registry / AI-agent capability abuse / openchamber-sogawugu / 1.21.1

openchamber-sogawugu@1.21.1

[![GitHub stars](https://img.shields.io/github/stars/openchamber/openchamber?style=flat&logo=data%3Aimage%2Fsvg%2Bxml%3Bbase64%2CPHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgZmlsbD0iI2YxZWNlYyIgdmlld0JveD0iMCAwIDI1Ni

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is a suspicious, impersonation-like package with high-impact runtime agent-control features, but the observed writes require explicit runtime actions and there is no install hook. The evidence supports a warning rather than a publication block.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

A user starts the CLI service and submits a skill request, or runs `openchamber startup enable`.

Impact

Arbitrary skill instructions can affect future agent behavior, and persisted environment values may include provider credentials.

Mechanism

Runtime agent-skill mutation and user-requested login persistence.

AI rationale

Evidence

package.jsonserver/lib/opencode/skill-routes.jsserver/lib/opencode/skills.jsbin/lib/cli-startup.jsbin/lib/commands-startup.js~/.agents/skills/<skill>/SKILL.md<project>/.agents/skills/<skill>/SKILL.md<OpenChamber data directory>/startup.env~/.config/systemd/user/openchamber.service

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

The package uses an unrelated suffixed name while exposing the `openchamber` command.
Its running HTTP service accepts skill content and creates agent skills in user or project agent directories.
The optional startup command snapshots most environment variables and writes a login service, preserving credentials for later execution.

Evidence against

The manifest has no preinstall, install, or postinstall hook.
The persistence path requires the explicit `openchamber startup enable` command.
No source inspected showed automatic secret exfiltration or a remote payload executed during installation.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Source & flagged code

11 flagged

bin/cli.test.jsView file

6import net from 'net'; L7: import { spawn } from 'child_process'; L8: import { pathToFileURL } from 'url';

High

Child Process

Package source references child process execution.

bin/cli.test.jsView on unpkg · L6

bin/lib/cli-startup.jsView file

52L53: function powershellQuote(value) { L54: return `'${String(value).replace(/'/g, "''")}'`;

High

Shell

Package source references shell execution.

bin/lib/cli-startup.jsView on unpkg · L52

3Trigger-reachable persistence chain: scripts.start -> bin/cli.js -> bin/lib/commands-startup.js -> bin/lib/cli-startup.js L3: import path from 'path'; L4: import { spawnSync } from 'child_process'; L5: import { DEFAULT_PORT } from './cli-args.js'; ... L13: function getStartupServicePaths() { L14: if (process.platform === 'darwin') { L15: return { L16: platform: 'macos', L17: servicePath: path.join(os.homedir(), 'Library', 'LaunchAgents', `${STARTUP_SERVICE_ID}.plist`), L18: }; ... L78: const env = options.envSnapshot === false ? {} : Object.fromEntries( L79: Object.entries(process.env) L80: .filter(([key, value]) => shouldPersistStartupEnv(key, value))

Findings

7 High5 Medium8 Low

HighChild Processbin/cli.test.js

HighShellbin/lib/cli-startup.js

HighSame File Env Network Executionserver/lib/opencode/lifecycle.js

HighSandbox Evasion Gated Capabilityserver/lib/cloudflare-tunnel.js

HighTrigger Reachable Persistencebin/lib/cli-startup.js

HighSemantic Analysis Limiteddist/assets/useAppFontEffects-D6RzH9Ex.js

HighKnown Malware Source Similaritydist/assets/sql-D0XecflT.js

MediumDynamic Requirebin/lib/commands-serve.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencebin/lib/cli-startup.js

MediumStructural Risk Force Deep Review

Low

Affected versions and remediation

This report applies to openchamber-sogawugu@1.21.1.

See all versions of openchamber-sogawugu for other recorded verdicts.

Review the evidence and your use of openchamber-sogawugu@1.21.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-29 09:51:04.545Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / AI-agent capability abuse / openchamber-sogawugu / 1.21.1

openchamber-sogawugu@1.21.1

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

A user starts the CLI service and submits a skill request, or runs `openchamber startup enable`.

Impact

Arbitrary skill instructions can affect future agent behavior, and persisted environment values may include provider credentials.

Mechanism

Runtime agent-skill mutation and user-requested login persistence.

AI rationale

Evidence

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

The package uses an unrelated suffixed name while exposing the `openchamber` command.
Its running HTTP service accepts skill content and creates agent skills in user or project agent directories.
The optional startup command snapshots most environment variables and writes a login service, preserving credentials for later execution.

Evidence against

The manifest has no preinstall, install, or postinstall hook.
The persistence path requires the explicit `openchamber startup enable` command.
No source inspected showed automatic secret exfiltration or a remote payload executed during installation.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Source & flagged code

11 flagged

bin/cli.test.jsView file

6import net from 'net'; L7: import { spawn } from 'child_process'; L8: import { pathToFileURL } from 'url';

High

Child Process

Package source references child process execution.

bin/cli.test.jsView on unpkg · L6

bin/lib/cli-startup.jsView file

52L53: function powershellQuote(value) { L54: return `'${String(value).replace(/'/g, "''")}'`;

High

Shell

Package source references shell execution.

bin/lib/cli-startup.jsView on unpkg · L52

Findings

7 High5 Medium8 Low

HighChild Processbin/cli.test.js

HighShellbin/lib/cli-startup.js

HighSame File Env Network Executionserver/lib/opencode/lifecycle.js

HighSandbox Evasion Gated Capabilityserver/lib/cloudflare-tunnel.js

HighTrigger Reachable Persistencebin/lib/cli-startup.js

HighSemantic Analysis Limiteddist/assets/useAppFontEffects-D6RzH9Ex.js

HighKnown Malware Source Similaritydist/assets/sql-D0XecflT.js

MediumDynamic Requirebin/lib/commands-serve.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencebin/lib/cli-startup.js

MediumStructural Risk Force Deep Review

Low

Affected versions and remediation

This report applies to openchamber-sogawugu@1.21.1.

See all versions of openchamber-sogawugu for other recorded verdicts.

Review the evidence and your use of openchamber-sogawugu@1.21.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-29 09:51:04.545Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.