registry / oh-my-claude-sisyphus / 4.15.6
oh-my-claude-sisyphus@4.15.6
Multi-agent orchestration system for Claude Code - Inspired by oh-my-opencode
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection contradicts the malicious scanner label: there is no npm install lifecycle execution and silent updating is opt-in. The package nevertheless has a meaningful Claude extension lifecycle and unattended update capability, so it warrants a warning.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User-installed OMC hook runs at Claude session start with silentAutoUpdate enabled.
Impact
Update supply-chain and first-party Claude extension lifecycle risk; no concrete malicious behavior established.
Mechanism
Opt-in background GitHub release check, npm global update, and OMC plugin reconciliation.
AI rationale
Source inspection contradicts the malicious scanner label: there is no npm install lifecycle execution and silent updating is opt-in. The package nevertheless has a meaningful Claude extension lifecycle and unattended update capability, so it warrants a warning.
Evidence
package.jsondist/features/auto-update.jsdist/hooks/bridge.jsdist/installer/index.jsdist/tools/ast-tools.js
Network endpoints2
api.github.com/repos/Yeachan-Heo/oh-my-claudecoderaw.githubusercontent.com/Yeachan-Heo/oh-my-claudecode
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/hooks/bridge.js invokes silent-update initialization on Claude session start.
- dist/features/auto-update.js can fetch releases and run npm global install after explicit opt-in.
- dist/installer/index.js manages OMC-owned Claude hooks and plugin payloads.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- Silent updates default disabled when config is absent or invalid.
- Update endpoints are the declared GitHub repository; no credential harvesting or exfiltration found.
- Dynamic require loads declared @ast-grep/napi; bundled eval is AJV schema generation.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
14 flaggeddist/autoresearch/runtime.jsView file
1import { execFileSync, spawnSync } from 'child_process';
L2: import { existsSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/autoresearch/runtime.jsView on unpkg · L1371encoding: 'utf-8',
L372: shell: true,
L373: maxBuffer: 1024 * 1024,
High
bridge/mcp-server.cjsView file
2955sourceCode = this.opts.code.process(sourceCode, sch);
L2956: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
L2957: const validate = makeValidate(this, this.scope.get());
Low
Eval
Package source references a known benign dynamic code generation pattern.
Findings
1 Critical7 High7 Medium7 Low
CriticalPrevious Version Dangerous Deltadist/features/auto-update.js
HighChild Processdist/autoresearch/runtime.js
HighShelldist/autoresearch/runtime.js
HighSandbox Evasion Gated Capabilitydist/tools/lsp/servers.js
HighCloud Metadata Accessbridge/runtime-cli.cjs
HighRuntime Package Installdist/features/auto-update.js
HighPayload In Excluded Dirskills/project-session-manager/tests/test-psm-prompt-injection.sh
HighOversized Source Filebridge/cli.cjs
MediumDynamic Requiredist/tools/ast-tools.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/team/tmux-session.js
Affected versions and remediation
This report applies to oh-my-claude-sisyphus@4.15.6.
See all versions of oh-my-claude-sisyphus for other recorded verdicts.
- Review the evidence and your use of oh-my-claude-sisyphus@4.15.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.