registry / oh-my-claude-sisyphus / 5.7.2
oh-my-claude-sisyphus@5.7.2
Multi-agent orchestration system for Claude Code - Inspired by oh-my-opencode
AI Security Review
scanned 22d ago · by lpm-firewall-aiSource inspection confirms an opt-in background update of the package's own agent integration, which warrants a warning under the guarded extension lifecycle policy. The install hook and credential-related service path did not establish a separate attack.
Static reason
One or more suspicious static signals were detected.
Trigger
A Claude session starts while the user has enabled silent auto-updates.
Impact
A later release can replace the installed package and refresh its Claude integration without a separate prompt for that release.
Mechanism
The hook checks the project's GitHub releases, installs the latest release of this package through npm, and refreshes its own plugin installation.
AI rationale
Source inspection confirms an opt-in background update of the package's own agent integration, which warrants a warning under the guarded extension lifecycle policy. The install hook and credential-related service path did not establish a separate attack.
Evidence
dist/features/auto-update.jsdist/hooks/bridge.js
Network endpoints1
api.github.com/repos/Yeachan-Heo/oh-my-claudecode
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest's postinstall hook calls a package script that skips non-macOS systems and handles an optional native build.
- The session-start hook launches silent updates, but the setting defaults off and the updater stops unless it is enabled.
- When enabled, the updater checks the project's GitHub releases, installs the latest release of this same package, and updates first-party plugin installation metadata.
- The separate judgment-service request uses a dedicated service key, sends state and questions to its configured endpoint, and validates the response structure.
Evidence against
- The install hook does not show unconsented mutation of a foreign agent configuration or consumer install-script approvals.
- The judgment-service path is gated by its own key and checks response structure; it does not establish arbitrary remote code execution or disclosure of Anthropic credentials.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEval
Source & flagged code
24 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall-contained-fs.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/autoresearch/runtime.jsView file
1import { execFileSync, spawnSync } from 'child_process';
L2: import { existsSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/autoresearch/runtime.jsView on unpkg · L1371encoding: 'utf-8',
L372: shell: true,
L373: maxBuffer: 1024 * 1024,
High
Findings
1 Critical17 High8 Medium6 Low
CriticalRemote Response Code Executionbridge/cli.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/autoresearch/runtime.js
HighShelldist/autoresearch/runtime.js
HighEvalbridge/cli.cjs
HighEntrypoint Build Divergencebridge/cli.cjs
HighSame File Env Network Executionscripts/release-boundary.mjs#virtual:normalized:round1
HighCredential Redirect Persistencebridge/cli.cjs
HighCommand Output Exfiltrationbridge/cli.cjs
HighHidden Inline Dependency Executionbridge/cli.cjs
HighSandbox Evasion Gated Capabilitydist/tools/lsp/servers.js
Affected versions and remediation
This report applies to oh-my-claude-sisyphus@5.7.2.
See all versions of oh-my-claude-sisyphus for other recorded verdicts.
- Review the evidence and your use of oh-my-claude-sisyphus@5.7.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.