Loading npm security reports…
oh-my-claude-sisyphus@5.6.1: AI-agent capability abuse – flagged | LPM Firewall
Flagged as AI-agent capability risk
Allowed by default with warning: agent-facing configuration or capability changes need review before use.
oh-my-claude-sisyphus@5.6.1 Multi-agent orchestration system for Claude Code - Inspired by oh-my-opencode
scanned 1mo ago · by lpm-firewall-ai Source confirms explicit-command mutation of agent hooks and global instructions, warranting a behavior-specific warning. The inspected behavior does not establish a block-eligible attack.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The user runs omc install or omc setup.
Impact
Installed hooks and instructions affect subsequent Claude Code sessions.
Mechanism
The installer merges OMC command hooks into Claude settings and applies bundled instructions to global CLAUDE.md.
AI rationale
Source confirms explicit-command mutation of agent hooks and global instructions, warranting a behavior-specific warning. The inspected behavior does not establish a block-eligible attack.
Evidence
bridge/cli.cjs dist/installer/index.js ~/.claude/ settings.json CLAUDE.md
public snapshot AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
The explicit install CLI command calls the installer with user-selected options. The installer merges executable OMC hook entries and writes the resulting Claude settings.json. The installer updates global CLAUDE.md using instructions bundled in docs/CLAUDE.md. Evidence against
package.json has no preinstall, install, or postinstall hook and no runtime self-dependency. Inspected agent integration hints mostly resolve configuration directories; the test target writes a temporary fixture. The inspected dynamic Function call compiles schema validation code, rather than executing a downloaded response. Behavioral surface
Source ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem Network Shell WebSocket
Supply chain HighEntropyStrings UrlStrings
Manifest
27 flagged 1 import { execFileSync, spawnSync } from 'child_process';
L2: import { existsSync } from 'fs';
High Child Process
Package source references child process execution.
dist/autoresearch/runtime.js View on unpkg · L1 371 encoding: 'utf-8',
L372: shell: true,
L373: maxBuffer: 1024 * 1024,
43 * Constructs the CommanderError class
L44: * @param {number} exitCode suggested exit code which could be used with process.exit
L45: * @param {string} code an id string representing the error
...
L969: var EventEmitter = require("node:events").EventEmitter;
L970: var childProcess = require("node:child_process");
L971: var path28 = require("node:path");
...
L1018: this._outputConfiguration = {
L1019: writeOut: (str) => process3.stdout.write(str),
L1020: writeErr: (str) => process3.stderr.write(str),
...
L1054: * @returns {Command[]}
L1055: * @private
L1056: */
4 Critical 17 High 8 Medium 6 Low
Critical Credential Exfiltration bridge/cli.cjs
Critical Remote Response Code Execution bridge/cli.cjs
Critical Trigger Reachable Dangerous Capability bridge/cli.cjs
Critical Previous Version Dangerous Delta dist/installer/index.js
High Child Process dist/autoresearch/runtime.js
High Shell dist/autoresearch/runtime.js
High Eval bridge/cli.cjs
High Entrypoint Build Divergence bridge/cli.cjs
High Same File Env Network Execution scripts/release-boundary.mjs#virtual:normalized:round1
High Credential Redirect Persistence bridge/cli.cjs
High Command Output Exfiltration bridge/cli.cjs
Affected versions and remediation This report applies to oh-my-claude-sisyphus@5.6.1 .
See all versions of oh-my-claude-sisyphus for other recorded verdicts.
Review the evidence and your use of oh-my-claude-sisyphus@5.6.1 before allowing it. Restrict the permissions described in this report. Choose an independently verified alternative or release. This report does not establish that other versions are safe. Evidence last updated: 2026-10-03 12:04:21.009Z (UTC) .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced .
90% Suspicious
AI assessment confidence
Package metadata npm Author Yeachan Heo
Maintainers bellman_04
Version 5.6.1
Latest on npm 5.7.30
Published Oct 3, 2026
License MIT
Dependencies 12
Integrity verified
Package size 8.42 MB
Files 5,461
Keywords claude claude-code ai agent multi-agent orchestration omc claudecode
No manifest risk signals triggered.
scanned 766 file(s), 13.1 MB of source, external domains: 127.0.0.1, antigravity.google, api.bitbucket.org, api.github.com, api.telegram.org, api.typesafe.ai, build.grok.com, claude.ai, code.claude.com, dart.dev, discord.com, docs.anthropic.com, docs.cursor.com, docs.n8n.io, example.com, flutter.dev, github.com, img.shields.io, in-toto.io, json-schema.org, learn.microsoft.com, raw.githubusercontent.com, registry.npmjs.org, slack.com, slsa-framework.github.io, slsa.dev, swift.org
Oversized source lightweight scan
bridge/cli.cjs 5.00 MB file, sampled 256 KB
Filesystem Network ChildProcess EnvironmentVars Crypto HighEntropyStrings UrlStrings github.com learn.microsoft.com
Critical Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
bridge/cli.cjs View on unpkg · L43 43 * Constructs the CommanderError class
L44: * @param {number} exitCode suggested exit code which could be used with process.exit
L45: * @param {string} code an id string representing the error
...
