registry / oh-my-codex-pennix / 0.18.63

oh-my-codex-pennix@0.18.63

Multi-agent orchestration layer for OpenAI Codex CLI — Pennix fork

AI Security Review

scanned 3d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The package has powerful CLI and Codex-integration behavior, but inspected risky paths are user-invoked or package-aligned.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

global npm install records stamp; CLI setup/autoresearch/MCP commands activate broader behavior

Impact

Install-time impact limited to install-state metadata; runtime commands can modify project/Codex files when explicitly invoked

Mechanism

Codex orchestration CLI with setup-managed config/hooks and user-invoked subprocess tooling

Rationale

Static inspection found high-risk primitives, but they match the advertised Codex orchestration/tooling purpose and are gated behind global install metadata or explicit CLI/MCP workflows. I did not find concrete credential theft, exfiltration, persistence, destructive install behavior, or unconsented lifecycle mutation of AI-agent control surfaces.

Evidence

package.jsondist/scripts/postinstall.jsdist/cli/update.jsdist/cli/setup.jsdist/cli/hooks.jsdist/autoresearch/runtime.jsdist/mcp/code-intel-server.js$CODEX_HOME/.omx/install-state.json.codex/config.toml.codex/hooks.jsonAGENTS.md.omx/hooks/sample-plugin.mjs.omx/logs/autoresearch/*

Network endpoints2

registry.npmjs.org/oh-my-codex-pennix/latestgithub.com/PennixRv/oh-my-codex.git

Decision evidence

public snapshot

AI called this Clean at 84.0% confidence as Benign with medium false-positive risk.

Evidence for block

package.json has postinstall lifecycle importing dist/scripts/postinstall.js
dist/autoresearch/runtime.js runs git and user-provided evaluator command with shell:true during autoresearch workflow
dist/mcp/code-intel-server.js can invoke npx/grep/ast-grep when MCP tools are called
dist/cli/setup.js writes Codex config, hooks, AGENTS.md, and plugin registration during explicit setup

Evidence against

dist/scripts/postinstall.js only runs for global install and writes install-state metadata, not hooks/config/AGENTS.md
No credential harvesting or exfiltration found in inspected lifecycle and hot files
Network endpoints are package-aligned: npm registry update check and repository metadata
Shell/child_process use is tied to CLI features: git workflows, diagnostics, update, and user-invoked tooling
AI-agent control-surface writes are setup/CLI actions, not unconsented install-time mutation

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 401 file(s), 4.81 MB of source, external domains: api.github.com, api.telegram.org, discord.com, github.com, registry.npmjs.org

Source & flagged code

9 flagged

package.jsonView file

Lines 1-40json

2 "name": "oh-my-codex-pennix",

3 "version": "0.18.63",

4 "description": "Multi-agent orchestration layer for OpenAI Codex CLI — Pennix fork",

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "omx": "dist/cli/omx.js"

9 },

10 "scripts": {

11 "build": "node -e \"const fs=require('fs'); fs.rmSync('dist',{recursive:true,force:true});\" && tsc && node -e \"require('fs').chmodSync('dist/cli/omx.js', 0o755)\"",

12 "build:explore": "cargo build -p omx-explore-harness",

13 "build:full": "npm run build && npm run build:explore:release && npm run build:sparkshell && npm run build:api",

14 "build:explore:release": "node dist/scripts/build-explore-harness.js",

15 "check:no-unused": "tsc -p tsconfig.no-unused.json",

16 "clean:native-package-assets": "node dist/scripts/cleanup-explore-harness.js",

17 "dev": "tsc --watch",

18 "lint": "biome lint src",

19 "prepack": "npm run build && npm run verify:native-agents && npm run sync:plugin && npm run verify:plugin-bundle && npm run clean:native-package-assets",

20 "postinstall": "node -e \"const fs=require('fs');const p='./dist/scripts/postinstall.js';if(fs.existsSync(p))import(p).then(m=>m.main?.()).catch(e=>console.warn('[omx] Postinstall skipped after a non-fatal error: '+(e?.message??e)))\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L20

