registry / @omicverse/omicos / 0.2.45

@omicverse/omicos@0.2.45

OmicOS — agentic omics-analysis runtime & CLI (omicos-core). Installs the matching native binary for your platform.

AI Security Review

scanned 15d ago · by lpm-firewall-ai

No confirmed malicious attack surface in this wrapper package. The install hook is a notice-only PATH diagnostic, and the CLI entrypoint launches the matching optional native binary when the user runs omicos.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install runs postinstall; user running omicos activates the launcher

Impact

No confirmed exfiltration, persistence, destructive action, or unauthorized mutation in inspected source

Mechanism

platform wrapper and PATH warning script

Rationale

Static source inspection shows suspicious primitives are package-aligned: an npm postinstall notice script and a CLI wrapper for optional native packages. There is no source evidence of malicious install-time behavior, credential/file harvesting, network exfiltration, persistence, or destructive behavior.

Evidence

package.jsonbin/postinstall.jsbin/omicos.js

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for block

package.json defines postinstall: node bin/postinstall.js
bin/omicos.js uses spawnSync to launch optional native package binary by platform

@omicverse/omicos@0.2.45

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code