L969: var EventEmitter = require("node:events").EventEmitter;
L970: var childProcess = require("node:child_process");
L971: var path28 = require("node:path");
...
L1018: this._outputConfiguration = {
L1019: writeOut: (str) => process3.stdout.write(str),
L1020: writeErr: (str) => process3.stderr.write(str),
...
L1054: * @returns {Command[]}
L1055: * @private
L1056: */
Critical Remote Response Code Execution
Source passes code obtained from a remote response into a dynamic execution sink.
bridge/cli.cjs View on unpkg · L43 43 Trigger-reachable chain: manifest.bin -> bridge/cli.cjs
L43: * Constructs the CommanderError class
L44: * @param {number} exitCode suggested exit code which could be used with process.exit
L45: * @param {string} code an id string representing the error
...
L969: var EventEmitter = require("node:events").EventEmitter;
L970: var childProcess = require("node:child_process");
L971: var path28 = require("node:path");
...
L1018: this._outputConfiguration = {
L1019: writeOut: (str) => process3.stdout.write(str),
L1020: writeErr: (str) => process3.stderr.write(str),
...
L1054: * @returns {Command[]}
L1055: * @private
L1056: */
Critical Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
bridge/cli.cjs View on unpkg · L43 12496 sourceCode = this.opts.code.process(sourceCode, sch);
L12497: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
L12498: const validate = makeValidate(this, this.scope.get());
43 Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network
L43: * Constructs the CommanderError class
L44: * @param {number} exitCode suggested exit code which could be used with process.exit
L45: * @param {string} code an id string representing the error
...
L969: var EventEmitter = require("node:events").EventEmitter;
L970: var childProcess = require("node:child_process");
L971: var path28 = require("node:path");
...
L1018: this._outputConfiguration = {
L1019: writeOut: (str) => process3.stdout.write(str),
L1020: writeErr: (str) => process3.stderr.write(str),
...
L1054: * @returns {Command[]}
L1055: * @private
L1056: */
High Entrypoint Build Divergence
Manifest entrypoint contains risky behavior absent from dist/build output.
bridge/cli.cjs View on unpkg · L43 • Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
bridge/cli.cjs:
const configured = process.env.CLAUDE_CONFIG_DIR?.trim();
return stripTrailingSep((0, import_path.normalize)((0, import_path.join)(home, ".claude")));
function validateAnthropicBaseUrl(urlString) {
if (/^((us|eu|ap|global)\.anthropic\.|anthropic\.claude)/i.test(modelId)) {
if (process.env.CLAUDE_CODE_USE_BEDROCK === "1") {
if (/^((us|eu|ap|global)\.anthropic\.|anthropic\.claude)/i.test(modelId)) {
if (process.env.CLAUDE_CODE_USE_VERTEX === "1") {
if (process.env.CLAUDE_CODE_USE_BEDROCK === "1") {
High Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
bridge/cli.cjs View on unpkg 43 * Constructs the CommanderError class
L44: * @param {number} exitCode suggested exit code which could be used with process.exit
L45: * @param {string} code an id string representing the error
...
L969: var EventEmitter = require("node:events").EventEmitter;
L970: var childProcess = require("node:child_process");
L971: var path28 = require("node:path");
...
L1018: this._outputConfiguration = {
L1019: writeOut: (str) => process3.stdout.write(str),
L1020: writeErr: (str) => process3.stderr.write(str),
...
L1054: * @returns {Command[]}
L1055: * @private
L1056: */
High Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
bridge/cli.cjs View on unpkg · L43 43 * Constructs the CommanderError class
L44: * @param {number} exitCode suggested exit code which could be used with process.exit
L45: * @param {string} code an id string representing the error
...
L969: var EventEmitter = require("node:events").EventEmitter;
L970: var childProcess = require("node:child_process");
L971: var path28 = require("node:path");
...
L1018: this._outputConfiguration = {
L1019: writeOut: (str) => process3.stdout.write(str),
L1020: writeErr: (str) => process3.stderr.write(str),
...
