registry / @omp-studio/omps / 0.1.15

@omp-studio/omps@0.1.15

OMP Studio agent (omps): open, sync and version Grenton .omp projects in the hosted editor

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 19 file(s), 153 KB of source, external domains: 127.0.0.1, git-scm.com, github.com, omp-studio.coderai.dev, registry.npmjs.org

Source & flagged code

2 flagged

dist/macsetup.jsView file

Lines 1-33javascript

1/**

2 * macOS integration: `omps setup-macos` builds a tiny AppleScript droplet app

3 * at ~/Applications/OMP Studio.app whose Info.plist declares the .omp document

4 * type — that (and only that) is what makes "Open With > OMP Studio" appear in

5 * Finder; a plain CLI can never show up there. Opening a file through it

6 * launches Terminal running `omps open <file>` (the agent must stay in a

7 * terminal, exactly like the Windows context-menu entry).

8 *

9 * The droplet bakes in absolute paths to the current Node binary and this

10 * package's entry point, so it works for both `npm -g` and npx-cached

11 * installs. The app is generated locally by osacompile (present on every

12 * Mac), so it carries no quarantine attribute and Gatekeeper leaves it alone.

13 */

14import { spawnSync } from "node:child_process";

15import { mkdir, rm, writeFile } from "node:fs/promises";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/macsetup.jsView on unpkg · L13

16import os from "node:os";

17import path from "node:path";

18import { fileURLToPath } from "node:url";

19const APP_NAME = "OMP Studio.app";

20const LSREGISTER = "/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";

21/** POSIX-shell single-quote. */

22export function shQuote(s) {

23 return `'${s.replace(/'/g, "'\\''")}'`;

24}

25/** Escape a string for embedding in an AppleScript double-quoted literal. */

26export function asEscape(s) {

27 return s.replace(/\\/g, "\\\\").replace(/"/g, '\\"');

28}

29/** AppleScript droplet source: each dropped .omp gets its own Terminal window running the agent. */

30export function dropletSource(nodePath, ompsJsPath) {

31 const cmd = asEscape(`${shQuote(nodePath)} ${shQuote(ompsJsPath)} open `);

32 return [

33 "-- Generated by `omps setup-macos` - do not edit (re-run the command instead).",

dist/cloud.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @omp-studio/omps@0.1.14 matchedIdentity = npm:QG9tcC1zdHVkaW8vb21wcw:0.1.14 similarity = 0.895 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cloud.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/macsetup.jsView file

13*/ L14: import { spawnSync } from "node:child_process"; L15: import { mkdir, rm, writeFile } from "node:fs/promises"; ... L53: "on run", L54: '\topen location "https://omp-studio.coderai.dev"', L55: "end run", ... L63: if (r.status !== 0) L64: throw new Error(`${what} failed (exit code ${String(r.status)})`); L65: } ... L73: function appPath() { L74: return path.join(os.homedir(), "Applications", APP_NAME); L75: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/macsetup.jsView on unpkg · L13

dist/cloud.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cloud.jsView on unpkg

Findings

2 High3 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/macsetup.js

HighPrevious Version Dangerous Deltadist/cloud.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/macsetup.jsView file

Lines 1-33javascript

1/**

2 * macOS integration: `omps setup-macos` builds a tiny AppleScript droplet app

3 * at ~/Applications/OMP Studio.app whose Info.plist declares the .omp document

4 * type — that (and only that) is what makes "Open With > OMP Studio" appear in

5 * Finder; a plain CLI can never show up there. Opening a file through it

6 * launches Terminal running `omps open <file>` (the agent must stay in a

7 * terminal, exactly like the Windows context-menu entry).

8 *

9 * The droplet bakes in absolute paths to the current Node binary and this

10 * package's entry point, so it works for both `npm -g` and npx-cached

11 * installs. The app is generated locally by osacompile (present on every

12 * Mac), so it carries no quarantine attribute and Gatekeeper leaves it alone.

13 */

14import { spawnSync } from "node:child_process";

15import { mkdir, rm, writeFile } from "node:fs/promises";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/macsetup.jsView on unpkg · L13

16import os from "node:os";

17import path from "node:path";

18import { fileURLToPath } from "node:url";

19const APP_NAME = "OMP Studio.app";

20const LSREGISTER = "/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";

21/** POSIX-shell single-quote. */

22export function shQuote(s) {

23 return `'${s.replace(/'/g, "'\\''")}'`;

24}

25/** Escape a string for embedding in an AppleScript double-quoted literal. */

26export function asEscape(s) {

27 return s.replace(/\\/g, "\\\\").replace(/"/g, '\\"');

28}

29/** AppleScript droplet source: each dropped .omp gets its own Terminal window running the agent. */

30export function dropletSource(nodePath, ompsJsPath) {

31 const cmd = asEscape(`${shQuote(nodePath)} ${shQuote(ompsJsPath)} open `);

32 return [

33 "-- Generated by `omps setup-macos` - do not edit (re-run the command instead).",

dist/cloud.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cloud.jsView on unpkg