registry / @omicverse/omicos / 0.2.42

@omicverse/omicos@0.2.42

OmicOS — agentic omics-analysis runtime & CLI (omicos-core). Installs the matching native binary for your platform.

AI Security Review

scanned 17d ago · by lpm-firewall-ai

No confirmed malicious attack surface in the inspected wrapper package. The lifecycle hook is a global-install PATH notice, and the CLI launcher only dispatches to declared platform optionalDependencies.

Static reason

One or more suspicious static signals were detected.

Trigger

postinstall for PATH warning; user runs omicos CLI for native binary dispatch

Impact

Executes the declared omicos native binary only when the user invokes the CLI; install hook prints warnings only.

Mechanism

platform native binary launcher plus install-time PATH check

Rationale

The suspicious primitives are package-aligned for a native CLI wrapper and the postinstall hook does not mutate files, run commands, or exfiltrate data. No concrete malicious behavior was found by source inspection of the package contents.

Evidence

package.jsonbin/omicos.jsbin/postinstall.js

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for block

package.json defines postinstall lifecycle hook: node bin/postinstall.js
bin/omicos.js uses spawnSync to execute platform optionalDependency native binary on user CLI invocation

@omicverse/omicos@0.2.42

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code