Loading npm security reports…

@kl-c/matrixos@0.3.44: AI-agent control-surface risk | LPM Firewall

registry / @kl-c/matrixos / 0.3.44

@kl-c/matrixos@0.3.44

MaTrixOS — Agentic OS for OpenCode. Personalizable, communicating, self-improving, resilient.

AI Security Review

scanned 21d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Install-time code mutates the user's global OpenCode command control surface. It force-installs MaTrixOS agent instructions and invalidates plugin caches so they are rediscovered.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall

Impact

Existing OpenCode commands can be overwritten and future agent sessions receive package-supplied instructions.

Mechanism

global AI-agent command injection and cache invalidation

Policy narrative

During installation, postinstall.mjs copies all bundled Markdown command instructions into the user's global OpenCode command directory with force overwrite, then removes matching OpenCode cache packages. This modifies a foreign AI-agent control surface without an explicit setup command; installed instructions can direct subsequent agent actions, including filesystem creation and release operations.

Rationale

The package performs unconsented postinstall mutation of a global AI-agent command surface, not merely package-local setup. The lack of observed install-time exfiltration does not remove the control-hijack risk.

Evidence

package.jsonpostinstall.mjs.opencode/command/adopt.md.opencode/command/publish.md.opencode/command/*.md.agents/command/*.md~/.config/opencode/command/*.md~/.cache/opencode~/.cache/opencode/packages

Source & flagged code

21 flagged

package.jsonView file

Lines 78-118json

78 },

79 "./server": "./dist/index.js",

80 "./tui": "./dist/tui.js",

81 "./features": "./dist/features/matrix-inventory/features.js",

82 "./schema.json": "./dist/matrixos.schema.json"

83 },

84 "scripts": {

85 "build": "bun run script/build.ts",

86 "build:cli-node": "bun run script/build-cli-node.ts",

87 "build:dashboard-frontend": "rm -rf dist/features/dashboard/frontend && mkdir -p dist/features/dashboard/frontend && cp -R packages/omo-opencode/src/features/dashboard/frontend/. dist/features/dashboard/frontend/",

88 "build:shared-skills-assets": "rm -rf dist/skills && cp -R packages/shared-skills/skills dist/skills && mkdir -p dist/cli && rm -rf dist/cli/skills && cp -R packages/shared-skills/skills dist/cli/skills",

89 "build:lsp-tools-mcp": "npm --prefix packages/lsp-tools-mcp ci && npm --prefix packages/lsp-tools-mcp run build",

90 "build:lsp-daemon": "npm --prefix packages/lsp-daemon ci && npm --prefix packages/lsp-daemon run build",

91 "build:node-require-shim": "bun run script/patch-node-require-shim.ts",

92 "build:binaries": "bun run script/build-binaries.ts",

93 "build:features-inventory": "bun build packages/omo-opencode/src/features/matrix-inventory/features.ts --outdir dist/features/matrix-inventory --target bun --format esm --external zod",

94 "build:schema": "bun run script/build-schema.ts",

95 "build:model-capabilities": "bun run script/build-model-capabilities.ts",

96 "clean": "rm -rf dist",

97 "prepare": "bun run build",

98 "postinstall": "node postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L98

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L98

99 "prepublishOnly": "bun run clean && bun run build:lsp-tools-mcp && bun run build:lsp-daemon && bun run build",

100 "test:model-capabilities": "bun test packages/model-core/src/model-capability-aliases.test.ts packages/model-core/src/model-capability-guardrails.test.ts packages/model-core/src/model-capabilities.test.ts packages/omo-opencode/src/cli/doctor/checks/model-resolution.test.ts --bail",

101 "typecheck": "tsgo --noEmit && bun run typecheck:script && bun run typecheck:packages",

102 "typecheck:packages": "tsgo --noEmit -p packages/rules-engine/tsconfig.json && tsgo --noEmit -p packages/delegate-core/tsconfig.json && tsgo --noEmit -p packages/mcp-stdio-core/tsconfig.json && tsgo --noEmit -p packages/mcp-client-core/tsconfig.json && tsgo --noEmit -p packages/git-bash-mcp/tsconfig.json && tsgo --noEmit -p packages/lsp-core/tsconfig.json && tsgo --noEmit -p packages/utils/tsconfig.json && tsgo --noEmit -p packages/model-core/tsconfig.json && tsgo --noEmit -p packages/omo-config-core/tsconfig.json && tsgo --noEmit -p packages/prompts-core/tsconfig.json && tsgo --noEmit -p ...

