registry / oh-my-claude-sisyphus / 5.2.0
oh-my-claude-sisyphus@5.2.0
Multi-agent orchestration system for Claude Code - Inspired by oh-my-opencode
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo malicious install hook, credential theft, or remote-code execution chain was confirmed. The automatic global self-update and Claude extension reconciliation justify a warning for lifecycle risk.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs the CLI with silent updates enabled, or invokes the update command.
Impact
A later package release can be installed and extension state refreshed without a new manual npm install.
Mechanism
Runtime self-update through GitHub release checks and global npm installation.
AI rationale
No malicious install hook, credential theft, or remote-code execution chain was confirmed. The automatic global self-update and Claude extension reconciliation justify a warning for lifecycle risk.
Evidence
bridge/cli.cjsdist/features/auto-update.js~/.claude/.omc-update.log~/.claude/plugins/installed_plugins.json
Network endpoints2
api.github.comraw.githubusercontent.com
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The shipped CLI contains a silent-update path that defaults to applying updates and installs the latest package globally.
- The package has broad user-invoked command, worktree, language-server, and worker-launch capabilities.
- This is a first-party Claude Code extension update mechanism, but automatic runtime replacement remains a supply-chain risk.
Evidence against
- package.json has only a prepublishOnly hook, not an install-time lifecycle hook.
- No source evidence showed credential collection or transmission to an unrelated endpoint.
- The update path is gated by a configuration setting and the explicit update command is user-invoked.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket
HighEntropyStrings
Source & flagged code
25 flaggeddist/autoresearch/runtime.jsView file
1import { execFileSync, spawnSync } from 'child_process';
L2: import { existsSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/autoresearch/runtime.jsView on unpkg · L1371encoding: 'utf-8',
L372: shell: true,
L373: maxBuffer: 1024 * 1024,
High
bridge/cli.cjsView file
43* Constructs the CommanderError class
L44: * @param {number} exitCode suggested exit code which could be used with process.exit
L45: * @param {string} code an id string representing the error
...
L969: var EventEmitter = require("node:events").EventEmitter;
L970: var childProcess = require("node:child_process");
L971: var path27 = require("node:path");
...
L1018: this._outputConfiguration = {
L1019: writeOut: (str) => process3.stdout.write(str),
L1020: writeErr: (str) => process3.stderr.write(str),
...
L1054: * @returns {Command[]}
L1055: * @private
L1056: */
Findings
4 Critical16 High7 Medium6 Low
CriticalCredential Exfiltrationbridge/cli.cjs
CriticalRemote Response Code Executionbridge/cli.cjs
CriticalTrigger Reachable Dangerous Capabilitybridge/cli.cjs
CriticalPrevious Version Dangerous Deltadist/team/worker-launch-ack.js
HighChild Processdist/autoresearch/runtime.js
HighShelldist/autoresearch/runtime.js
HighEvalbridge/cli.cjs
HighEntrypoint Build Divergencebridge/cli.cjs
HighSame File Env Network Executionscripts/release-boundary.mjs#virtual:normalized:round1
HighCredential Redirect Persistencebridge/cli.cjs
HighCommand Output Exfiltrationbridge/cli.cjs
Affected versions and remediation
This report applies to oh-my-claude-sisyphus@5.2.0.
See all versions of oh-my-claude-sisyphus for other recorded verdicts.
- Review the evidence and your use of oh-my-claude-sisyphus@5.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.