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

21 "setup": "node dist/cli/omx.js setup",

22 "doctor": "node dist/cli/omx.js doctor",

23 "ask:claude": "./src/scripts/ask-claude.sh",

24 "ask:gemini": "./src/scripts/ask-gemini.sh",

25 "test:explore": "cargo test -p omx-explore-harness && node --test dist/cli/__tests__/explore.test.js dist/hooks/__tests__/explore-routing.test.js dist/hooks/__tests__/explore-sparkshell-guidance-contract.test.js",

26 "test:team:cross-rebase-smoke": "npm run build && npm run test:team:cross-rebase-smoke:compiled",

27 "test:team:cross-rebase-smoke:compiled": "node dist/scripts/run-test-files.js dist/team/__tests__/cross-rebase-smoke.test.js",

28 "test:team:worker-runtime-identity": "npm run build && npm run test:team:worker-runtime-identity:compiled",

29 "test:team:worker-runtime-identity:compiled": "node dist/scripts/run-test-files.js dist/team/__tests__/worker-runtime-identity.test.js",

30 "test:recent-bug-regressions": "npm run build && npm run test:recent-bug-regressions:compiled",

31 "test:recent-bug-regressions:compiled": "node dist/scripts/run-test-files.js dist/hooks/__tests__/keyword-detector.test.js dist/scripts/__tests__/codex-native-hook.test.js dist/cli/__tests__/launch-fallback.test.js dist/team/__tests__/runtime.test.js dist/team/__tests__/hardening-e2e.test.js",

32 "test:plugin-boundaries:compiled": "node dist/scripts/run-test-files.js dist/cli/__tests__/codex-plugin-layout.test.js dist/cli/__tests__/package-bin-contract.test.js dist/cli/__tests__/setup-hooks-shared-ownership.test.js dist/catalog/__tests__/plugin-bundle-ssot.test.js",

33 "test:node": "node dist/scripts/run-test-files.js dist",

34 "test:node:cross-platform": "npm run test:node",

35 "test": "npm run build && npm run verify:native-agents && npm run verify:plugin-bundle && npm run test:node && node dist/scripts/generate-catalog-docs.js --check",

36 "test:ci:compiled": "npm run verify:native-agents && npm run verify:plugin-bundle && npm run test:node && node dist/scripts/generate-catalog-docs.js --check",

37 "coverage:team-critical": "npm run build && npm run coverage:team-critical:compiled",

38 "coverage:team-critical:compiled": "c8 --all --src dist/team --src dist/state --include 'dist/team/**/*.js' --include 'dist/state/**/*.js' --exclude '**/__tests__/**' --reporter=text-summary --reporter=lcov --reporter=json-summary --report-dir coverage/team --check-coverage --lines=78 --functions=90 --branches=70 --statements=78 node dist/scripts/run-test-files.js dist/team/__tests__ dist/state/__tests__",

39 "coverage:team-critical:cross-platform": "npm run coverage:team-critical",

40 "coverage:ts:full": "npm run build && npm run coverage:ts:full:compiled",

dist/autoresearch/runtime.jsView file

Lines 1-21javascript

1import { execFileSync, spawnSync } from 'child_process';

2import { existsSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/autoresearch/runtime.jsView on unpkg · L1

3import { mkdir, readFile, symlink, writeFile } from 'fs/promises';

4import { dirname, join } from 'path';

dist/cli/hooks.jsView file

Lines 20-60javascript

20 if (event.event !== 'turn-complete') return;

22 const current = Number((await sdk.state.read('sample-seen-count')) ?? 0);

23 const next = Number.

dist/cli/index.jsView file

Lines 1-24javascript

1/**

2 * oh-my-codex-pennix CLI

3 * Multi-agent orchestration for OpenAI Codex CLI

4 */

5import { execFileSync, spawn } from "child_process";

6import { basename, dirname, join, posix, resolve, win32 } from "path";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/index.jsView on unpkg · L4

