registry / oh-my-claude-sisyphus / 5.7.5
oh-my-claude-sisyphus@5.7.5
⚠ Under reviewMulti-agent orchestration system for Claude Code - Inspired by oh-my-opencode
AI Security Review
scanned 18d ago · by lpm-firewall-aiInspected sources show an optional local native build and a silent updater disabled by default; the flagged dynamic code generation is validator compilation. Manual review is required because clean verdict citation coverage requires 137 paths, above the 128-citation limit.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
npm installation invokes the postinstall hook; a later agent session starts the updater check.
Impact
No attack impact was established in the inspected paths.
Mechanism
The install hook conditionally compiles a local native addon on macOS. The updater checks saved configuration before silently installing the latest package.
AI rationale
Inspected sources show an optional local native build and a silent updater disabled by default; the flagged dynamic code generation is validator compilation. Manual review is required because clean verdict citation coverage requires 137 paths, above the 128-citation limit.
Evidence
package.jsonscripts/postinstall-contained-fs.mjsdist/features/auto-update.jsdist/hooks/bridge.js
Decision evidence
public snapshotAI called this Manual Review at 58.0% confidence as Unknown with high false-positive risk.
AI review observations
- The npm postinstall runs a helper that skips non-macOS systems and builds only an optional local native addon.
- The session-start hook invokes the silent updater, but the updater defaults to disabled unless its configuration enables it.
- The flagged dynamic function construction builds a validator from generated schema code.
Evidence against
- When enabled, the updater can silently install the latest package from a session-start hook.
- Clean verdict citation coverage requires 137 distinct paths, exceeding the 128-citation limit.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
25 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall-contained-fs.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/autoresearch/runtime.jsView file
1import { execFileSync, spawnSync } from 'child_process';
L2: import { existsSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/autoresearch/runtime.jsView on unpkg · L1371encoding: 'utf-8',
L372: shell: true,
L373: maxBuffer: 1024 * 1024,
High
Findings
2 Critical17 High8 Medium6 Low
CriticalRemote Response Code Executionbridge/cli.cjs
CriticalPrevious Version Dangerous Deltadist/features/auto-update.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/autoresearch/runtime.js
HighShelldist/autoresearch/runtime.js
HighEvalbridge/cli.cjs
HighEntrypoint Build Divergencebridge/cli.cjs
HighSame File Env Network Executionscripts/release-boundary.mjs#virtual:normalized:round1
HighCredential Redirect Persistencebridge/cli.cjs
HighCommand Output Exfiltrationbridge/cli.cjs
HighHidden Inline Dependency Executionbridge/cli.cjs
Affected versions and remediation
This report applies to oh-my-claude-sisyphus@5.7.5.
See all versions of oh-my-claude-sisyphus for other recorded verdicts.
- Review the evidence and your use of oh-my-claude-sisyphus@5.7.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.