L1054: * @returns {Command[]}
L1055: * @private
L1056: */
High Hidden Inline Dependency Execution
Source silently spawns a Node process to execute an inline dependency payload.
bridge/cli.cjs View on unpkg · L43 103580 package = oh-my-claude-sisyphus; repositoryIdentity = oh-my-claudecode; dependency = @ast-grep/napi
L103580: try {
L103581: sgModule = await import("@ast-grep/napi");
L103582: } catch (error2) {
High Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
bridge/cli.cjs View on unpkg · L103580 • Runtime or CLI code links a write operation to an explicit external AI-agent control path:
if (!(0, import_fs127.existssync)(source)) return null;
const bundled = (0, import_fs127.readfilesync)(source, "utf8");
if ((0, import_fs127.existssync)(target)) {
const status = (0, import_fs127.readfilesync)(target, "utf8") === bundled ? "present" : "diverged";
return { status, path: target };
}
(0, import_fs127.mkdirsync)((0, import_path153.join)(directory, ".claude", "skills", "ralph"), { recursive: true });
(0, import_fs127.copyfilesync)(source, target);
return { status: "created", path: target };
}
function ralphcommand(program3) {
const cmd = program3.command("ralph").description("ralph persistence loop launchers and feedback verification");
cmd.command("afk").descripti
High External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
bridge/cli.cjs View on unpkg 43 Trigger-reachable credential exfiltration chain: manifest.bin -> bridge/cli.cjs
L43: * Constructs the CommanderError class
L44: * @param {number} exitCode suggested exit code which could be used with process.exit
L45: * @param {string} code an id string representing the error
...
L969: var EventEmitter = require("node:events").EventEmitter;
L970: var childProcess = require("node:child_process");
L971: var path28 = require("node:path");
...
L1018: this._outputConfiguration = {
L1019: writeOut: (str) => process3.stdout.write(str),
L1020: writeErr: (str) => process3.stderr.write(str),
...
L1054: * @returns {Command[]}
L1055: * @private
L1056: */
High Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
bridge/cli.cjs View on unpkg · L43 • stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 16
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
bridge/cli.cjs View on unpkg • path = bridge/cli.cjs
kind = oversized_source_file
sizeBytes = 5247425
magicHex = [redacted]
Medium Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
bridge/cli.cjs View on unpkg • path = bridge/cli.cjs
kind = oversized_cli_entrypoint
sizeBytes = 5247425
magicHex = [redacted]
Medium Oversized Cli Entrypoint
Package contains an oversized executable-looking CLI entrypoint.
bridge/cli.cjs View on unpkg 18 //
L19: // IMPORTANT: Uses createRequire() (CJS resolution) instead of dynamic import() (ESM resolution)
L20: // because ESM resolution does NOT respect NODE_PATH or Module._initPaths().
Medium Dynamic Require
Package source references dynamic require/import behavior.
dist/tools/ast-tools.js View on unpkg · L18 54 try {
L55: const parsed = JSON.parse(readFileSync(statePath, "utf-8"));
L56: return {
Low Weak Crypto
Package source references weak cryptographic algorithms.
dist/openclaw/dedupe.js View on unpkg · L54 15 import { Command } from 'commander';
L16: import { spawnSync } from 'child_process';
L17: import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
...
L31: const TASK_NAME = 'OMC Intake';
L32: const CRONTAB_MARKER = '# omc-intake';
L33: const LOCK_STALE_MS = 2 * 3600_000;
...
L42: input: options.input,
L43: env: options.env ? { ...process.env, ...options.env } : process.env,
L44: });
L45: return { status: result.status ?? null, stdout: result.stdout ?? '', stderr: result.stderr ?? '' };
L46: };
...
L62: try {
Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/cli/commands/intake.js View on unpkg · L15 scripts/release-boundary.mjs#virtual:normalized:round1 View file 544 : "";
L545: const propertyIndent = packageJsonText.match(/(?:\r?\n)([ \t]+)"(?:[^"\\]|\\.)+"s*:/)?.[1] ?? `${closeIndent} `;\n const hasProperties = Object.keys(parsed).length > 0;\n const ...
L546: cliMain().catch(error => {
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
scripts/release-boundary.mjs#virtual:normalized:round1 View on unpkg · L544 6 */
L7: import { spawnSync } from 'child_process';
L8: import { existsSync, readFileSync } from 'fs';
...
L20: const workspaceRoot = dirname(packageNodeModules);
L21: const executable = process.platform === 'win32' ? 'tsc.cmd' : 'tsc';
L22: return join(workspaceRoot, 'node_modules', '.bin', executable);
...