103 "typecheck:script": "tsgo --noEmit -p script/tsconfig.json",

104 "test": "bun test",

105 "build:git-bash-mcp": "bun run --cwd packages/git-bash-mcp build",

106 "build:slash-commands": "rm -rf dist/cli/slash-commands && mkdir -p dist/cli/slash-commands && cp packages/omo-opencode/src/cli/slash-commands/*.md dist/cli/slash-commands/"

107 },

108 "keywords": [

109 "opencode",

110 "plugin",

111 "agentic-os",

112 "agents",

113 "ai",

114 "llm",

115 "matrixos"

116 ],

117 "author": "KL-Consulting",

118 "license": "SEE LICENSE IN LICENSE.md",

Long lines were clipped for display.

bin/oh-my-opencode.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

2// bin/oh-my-opencode.js

3// Wrapper script that detects platform and spawns the correct binary

5import { spawnSync } from "node:child_process";

6import { existsSync, readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/oh-my-opencode.jsView on unpkg · L4

dist/tui.jsView file

681for (;index < max; index++) { L682: if (!isHexCode(data.charCodeAt(index))) L683: return false; ... L4234: const osProvider = options.osProvider ?? os; L4235: const env = options.env ?? process.env; L4236: const preferredDir = env.XDG_DATA_HOME ?? path.join(osProvider.homedir(), ".local", "share"); L4237: return resolveWritableDirectory(preferredDir, `${appName}-data`, osProvider); ... L4518: // [redacted].ts L4519: import { execFile } from "child_process"; L4520: import { promisify } from "util"; ... L6322: error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config()))) L6323: } : { success: true, data: result.value };

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/tui.jsView on unpkg · L681

681Trigger-reachable chain: manifest.exports -> dist/tui.js L681: for (;index < max; index++) { L682: if (!isHexCode(data.charCodeAt(index))) L683: return false; ... L4234: const osProvider = options.osProvider ?? os; L4235: const env = options.env ?? process.env; L4236: const preferredDir = env.XDG_DATA_HOME ?? path.join(osProvider.homedir(), ".local", "share"); L4237: return resolveWritableDirectory(preferredDir, `${appName}-data`, osProvider); ... L4518: // [redacted].ts L4519: import { execFile } from "child_process"; L4520: import { promisify } from "util"; ... L6322: error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config()))) L6323: } : { success: true, data: result.value };

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/tui.jsView on unpkg · L681

63412this.args = manager.shardArgs ?? []; L63413: this.execArgv = manager.execArgv; L63414: this.env = Object.assign({}, process3.env, {

dist/skills/superpowers-brainstorming/scripts/server.cjsView file

Lines 1-21javascript

1const crypto = require('crypto');

2const http = require('http');

3const fs =

dist/cli-node/index.jsView file

•context = *: Use \`getAISnapshot()\` to discover elements and \`selectSnapshotRef()\` to interact with them\n- **Visual feedback**: Take screenshots to see what the user sees\n\n## Setup\n\n**IMPORTANT**: Before using this skill, ensure the server is running. See [references/installation.md](references/installation.md) for platform-specific setup instructions (macOS, Linux, Windows).\n\nTwo modes available. Ask the user if unclear which to use.\n\n### Standalone Mode (Default)\n\nLaunches a new Chromium browser for fresh automation sessions.\n\n**macOS/Linux:**\n\`\`\`bash\n./skills/dev-browser/server.sh &\n\`\`\`\n\n**Windows (PowerShell):**\n\`\`\`powershell\nStart-Process -NoNewWindow -FilePath "node" -ArgumentList "skills/dev-browser/server.js"\n\`\`\`\n\nAdd \`--headless\` flag if use

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/cli-node/index.jsView on unpkg

•path = dist/cli-node/index.js kind = oversized_source_file sizeBytes = 6551576 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli-node/index.jsView on unpkg

•path = dist/cli-node/index.js kind = oversized_cli_entrypoint sizeBytes = 6551576 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli-node/index.js

postinstall.mjsView file

1Install-time AI-agent control hijack evidence: L3: L4: import { readdirSync, rmSync, cpSync, mkdirSync, existsSync } from "node:fs"; L5: import { createRequire } from "node:module"; ... L19: * so OpenCode discovers them at startup. OpenCode scans L20: * `~/.config/opencode/command/*.md` (user-level) and `.opencode/command/*.md` L21: * (project-level), but NOT package internals under node_modules. Without this ... L28: const commandSources = [ L29: join(__dirname, ".opencode", "command"), L30: join(__dirname, ".agents", "command"), ... L35: if (!existsSync(sourceDir)) continue; L36: mkdirSync(targetDir, { recursive: true }); L37: for (const entry of readdirSync(sourceDir, { withFileTypes: true })) { Payload evidence from dist/features/builtin-skills/skills/playwright-mcp-skill.d.ts: L1: ex

