registry / @omicverse/omicos / 0.2.43

@omicverse/omicos@0.2.43

OmicOS — agentic omics-analysis runtime & CLI (omicos-core). Installs the matching native binary for your platform.

AI Security Review

scanned 17d ago · by lpm-firewall-ai

No confirmed malicious attack surface in the inspected wrapper package. The install hook is a global-install PATH notice, and the CLI launcher delegates to a platform native optional dependency when the user invokes omicos.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install runs postinstall; user invocation runs bin/omicos.js

Impact

No confirmed malicious impact from inspected source

Mechanism

native CLI wrapper with install-time PATH warning

Rationale

Static inspection shows a conventional native-binary wrapper and a postinstall script that only emits warnings for PATH precedence on global installs. Suspicious primitives are package-aligned and no concrete exfiltration, persistence, destructive behavior, or unconsented control-surface mutation was found.

Evidence

package.jsonbin/postinstall.jsbin/omicos.js

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for block

package.json defines postinstall: node bin/postinstall.js
bin/omicos.js uses spawnSync to run platform optionalDependency native binary
bin/postinstall.js reads PATH, npm_config_global, npm_config_prefix, and homedir

@omicverse/omicos@0.2.43

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code