L26: while (true) {
L27: const packageJsonPath = join(dir, 'node_modules', 'typescript', 'package.json');
L28: if (existsSync(packageJsonPath)) {
...
L39: try {
L40: const packageJson = JSON.parse(readFileSync(join(packageRoot, 'package.json'), 'utf8'));
L41: if (typeof packageJson.version !== 'string') {
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/tools/lsp/servers.js View on unpkg · L6 41 function getClaudeConfigDir() {
L42: const home = (0, import_os.homedir)();
L43: const configured = process.env.CLAUDE_CONFIG_DIR?.trim();
L44: if (!configured) {
...
L121: if (!raw) return {};
L122: const parsed = JSON.parse(raw);
L123: if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
...
L132: if (!error || typeof error !== "object") return false;
L133: const { status, stderr } = error;
L134: if (status !== 128) return false;
...
L154: try {
L155: superRoot = (0, import_child_process.execFileSync)("git", ["rev-parse", "--show-superproject-working-tree"], {
High Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
bridge/runtime-cli.cjs View on unpkg · L41 41 Cross-file remote execution chain: bridge/runtime-cli.cjs spawns bridge/cli.cjs; helper contains network access plus dynamic code execution.
L41: function getClaudeConfigDir() {
L42: const home = (0, import_os.homedir)();
L43: const configured = process.env.CLAUDE_CONFIG_DIR?.trim();
L44: if (!configured) {
...
L121: if (!raw) return {};
L122: const parsed = JSON.parse(raw);
L123: if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
...
L132: if (!error || typeof error !== "object") return false;
L133: const { status, stderr } = error;
L134: if (status !== 128) return false;
...
L154: try {
L155: superRoot = (0, import_child_process.execFileSync)("git", ["rev-parse", "--show-superproject-working-tree"], {
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
bridge/runtime-cli.cjs View on unpkg · L41 41 if (process.platform === 'win32') {
L42: execSync(`npm install -g ${packageSpec}`, npmExecOptions(verbose));
L43: return;
High Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/features/auto-update.js View on unpkg · L41 • path = bridge/run-mcp-server.sh
kind = build_helper
sizeBytes = 445
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
bridge/run-mcp-server.sh View on unpkg skills/project-session-manager/tests/test-jira-provider.sh View file • path = skills/project-session-manager/tests/test-jira-provider.sh
kind = payload_in_excluded_dir
sizeBytes = 6381
magicHex = [redacted]
High Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
skills/project-session-manager/tests/test-jira-provider.sh View on unpkg • matchType = previous_version_dangerous_delta
matchedPackage = oh-my-claude-sisyphus@5.6.0
matchedIdentity = npm:b2gtbXktY2xhdWRlLXNpc3lwaHVz:5.6.0
similarity = 0.842
summary = stored previous version shares package body but lacks this dangerous source file
Critical Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/installer/index.js View on unpkg High
Hidden Inline Dependency Execution
bridge/cli.cjs
High Sandbox Evasion Gated Capability dist/tools/lsp/servers.js
High Cloud Metadata Access bridge/runtime-cli.cjs
High Copied Package Dependency Bridge bridge/cli.cjs
High External Ai Agent Control Surface Mutation bridge/cli.cjs
High Cross File Remote Execution Context bridge/runtime-cli.cjs
High Trigger Reachable Credential Exfiltration bridge/cli.cjs
High Runtime Package Install dist/features/auto-update.js
High Payload In Excluded Dir skills/project-session-manager/tests/test-jira-provider.sh
High Semantic Analysis Limited bridge/cli.cjs
Medium Dynamic Require dist/tools/ast-tools.js
Medium Install Persistence dist/cli/commands/intake.js
Medium Ships Build Helper bridge/run-mcp-server.sh
Medium Oversized Source File bridge/cli.cjs
Medium Oversized Cli Entrypoint bridge/cli.cjs
Medium Structural Risk Force Deep Review
Low Non Install Lifecycle Scripts
Low Weak Crypto dist/openclaw/dedupe.js
Runtime surface package.json Entrypoints main → dist/index.js types → dist/index.d.ts exports map bin → oh-my-claudecode, omc, omc-cli
Runtime node 20.x || 22.x || 23.x || 24.x || 25.x || 26.x
Artifact 44.2 MB · 5,461 files 2 signature(s) · provenance
Install lifecycle prepublishOnly
Behavioral surface ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem Network Shell WebSocket HighEntropyStrings UrlStrings Manifest: clean