registry / @melandlabs/opencontext / 0.10.0

@melandlabs/opencontext@0.10.0

OpenContext — single-package facade that bundles the contracts, memory-store, retrieval, loop engine, and agent runtime. Install once, get every capability.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Source inspection found no lifecycle scripts or automatic import-time attack behavior. The scanner's credential-redirection claim is not supported by the inspected CLI source; its network-capable features use explicit commands and supplied settings.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

A user invokes the opencontext CLI with a selected command and configuration.

Impact

No automatic installation-time execution, credential harvesting, or fixed credential-redirection endpoint was confirmed.

Mechanism

User-configured local memory, MCP, HTTP, and LLM integration.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 87.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes a library and user-invoked CLI but has no install lifecycle hook.
CLI execution dispatches only after its command-line entrypoint is invoked.
LLM and storage settings are read from user-provided environment variables or command-line options.

Evidence against

The bundled CLI contains broad agent, filesystem, process, and network functionality, increasing capability exposure.
The published JavaScript is unusually large and includes substantial unrelated-looking bundled runtime code.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 534 KB of source, external domains: 127.0.0.1, github.com, jimmy.warting.se, openrouter.ai, sheetjs.com

Oversized source lightweight scan

Source & flagged code

16 flagged

dist/cli/opencontext.jsView file

17import 'pg'; L18: import { execFile, execFileSync, spawn, execSync, spawnSync, exec } from 'child_process'; L19: import * as z4 from 'zod/v4'; ... L36: import { createRequire } from 'module'; L37: import Xoe from 'http'; L38: import Qoe from 'https'; ... L89: function getTauriDataDir() { L90: if (process.env.TAURI_DATA_DIR) { L91: return process.env.TAURI_DATA_DIR; ... L93: if (process.env.NODE_ENV === "development") { L94: return process.platform === "win32" ? `${process.env.APPDATA}/opencontext` : process.platform === "darwin" ? `${process.env.HOME}/Library/Application Support/opencontext` : `${proc... L95: }

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli/opencontext.jsView on unpkg · L17

17Trigger-reachable chain: manifest.bin -> dist/cli/opencontext.js L17: import 'pg'; L18: import { execFile, execFileSync, spawn, execSync, spawnSync, exec } from 'child_process'; L19: import * as z4 from 'zod/v4'; ... L36: import { createRequire } from 'module'; L37: import Xoe from 'http'; L38: import Qoe from 'https'; ... L89: function getTauriDataDir() { L90: if (process.env.TAURI_DATA_DIR) { L91: return process.env.TAURI_DATA_DIR; ... L93: if (process.env.NODE_ENV === "development") { L94: return process.platform === "win32" ? `${process.env.APPDATA}/opencontext` : process.platform === "darwin" ? `${process.env.HOME}/Library/Application Support/opencontext` : `${proc... L95: }

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli/opencontext.jsView on unpkg · L17

•matchType = previous_version_dangerous_delta matchedPackage = @melandlabs/opencontext@0.9.0 matchedIdentity = npm:QG1lbGFuZGxhYnMvb3BlbmNvbnRleHQ:0.9.0 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/opencontext.jsView on unpkg

17import 'pg'; L18: import { execFile, execFileSync, spawn, execSync, spawnSync, exec } from 'child_process'; L19: import * as z4 from 'zod/v4';

High

Child Process

Package source references child process execution.

dist/cli/opencontext.jsView on unpkg · L17

201348var jx = {}; L201349: Dt(jx, { USE_API_CONTEXT_MANAGEMENT: () => Rle, INK_SCREEN_READER: () => Jse, FORCE_VCR: () => Cle, FORCE_PROMPT_CACHING_5M: () => Ale, FORCE_CODE_TERMINAL: () => Tle, FORCE_AUTOUP... L201350: var Vse = p.triBool();

High

Shell

Package source references shell execution.

dist/cli/opencontext.jsView on unpkg · L201348

205098var ST = O(() => x({ source: Vp().describe("Where to fetch the marketplace from"), installLocation: g().optional().describe("Local cache path where marketplace manifest is stored (... L205099: var vh = O(() => x({ serverName: g().regex(/^[a-zA-Z0-9_-]+$/, "Server name can only contain letters, numbers, hyphens, and underscores").optional().describe("Name of the MCP serve... L205100: var wh = O(() => x({ serverName: g().min(1, "Server name must be non-empty").refine((e) => e.trim().length > 0, { message: "Server name must not be whitespace-only" }).refine((e) =... ... L205105: function HG(e) { L205106: return x({ $schema: g().optional().describe("JSON Schema reference for Claude Code settings"), apiKeyHelper: g().optional().describe("Path to a script that outputs authentication v..

