registry / @omicverse/omicos / 0.2.46

@omicverse/omicos@0.2.46

OmicOS — agentic omics-analysis runtime & CLI (omicos-core). Installs the matching native binary for your platform.

AI Security Review

scanned 14d ago · by lpm-firewall-ai

No confirmed malicious attack surface in the inspected wrapper package. The lifecycle script is advisory-only, and native execution is user-invoked through the CLI wrapper.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install runs postinstall; user runs omicos CLI

Impact

No source-confirmed credential access, persistence, exfiltration, destructive behavior, or agent control-surface mutation

Mechanism

PATH advisory postinstall and platform binary launcher

Rationale

The suspicious primitives are package-aligned: a postinstall notice and a CLI launcher for declared platform optional dependencies. Static inspection found no unconsented writes, network exfiltration, persistence, or AI-agent hijack behavior in this package.

Evidence

package.jsonbin/postinstall.jsbin/omicos.js

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for block

package.json defines postinstall: node bin/postinstall.js
bin/omicos.js uses spawnSync to launch a platform optionalDependency binary

Evidence against

@omicverse/omicos@0.2.46

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code