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

postinstall.mjsView on unpkg · L1

dist/cli/skills/ast-grep/install.shView file

•path = dist/cli/skills/ast-grep/install.sh kind = build_helper sizeBytes = 7581 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/cli/skills/ast-grep/install.shView on unpkg

dist/cli/skills/ast-grep/tests/smoke.ps1View file

•path = dist/cli/skills/ast-grep/tests/smoke.ps1 kind = payload_in_excluded_dir sizeBytes = 5701 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/cli/skills/ast-grep/tests/smoke.ps1View on unpkg

bin/matrixos.jsView file

•matchType = normalized_sha256 matchedPackage = @kl-c/matrixos@0.3.43 matchedPath = bin/matrixos.js matchedIdentity = npm:QGtsLWMvbWF0cml4b3M:0.3.43 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/matrixos.jsView on unpkg

dist/cli/skills/superpowers-brainstorming/scripts/server.cjsView file

•matchType = normalized_sha256 matchedPackage = @kl-c/matrixos@0.3.43 matchedPath = dist/cli/skills/superpowers-brainstorming/scripts/server.cjs matchedIdentity = npm:QGtsLWMvbWF0cml4b3M:0.3.43 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/skills/superpowers-brainstorming/scripts/server.cjsView on unpkg

packages/lsp-daemon/dist/cli.jsView file

•matchType = normalized_sha256 matchedPackage = @kl-c/matrixos@0.3.43 matchedPath = packages/lsp-daemon/dist/cli.js matchedIdentity = npm:QGtsLWMvbWF0cml4b3M:0.3.43 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/lsp-daemon/dist/cli.jsView on unpkg

packages/lsp-daemon/dist/client.jsView file

•matchType = normalized_sha256 matchedPackage = @kl-c/matrixos@0.3.43 matchedPath = packages/lsp-daemon/dist/client.js matchedIdentity = npm:QGtsLWMvbWF0cml4b3M:0.3.43 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/lsp-daemon/dist/client.jsView on unpkg

Source & flagged code

21 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/oh-my-opencode.jsView file

4L5: import { spawnSync } from "node:child_process"; L6: import { existsSync, readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/oh-my-opencode.jsView on unpkg · L4

16L17: const require = createRequire(import.meta.url); L18:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/oh-my-opencode.jsView on unpkg · L16

dist/tui.jsView file

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/tui.jsView on unpkg · L681

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/tui.jsView on unpkg · L681

63412this.args = manager.shardArgs ?? []; L63413: this.execArgv = manager.execArgv; L63414: this.env = Object.assign({}, process3.env, {

dist/skills/superpowers-brainstorming/scripts/server.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/skills/superpowers-brainstorming/scripts/server.cjsView on unpkg

1const crypto = require('crypto'); L2: const http = require('http'); L3: const fs = require('fs'); ... L12: function computeAcceptKey(clientKey) { L13: return crypto.createHash('sha1').update(clientKey + WS_MAGIC).digest('base64'); L14: } ... L84: L85: const PORT_FILE = process.env.BRAINSTORM_PORT_FILE || null; L86: const randomPort = () => 49152 + Math.floor(Math.random() * 16383); ... L195: try { sessionStorage.setItem('brainstorm-session-key', ${jsonKey}); } catch (e) {} L196: location.replace('/'); L197: </script>

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/skills/superpowers-brainstorming/scripts/server.cjsView on unpkg · L1

dist/cli-node/index.jsView file

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/cli-node/index.jsView on unpkg

•path = dist/cli-node/index.js kind = oversized_source_file sizeBytes = 6551576 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli-node/index.jsView on unpkg

•path = dist/cli-node/index.js kind = oversized_cli_entrypoint sizeBytes = 6551576 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli-node/index.js

postinstall.mjsView file

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

postinstall.mjsView on unpkg · L1

dist/cli/skills/ast-grep/install.shView file

•path = dist/cli/skills/ast-grep/install.sh kind = build_helper sizeBytes = 7581 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/cli/skills/ast-grep/install.shView on unpkg

dist/cli/skills/ast-grep/tests/smoke.ps1View file

•path = dist/cli/skills/ast-grep/tests/smoke.ps1 kind = payload_in_excluded_dir sizeBytes = 5701 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/cli/skills/ast-grep/tests/smoke.ps1View on unpkg

bin/matrixos.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/matrixos.jsView on unpkg

dist/cli/skills/superpowers-brainstorming/scripts/server.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/skills/superpowers-brainstorming/scripts/server.cjsView on unpkg

packages/lsp-daemon/dist/cli.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/lsp-daemon/dist/cli.jsView on unpkg

packages/lsp-daemon/dist/client.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/lsp-daemon/dist/client.jsView on unpkg

