@omniwatch-wick/cli
This report shows the evidence for @omniwatch-wick/cli@0.1.2. 1 of 2 known versions is blocked or flagged. The newest version, 0.1.4, is flagged. See all versions.
OpenSSF/OSV Malicious Advisory
imported 3mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-10486 confirms this npm version as malicious.
Advisory
MAL-2026-10486
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @omniwatch-wick/cli (npm)
Details
index.js requires child_process, os, http, and https, collects host identifiers via os.userInfo(), hostname, and process.platform, and POSTs the collected data to hardcoded endpoints at https://agentpolice-api.vedantn06soni.workers.dev (references at lines 17 and 268) and https://night-watch-indol.vercel.app (line 195). The POST call at line 75 sends host/user identity data to a non-first-party Cloudflare Workers endpoint controlled by the publisher. This is the shape of an installer-side reconnaissance/exfiltration beacon rather than any documented CLI functionality.
## Source: ghsa-malware (0ddf11512280b890368f2b127fd8d1531af879bd7371633b6545af5f28574dd6) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
References
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
The package creates a remotely managed Claude Code extension during an explicit user command and executes unpinned downloaded code. This warrants a warning under the explicit-user-command agent configuration policy, not a block.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs the package bin with no command or `install`.
Impact
A remote service or redirected response can control code executed during explicit setup and alter the user's Claude Code integration.
Mechanism
Remote script/agent download, execution, and Claude Code hook/MCP configuration.
AI rationale
The package creates a remotely managed Claude Code extension during an explicit user command and executes unpinned downloaded code. This warrants a warning under the explicit-user-command agent configuration policy, not a block.
Evidence
package.jsonindex.js~/.agentpolice/agp.py~/.agentpolice/mcp_server.py~/.agentpolice/routing.py~/.agentpolice/sdk_logger.py~/.agentpolice/config.json~/.claude/settings.json
Network endpoints2
agentpolice-api.vedantn06soni.workers.devnight-watch-indol.vercel.app
Independent scan evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for AI warning decision
- index.js downloads remote shell scripts and executes them with bash or PowerShell ExecutionPolicy Bypass.
- index.js downloads remote Python agent files without integrity checks, then executes agp.py.
- index.js invokes agp.py _patch-settings on ~/.claude/settings.json to wire hooks and MCP.
- Remote base is user-overridable and HTTP redirects are followed.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- Behavior runs only through the CLI default/install command, not package installation.
- Registration data is collected through interactive prompts and posted to the declared service.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
UrlStrings
Source & flagged code
3 flagged · loading sourceindex.jsView file
5L6: const { spawnSync } = require('child_process');
L7: const fs = require('fs');
High
5L6: const { spawnSync } = require('child_process');
L7: const fs = require('fs');
L8: const https = require('https');
L9: const http = require('http');
...
L14: const DEFAULT_BASE =
L15: process.env.AGP_BASE ||
L16: process.env.OMNIWATCH_API ||
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
index.jsView on unpkg · L55L6: const { spawnSync } = require('child_process');
L7: const fs = require('fs');
L8: const https = require('https');
L9: const http = require('http');
...
L14: const DEFAULT_BASE =
L15: process.env.AGP_BASE ||
L16: process.env.OMNIWATCH_API ||
...
L36: res.on('data', (c) => chunks.push(c));
L37: res.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
L38: })
...
L98: req.on('error', reject);
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
Findings
3 High2 Medium2 Low
HighChild Processindex.js
HighSame File Env Network Executionindex.js
HighSandbox Evasion Gated Capabilityindex.js
MediumNetwork
MediumEnvironment Vars
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to @omniwatch-wick/cli@0.1.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing @omniwatch-wick/cli@0.1.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.