registry / Remote code execution / @lmdelm-dev/bmo
@lmdelm-dev/bmo
BMO - a GameBoy-style terminal for Linux and Windows. Python (tkinter) app bootstrapped by npm/bun.
This report shows the evidence for @lmdelm-dev/bmo@0.3.0, the only known version.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe behavior is explicit rather than stealthy, but it is still an unconsented postinstall remote-code bootstrap with broad host mutation and no content pinning or verification. This meets the firewall block threshold for concrete install-time execution risk.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm postinstall (`node cli.js --install`)
Impact
A package install can execute changing remote payloads and alter the host before the user runs `bmo`.
Mechanism
unconsented lifecycle remote-code bootstrap and system mutation
Attack narrative
npm installation triggers cli.js. It fetches and extracts an unpinned GitHub main-branch archive, then conditionally pipes remote opencode and Ollama installers to shells, uses OS package managers (including sudo) and pip, and writes desktop/font artifacts. The fetched application is subsequently executed by the bmo command, so a later remote-branch change can become local code execution without a package version change.
AI rationale
The behavior is explicit rather than stealthy, but it is still an unconsented postinstall remote-code bootstrap with broad host mutation and no content pinning or verification. This meets the firewall block threshold for concrete install-time execution risk.
Evidence
package.jsoncli.jsREADME.mddist/$HOME/.opencode/bin$HOME/.local/share/fonts/Blue Water.otf$HOME/Library/Fonts/Blue Water.otf$XDG_DESKTOP_DIR/bmo.desktop
Network endpoints4
github.com/lmdelm-dev/bmo/archive/refs/heads/main.tar.gzopencode.ai/installopencode.ai/install.ps1ollama.com/install.sh
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json runs `node cli.js --install` at postinstall.
- cli.js downloads the mutable GitHub `main` tarball into `dist/` without integrity verification.
- Postinstall invokes remote installers through `curl | bash` for opencode and Ollama.
- Postinstall runs privileged OS package-manager commands and user-level pip installs.
- cli.js creates a desktop launcher and installs a font in user directories.
Evidence against
- No credential harvesting, secret reads, or exfiltration code found.
- No obfuscation, eval, dynamic JavaScript loading, or host-fingerprinting gate found.
- Commands and persistence are openly described in README.md.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node cli.js --install
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node cli.js --install
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgcli.jsView file
5* bmo --install -> download BMO source + assets into ./dist and ensure deps
L6: * (run automatically via package.json postinstall)
L7: *
...
L12:
L13: const { execFileSync, spawn, spawnSync } = require("child_process");
L14: const fs = require("fs");
...
L17:
L18: const PKG_DIR = __dirname;
L19: const DIST = path.join(PKG_DIR, "dist");
...
L21:
L22: const REPO = "https://github.com/lmdelm-dev/bmo";
L23: const BRANCH = "main";
Critical
Download Execute
Source downloads or fetches remote code and executes it.
Findings
2 Critical3 High3 Medium4 Low
CriticalDownload Executecli.js
CriticalTrigger Reachable Dangerous Capabilitycli.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processcli.js
HighSandbox Evasion Gated Capabilitycli.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @lmdelm-dev/bmo@0.3.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @lmdelm-dev/bmo@0.3.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.