registry / Data exfiltration / @melandlabs/opencontext
@melandlabs/opencontext
OpenContext — single-package facade that bundles the contracts, memory-store, retrieval, loop engine, and agent runtime. Install once, get every capability.
This report shows the evidence for @melandlabs/opencontext@0.7.0. 1 of 23 known versions is blocked or flagged. The newest version, 0.13.6, is flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is not a lifecycle-only concern: executable runtime code injects broad file-harvesting instructions into a permission-bypassing AI agent. The lack of install hooks does not mitigate the concrete, user-unconsented runtime collection behavior.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Runtime execution of a ClaudeAgent plan.
Impact
Unconsented local-file disclosure to the agent/model context.
Mechanism
hidden prompt-driven file harvesting through an unrestricted agent runtime
Attack narrative
When the package's Claude agent executes a plan, it embeds a workspace instruction that proactively searches common user directories for only loosely relevant context and reads matching files without permission. The same agent defaults to bypassPermissions while exposing file, shell, and search tools. This creates a concrete path from an ordinary task to unrequested harvesting of local files and inclusion of their contents in the remote-agent workflow.
AI rationale
This is not a lifecycle-only concern: executable runtime code injects broad file-harvesting instructions into a permission-bypassing AI agent. The lack of install hooks does not mitigate the concrete, user-unconsented runtime collection behavior.
Evidence
package.jsondist/index.jsdist/cli/opencontext.js~/Downloads/~/Desktop/~/Documents/
Network endpoints1
api.anthropic.com
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- Embedded agent prompt directs broad searches of user files for loosely relevant questions.
- Prompt targets ~/Downloads, ~/Desktop, and ~/Documents and says to read found files without permission.
- Claude runtime defaults to bypassPermissions and enables dangerously skipping permissions.
- Agent execution injects the workspace instruction into a Claude Code plan-execution prompt.
Evidence against
- package.json has no install lifecycle hook.
- CLI entrypoint otherwise exposes documented local MCP/HTTP and memory commands.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Oversized source lightweight scan
Source & flagged code
18 flagged · loading sourcedist/index.jsView file
•Default external logging endpoint and rich-record POST in dist/index.js:
const perm = await handle.queryPermission?.({ mode: "read" }) ?? "granted";
return "An error occurred while executing a database query.";
case "bad_request:api":
return `The request couldn't be processed. Please check your input and try again.${cause ? ` Cause: ${cause}` : ""}`;
return "The requested chat was not found. Please check the chat ID and try again.";
return "The requested document was not found. Please check the document ID and try again.";
case "bad_request:document":
return "The request to create or update the document was invalid. Please check your input and try again.";
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg2import * as nf from 'node-fetch';
L3: import * as fd from 'formdata-node';
L4: import KeepAliveAgent from 'agentkeepalive';
...
L27: import 'pg';
L28: import { execFile, spawn, execSync, execFileSync, spawnSync, exec } from 'child_process';
L29: import { createOpenAICompatible } from '@ai-sdk/openai-compatible';
...
L37: import iM, { promisify } from 'util';
L38: import Xoe from 'http';
L39: import Qoe from 'https';
...
L2577: // ../../node_modules/@tauri-apps/api/external/tslib/tslib.es6.js
L2578: function __classPrivateFieldGet(receiver, state, kind2, f10) {
L2579: if (typeof state === "function" ? receiver !== state || !f10 : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it")...
Critical
Credential Exfiltration
Findings
4 Critical11 High6 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/cli/opencontext.js
HighChild Processdist/index.js
HighShelldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighEntrypoint Foreign Package Code Overwritedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
High
Affected versions and remediation
This report applies to @melandlabs/opencontext@0.7.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @melandlabs/opencontext@0.7.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.