7import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync }

dist/mcp/code-intel-server.jsView file

Lines 526-566javascript

526 symbol,

527 includeDeclaration: effectiveIncludeDeclaration,

528 referenceCount: filteredRefs.length,

529 references: filteredRefs.slice(0, 100),

530 });

531 }

532 catch (err) {

src/scripts/run-autoresearch-showcase.shView file

•path = src/scripts/run-autoresearch-showcase.sh kind = build_helper sizeBytes = 1989 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/scripts/run-autoresearch-showcase.shView on unpkg

dist/cli/doctor.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = oh-my-codex-pennix@0.18.61 matchedIdentity = npm:b2gtbXktY29kZXgtcGVubml4:0.18.61 similarity = 0.967 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/cli/doctor.jsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "const fs=require('fs');const p='./dist/scripts/postinstall.js';if(fs.existsSync(p))import(p).then(m=>m.main?.()).catch(e=>console.warn('[omx] Postinstall skipped after a n...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/autoresearch/runtime.jsView file

1import { execFileSync, spawnSync } from 'child_process'; L2: import { existsSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/autoresearch/runtime.jsView on unpkg · L1

283encoding: 'utf-8', L284: shell: true, L285: maxBuffer: 1024 * 1024,

High

Shell

Package source references shell execution.

dist/autoresearch/runtime.jsView on unpkg · L283

dist/cli/hooks.jsView file

40const moduleUrl = `${pathToFileURL(filePath).href}?t=${Date.now()}`; L41: const mod = await import(moduleUrl); L42: if (typeof mod.onHookEvent !== 'function') {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/hooks.jsView on unpkg · L40

dist/cli/index.jsView file

4*/ L5: import { execFileSync, spawn } from "child_process"; L6: import { basename, dirname, join, posix, resolve, win32 } from "path"; ... L61: export { parseTmuxPaneSnapshot, isHudWatchPane, findHudWatchPaneIds } from "../hud/tmux.js"; L62: rememberOmxLaunchContext({ argv1: process.argv[1], cwd: process.cwd(), env: process.env }); L63: import { classifySpawnError, resolveTmuxBinaryForPlatform, spawnPlatformCommandSync, } from "../utils/platform-command.js"; ... L222: const ALLOWED_SHELLS = new Set([ L223: "/bin/sh", L224: "/bin/bash", ... L521: } L522: export function resolveCodexLaunchPolicy(env = process.env, _platform = process.platform, tmuxAvailable = isTmuxAvailable(), nativeWindows = isNativeWindows(), stdinIsTTY = Boolean... L523: if (explicitPolicy === "direct")

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/index.jsView on unpkg · L4

dist/mcp/code-intel-server.jsView file

546try { L547: const { stdout } = await exec('npx', ['tsc', '--version'], { timeout: 10000 }); L548: checks['typescript'] = { available: true, version: stdout.trim() }; ... L551: process.stderr.write(`[code-intel-server] operation failed: ${err}\n`); L552: checks['typescript'] = { available: false, note: 'Install: npm i -D typescript' }; L553: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/mcp/code-intel-server.jsView on unpkg · L546

src/scripts/run-autoresearch-showcase.shView file

•path = src/scripts/run-autoresearch-showcase.sh kind = build_helper sizeBytes = 1989 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/scripts/run-autoresearch-showcase.shView on unpkg

dist/cli/doctor.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/cli/doctor.jsView on unpkg

Findings

2 Critical4 High6 Medium5 Low

CriticalRed Install Lifecycle Scriptpackage.json

CriticalPrevious Version Dangerous Deltadist/cli/doctor.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/autoresearch/runtime.js

HighShelldist/autoresearch/runtime.js

HighRuntime Package Installdist/mcp/code-intel-server.js

MediumDynamic Requiredist/cli/hooks.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/cli/index.js

MediumShips Build Helpersrc/scripts/run-autoresearch-showcase.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

package.jsonView file

Lines 1-40json

2 "name": "oh-my-codex-pennix",

3 "version": "0.18.63",

4 "description": "Multi-agent orchestration layer for OpenAI Codex CLI — Pennix fork",

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "omx": "dist/cli/omx.js"