Source & flagged code

21 flagged

package.jsonView file

Lines 78-118json

78 },

79 "./server": "./dist/index.js",

80 "./tui": "./dist/tui.js",

81 "./features": "./dist/features/matrix-inventory/features.js",

82 "./schema.json": "./dist/matrixos.schema.json"

83 },

84 "scripts": {

85 "build": "bun run script/build.ts",

86 "build:cli-node": "bun run script/build-cli-node.ts",

89 "build:lsp-tools-mcp": "npm --prefix packages/lsp-tools-mcp ci && npm --prefix packages/lsp-tools-mcp run build",

90 "build:lsp-daemon": "npm --prefix packages/lsp-daemon ci && npm --prefix packages/lsp-daemon run build",

91 "build:node-require-shim": "bun run script/patch-node-require-shim.ts",

92 "build:binaries": "bun run script/build-binaries.ts",

93 "build:features-inventory": "bun build packages/omo-opencode/src/features/matrix-inventory/features.ts --outdir dist/features/matrix-inventory --target bun --format esm --external zod",

94 "build:schema": "bun run script/build-schema.ts",

95 "build:model-capabilities": "bun run script/build-model-capabilities.ts",

96 "clean": "rm -rf dist",

97 "prepare": "bun run build",

98 "postinstall": "node postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L98

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L98

99 "prepublishOnly": "bun run clean && bun run build:lsp-tools-mcp && bun run build:lsp-daemon && bun run build",

101 "typecheck": "tsgo --noEmit && bun run typecheck:script && bun run typecheck:packages",

103 "typecheck:script": "tsgo --noEmit -p script/tsconfig.json",

104 "test": "bun test",

105 "build:git-bash-mcp": "bun run --cwd packages/git-bash-mcp build",

106 "build:slash-commands": "rm -rf dist/cli/slash-commands && mkdir -p dist/cli/slash-commands && cp packages/omo-opencode/src/cli/slash-commands/*.md dist/cli/slash-commands/"

107 },

108 "keywords": [

109 "opencode",

110 "plugin",

111 "agentic-os",

112 "agents",

113 "ai",

114 "llm",

115 "matrixos"

116 ],

117 "author": "KL-Consulting",

118 "license": "SEE LICENSE IN LICENSE.md",

Long lines were clipped for display.

bin/oh-my-opencode.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

2// bin/oh-my-opencode.js

3// Wrapper script that detects platform and spawns the correct binary

5import { spawnSync } from "node:child_process";

6import { existsSync, readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/oh-my-opencode.jsView on unpkg · L4

dist/tui.jsView file

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/tui.jsView on unpkg · L681

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/tui.jsView on unpkg · L681

63412this.args = manager.shardArgs ?? []; L63413: this.execArgv = manager.execArgv; L63414: this.env = Object.assign({}, process3.env, {

dist/skills/superpowers-brainstorming/scripts/server.cjsView file

Lines 1-21javascript

1const crypto = require('crypto');

2const http = require('http');

3const fs =

dist/cli-node/index.jsView file

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/cli-node/index.jsView on unpkg

•path = dist/cli-node/index.js kind = oversized_source_file sizeBytes = 6551576 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli-node/index.jsView on unpkg

•path = dist/cli-node/index.js kind = oversized_cli_entrypoint sizeBytes = 6551576 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli-node/index.js

postinstall.mjsView file

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

postinstall.mjsView on unpkg · L1

dist/cli/skills/ast-grep/install.shView file

•path = dist/cli/skills/ast-grep/install.sh kind = build_helper sizeBytes = 7581 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/cli/skills/ast-grep/install.shView on unpkg

dist/cli/skills/ast-grep/tests/smoke.ps1View file

•path = dist/cli/skills/ast-grep/tests/smoke.ps1 kind = payload_in_excluded_dir sizeBytes = 5701 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/cli/skills/ast-grep/tests/smoke.ps1View on unpkg

bin/matrixos.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/matrixos.jsView on unpkg

dist/cli/skills/superpowers-brainstorming/scripts/server.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/skills/superpowers-brainstorming/scripts/server.cjsView on unpkg

packages/lsp-daemon/dist/cli.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/lsp-daemon/dist/cli.jsView on unpkg

packages/lsp-daemon/dist/client.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/lsp-daemon/dist/client.jsView on unpkg

@kl-c/matrixos@0.3.44

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code