inventory/features.js",

82 "./schema.json": "./dist/matrixos.schema.json"

83 },

84 "scripts": {

85 "build": "bun run script/build.ts",

86 "build:cli-node": "bun run script/build-cli-node.ts",

89 "build:lsp-tools-mcp": "npm --prefix packages/lsp-tools-mcp ci && npm --prefix packages/lsp-tools-mcp run build",

90 "build:lsp-daemon": "npm --prefix packages/lsp-daemon ci && npm --prefix packages/lsp-daemon run build",

91 "build:node-require-shim": "bun run script/patch-node-require-shim.ts",

92 "build:binaries": "bun run script/build-binaries.ts",

93 "build:features-inventory": "bun build packages/omo-opencode/src/features/matrix-inventory/features.ts --outdir dist/features/matrix-inventory --target bun --format esm --external zod",

94 "build:schema": "bun run script/build-schema.ts",

95 "build:model-capabilities": "bun run script/build-model-capabilities.ts",

96 "clean": "rm -rf dist",

97 "prepare": "bun run build",

98 "postinstall": "node postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L98

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L98

99 "prepublishOnly": "bun run clean && bun run build:lsp-tools-mcp && bun run build:lsp-daemon && bun run build",

101 "typecheck": "tsgo --noEmit && bun run typecheck:script && bun run typecheck:packages",

103 "typecheck:script": "tsgo --noEmit -p script/tsconfig.json",

104 "test": "bun test",

105 "build:git-bash-mcp": "bun run --cwd packages/git-bash-mcp build",

106 "build:slash-commands": "rm -rf dist/cli/slash-commands && mkdir -p dist/cli/slash-commands && cp packages/omo-opencode/src/cli/slash-commands/*.md dist/cli/slash-commands/"

107 },

108 "keywords": [

109 "opencode",

110 "plugin",

111 "agentic-os",

112 "agents",

113 "ai",

114 "llm",

115 "matrixos"

116 ],

117 "author": "KL-Consulting",

118 "license": "SEE LICENSE IN LICENSE.md",

Long lines were clipped for display.

bin/oh-my-opencode.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

2// bin/oh-my-opencode.js

3// Wrapper script that detects platform and spawns the correct binary

5import { spawnSync } from "node:child_process";

6import { existsSync, readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/oh-my-opencode.jsView on unpkg · L4

dist/tui.jsView file

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/tui.jsView on unpkg · L681

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/tui.jsView on unpkg · L681

63412this.args = manager.shardArgs ?? []; L63413: this.execArgv = manager.execArgv; L63414: this.env = Object.assign({}, process3.env, {

dist/skills/superpowers-brainstorming/scripts/server.cjsView file

Lines 1-21javascript

1const crypto = require('crypto');

2const http = require('http');

3const fs =

dist/cli-node/index.jsView file

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/cli-node/index.jsView on unpkg

•path = dist/cli-node/index.js kind = oversized_source_file sizeBytes = 6551162 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli-node/index.jsView on unpkg

•path = dist/cli-node/index.js kind = oversized_cli_entrypoint sizeBytes = 6551162 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli-node/index.js

postinstall.mjsView file

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

postinstall.mjsView on unpkg · L1

dist/cli/skills/ast-grep/install.shView file

•path = dist/cli/skills/ast-grep/install.sh kind = build_helper sizeBytes = 7581 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/cli/skills/ast-grep/install.shView on unpkg

dist/cli/skills/ast-grep/tests/smoke.ps1View file

•path = dist/cli/skills/ast-grep/tests/smoke.ps1 kind = payload_in_excluded_dir sizeBytes = 5701 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/cli/skills/ast-grep/tests/smoke.ps1View on unpkg

bin/matrixos.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/matrixos.jsView on unpkg

dist/cli/skills/superpowers-brainstorming/scripts/server.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/skills/superpowers-brainstorming/scripts/server.cjsView on unpkg

packages/lsp-daemon/dist/cli.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/lsp-daemon/dist/cli.jsView on unpkg

packages/lsp-daemon/dist/client.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/lsp-daemon/dist/client.jsView on unpkg

@kl-c/matrixos@0.3.43

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code