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/opencontext.jsView on unpkg · L205098

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli/opencontext.js: import { readFile as readFile$1, stat as stat$1, mkdir, writeFile as writeFile$1, open as open$1, chmod, link, symlink, appendFile, copyFile, readlink, realpath, rename, rm, rmdir,... import { createInterface } from 'readline'; async function writeFile(path6, data, options) { await writeFile(path6, data); // Marks visible continuation messages created after an authorization card is authorizationContinuation: z$1.boolean().optional(), async function writeFileAtomic(filePath, content) { await nodeFsPromises.writeFile(tempPath, content, {

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli/opencontext.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/cli/opencontext.js: import { readFile as readFile$1, stat as stat$1, mkdir, writeFile as writeFile$1, open as open$1, chmod, link, symlink, appendFile, copyFile, readlink, realpath, rename, rm, rmdir,... "follow up" // ../../node_modules/clsx/dist/clsx.mjs "../../node_modules/clsx/dist/clsx.mjs"() { // ../../node_modules/@tauri-apps/api/external/tslib/tslib.es6.js "../../node_modules/@tauri-apps/api/external/tslib/tslib.es6.js"() { "../../node_modules/@tauri-apps/api/core.js"() { // ../../node_modules/@tauri-apps/api/path.js

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/cli/opencontext.jsView on unpkg

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/opencontext.jsView on unpkg · L17

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/opencontext.jsView on unpkg · L17

17import 'pg'; L18: import { execFile, execFileSync, spawn, execSync, spawnSync, exec } from 'child_process'; L19: import * as z4 from 'zod/v4'; ... L7693: function writeFileSync2(filePath, content) { L7694: we.writeFileSync(filePath, content); L7695: } ... L12174: // ../../node_modules/langsmith/dist/_openapi_client/client.js L12175: var __classPrivateFieldSet4, __classPrivateFieldGet4, _Langsmith_instances, _a, _Langsmith_encoder, _Langsmith_baseURLOverridden, Langsmith; L12176: var init_client = __esm({ ... L135872: availableTools = void 0, L135873: message = `Model tried to call unavailable tool '${toolName}'. ${availableTools === void 0 ? "No tools are available." : `Available tools: ${availableTools.join(", ")}.`}` L135874: }) {

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/cli/opencontext.jsView on unpkg · L17

17Trigger-reachable credential exfiltration chain: manifest.bin -> dist/cli/opencontext.js L17: import 'pg'; L18: import { execFile, execFileSync, spawn, execSync, spawnSync, exec } from 'child_process'; L19: import * as z4 from 'zod/v4'; ... L36: import { createRequire } from 'module'; L37: import Xoe from 'http'; L38: import Qoe from 'https'; ... L89: function getTauriDataDir() { L90: if (process.env.TAURI_DATA_DIR) { L91: return process.env.TAURI_DATA_DIR; ... L93: if (process.env.NODE_ENV === "development") { L94: return process.platform === "win32" ? `${process.env.APPDATA}/opencontext` : process.platform === "darwin" ? `${process.env.HOME}/Library/Application Support/opencontext` : `${proc... L95: }

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/cli/opencontext.jsView on unpkg · L17

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli/opencontext.jsView on unpkg

10895const isOldNode = typeof process2?.versions?.node === "string" && parseInt(process2.versions.node.split(".")) < 20; L10896: throw new Error("`File` is not defined as a global, which is required for file uploads." + (isOldNode ? " Update to Node 20 LTS or newer, or set `globalThis.File` to `import('node:... L10897: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/opencontext.jsView on unpkg · L10895

•path = dist/cli/opencontext.js kind = oversized_cli_entrypoint sizeBytes = 8363209 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli/opencontext.jsView on unpkg

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 10083587 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/index.jsView on unpkg

Source & flagged code

16 flagged · loading source

dist/cli/opencontext.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli/opencontext.jsView on unpkg · L17

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

Findings

3 Critical10 High6 Medium4 Low

CriticalCredential Exfiltrationdist/cli/opencontext.js

CriticalTrigger Reachable Dangerous Capabilitydist/cli/opencontext.js

CriticalPrevious Version Dangerous Deltadist/cli/opencontext.js

HighChild Processdist/cli/opencontext.js

HighShelldist/cli/opencontext.js

HighSame File Env Network Executiondist/cli/opencontext.js

HighCredential Redirect Persistencedist/cli/opencontext.js

HighEntrypoint Foreign Package Code Overwritedist/cli/opencontext.js

HighCommand Output Exfiltrationdist/cli/opencontext.js

HighSandbox Evasion Gated Capabilitydist/cli/opencontext.js

HighRemote Agent Bridgedist/cli/opencontext.js

Affected versions and remediation

This report applies to @melandlabs/opencontext@0.10.0.

See all versions of @melandlabs/opencontext for other recorded verdicts.

Review the evidence and your use of @melandlabs/opencontext@0.10.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-12 08:32:53.014Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.