9 },

10 "scripts": {

11 "build": "node -e \"const fs=require('fs'); fs.rmSync('dist',{recursive:true,force:true});\" && tsc && node -e \"require('fs').chmodSync('dist/cli/omx.js', 0o755)\"",

12 "build:explore": "cargo build -p omx-explore-harness",

13 "build:full": "npm run build && npm run build:explore:release && npm run build:sparkshell && npm run build:api",

14 "build:explore:release": "node dist/scripts/build-explore-harness.js",

15 "check:no-unused": "tsc -p tsconfig.no-unused.json",

16 "clean:native-package-assets": "node dist/scripts/cleanup-explore-harness.js",

17 "dev": "tsc --watch",

18 "lint": "biome lint src",

19 "prepack": "npm run build && npm run verify:native-agents && npm run sync:plugin && npm run verify:plugin-bundle && npm run clean:native-package-assets",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L20

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

21 "setup": "node dist/cli/omx.js setup",

22 "doctor": "node dist/cli/omx.js doctor",

23 "ask:claude": "./src/scripts/ask-claude.sh",

24 "ask:gemini": "./src/scripts/ask-gemini.sh",

26 "test:team:cross-rebase-smoke": "npm run build && npm run test:team:cross-rebase-smoke:compiled",

27 "test:team:cross-rebase-smoke:compiled": "node dist/scripts/run-test-files.js dist/team/__tests__/cross-rebase-smoke.test.js",

28 "test:team:worker-runtime-identity": "npm run build && npm run test:team:worker-runtime-identity:compiled",

29 "test:team:worker-runtime-identity:compiled": "node dist/scripts/run-test-files.js dist/team/__tests__/worker-runtime-identity.test.js",

30 "test:recent-bug-regressions": "npm run build && npm run test:recent-bug-regressions:compiled",

33 "test:node": "node dist/scripts/run-test-files.js dist",

34 "test:node:cross-platform": "npm run test:node",

35 "test": "npm run build && npm run verify:native-agents && npm run verify:plugin-bundle && npm run test:node && node dist/scripts/generate-catalog-docs.js --check",

36 "test:ci:compiled": "npm run verify:native-agents && npm run verify:plugin-bundle && npm run test:node && node dist/scripts/generate-catalog-docs.js --check",

37 "coverage:team-critical": "npm run build && npm run coverage:team-critical:compiled",

39 "coverage:team-critical:cross-platform": "npm run coverage:team-critical",

40 "coverage:ts:full": "npm run build && npm run coverage:ts:full:compiled",

dist/autoresearch/runtime.jsView file

Lines 1-21javascript

1import { execFileSync, spawnSync } from 'child_process';

2import { existsSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/autoresearch/runtime.jsView on unpkg · L1

3import { mkdir, readFile, symlink, writeFile } from 'fs/promises';

4import { dirname, join } from 'path';

dist/cli/hooks.jsView file

Lines 20-60javascript

20 if (event.event !== 'turn-complete') return;

22 const current = Number((await sdk.state.read('sample-seen-count')) ?? 0);

23 const next = Number.

dist/cli/index.jsView file

Lines 1-24javascript

1/**

2 * oh-my-codex-pennix CLI

3 * Multi-agent orchestration for OpenAI Codex CLI

4 */

5import { execFileSync, spawn } from "child_process";

6import { basename, dirname, join, posix, resolve, win32 } from "path";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/index.jsView on unpkg · L4

7import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync }

dist/mcp/code-intel-server.jsView file

Lines 526-566javascript

526 symbol,

527 includeDeclaration: effectiveIncludeDeclaration,

528 referenceCount: filteredRefs.length,

529 references: filteredRefs.slice(0, 100),

530 });

531 }

532 catch (err) {

src/scripts/run-autoresearch-showcase.shView file

•path = src/scripts/run-autoresearch-showcase.sh kind = build_helper sizeBytes = 1989 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/scripts/run-autoresearch-showcase.shView on unpkg

dist/cli/doctor.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/cli/doctor.jsView on unpkg