registry / oh-my-codex-pennix / 0.18.71

oh-my-codex-pennix@0.18.71

Multi-agent orchestration layer for OpenAI Codex CLI — Pennix fork

AI Security Review

scanned 17h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No confirmed malicious install-time attack surface was found. The package is an agent/Codex extension bundle with lifecycle state stamping and user-invoked setup that can install package-aligned Codex skills, hooks, config, and plugin cache.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

global npm install for stamp; explicit omx setup or Codex plugin use for extension surfaces

Impact

Agent-facing lifecycle/setup risk, but no unconsented foreign control-surface hijack or exfiltration confirmed

Mechanism

guarded first-party agent extension setup and plugin hook delegation

Rationale

Source inspection shows risky agent-extension capabilities, but the npm lifecycle path is limited to a guarded global-install stamp and reminder; substantive Codex/plugin/hook installation is user-invoked or platform-scoped. This fits warn-only agent extension lifecycle risk rather than malicious AI-agent control hijack.

Evidence

package.jsondist/scripts/postinstall.jsdist/cli/update.jsdist/utils/paths.jsdist/cli/setup.jsdist/cli/plugin-marketplace.jsplugins/oh-my-codex/.codex-plugin/plugin.jsonplugins/oh-my-codex/.mcp.jsonplugins/oh-my-codex/hooks/hooks.jsonplugins/oh-my-codex/hooks/codex-native-hook.mjsdist/autoresearch/runtime.jsdist/mcp/code-intel-server.js$CODEX_HOME/.omx/install-state.json$CODEX_HOME/plugins/cache/oh-my-codex-local/oh-my-codex/oh-my-codex$CODEX_HOME/config.toml$CODEX_HOME/agents$CODEX_HOME/skills$CODEX_HOME/prompts.omx/state

Network endpoints3

registry.npmjs.org/oh-my-codex-pennix/latestgithub.com/PennixRv/oh-my-codex.gitgithub.com/PennixRv/oh-my-codex

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json defines postinstall and prepare lifecycle scripts
dist/scripts/postinstall.js runs on global npm install and writes an install stamp under CODEX_HOME/.omx
plugins/oh-my-codex/.codex-plugin/plugin.json declares Codex plugin skills, hooks, apps, and MCP metadata
plugins/oh-my-codex/hooks/hooks.json registers hook commands for multiple Codex hook events
dist/cli/setup.js can install Codex skills/prompts/agents/config on explicit setup
dist/autoresearch/runtime.js supports user-provided evaluator command with shell:true in autoresearch workflow

Evidence against

postinstall is guarded to global installs and only updates install-state.json plus logs a setup reminder
No install-time code copies hooks, rewrites .mcp.json, launches agents, or registers standing MCP servers
Plugin MCP servers in plugins/oh-my-codex/.mcp.json are packaged disabled:false? actually enabled false for each server
Network access seen is package-aligned update/native asset lookup to npm/GitHub, not credential exfiltration
Runtime child_process and shell use are tied to explicit CLI/MCP/autoresearch workflows
No credential harvesting, destructive persistence, or remote payload execution confirmed by source inspection

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 407 file(s), 5.13 MB of source, external domains: api.github.com, api.telegram.org, discord.com, github.com, registry.npmjs.org

Source & flagged code

8 flagged

package.jsonView file

Lines 1-40json

2 "name": "oh-my-codex-pennix",

3 "version": "0.18.71",

4 "description": "Multi-agent orchestration layer for OpenAI Codex CLI — Pennix fork",

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "omx": "dist/cli/omx.js"

9 },

10 "scripts": {

11 "build": "node -e \"const fs=require('fs'); fs.rmSync('dist',{recursive:true,force:true});\" && tsc && node -e \"require('fs').chmodSync('dist/cli/omx.js', 0o755)\"",

12 "build:explore": "cargo build -p omx-explore-harness",

13 "build:full": "npm run build && npm run build:explore:release && npm run build:sparkshell && npm run build:api",

14 "build:explore:release": "node dist/scripts/build-explore-harness.js",

15 "check:no-unused": "tsc -p tsconfig.no-unused.json",

16 "clean:native-package-assets": "node dist/scripts/cleanup-explore-harness.js",

17 "dev": "tsc --watch",

18 "lint": "biome lint src",

19 "prepack": "npm run build && npm run verify:native-agents && npm run sync:plugin && npm run verify:plugin-bundle && npm run clean:native-package-assets",

20 "postinstall": "node -e \"const fs=require('fs');const p='./dist/scripts/postinstall.js';if(fs.existsSync(p))import(p).then(m=>m.main?.()).catch(e=>console.warn('[omx] Postinstall skipped after a non-fatal error: '+(e?.message??e)))\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L20

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

21 "setup": "node dist/cli/omx.js setup",

22 "doctor": "node dist/cli/omx.js doctor",

23 "ask:claude": "./src/scripts/ask-claude.sh",

24 "ask:gemini": "./src/scripts/ask-gemini.sh",

25 "test:explore": "cargo test -p omx-explore-harness && node --test dist/cli/__tests__/explore.test.js dist/hooks/__tests__/explore-routing.test.js dist/hooks/__tests__/explore-sparkshell-guidance-contract.test.js",

26 "test:team:cross-rebase-smoke": "npm run build && npm run test:team:cross-rebase-smoke:compiled",

27 "test:team:cross-rebase-smoke:compiled": "node dist/scripts/run-test-files.js dist/team/__tests__/cross-rebase-smoke.test.js",

28 "test:team:worker-runtime-identity": "npm run build && npm run test:team:worker-runtime-identity:compiled",

29 "test:team:worker-runtime-identity:compiled": "node dist/scripts/run-test-files.js dist/team/__tests__/worker-runtime-identity.test.js",

30 "test:recent-bug-regressions": "npm run build && npm run test:recent-bug-regressions:compiled",

31 "test:recent-bug-regressions:compiled": "node dist/scripts/run-test-files.js dist/hooks/__tests__/keyword-detector.test.js dist/scripts/__tests__/codex-native-hook.test.js dist/cli/__tests__/launch-fallback.test.js dist/team/__tests__/runtime.test.js dist/team/__tests__/hardening-e2e.test.js",

32 "test:plugin-boundaries:compiled": "node dist/scripts/run-test-files.js dist/cli/__tests__/codex-plugin-layout.test.js dist/cli/__tests__/package-bin-contract.test.js dist/cli/__tests__/setup-hooks-shared-ownership.test.js dist/catalog/__tests__/plugin-bundle-ssot.test.js",

33 "test:node": "node dist/scripts/run-test-files.js dist",

34 "test:node:cross-platform": "npm run test:node",

35 "test": "npm run build && npm run verify:native-agents && npm run verify:plugin-bundle && npm run test:node && node dist/scripts/generate-catalog-docs.js --check",

36 "test:ci:compiled": "npm run verify:native-agents && npm run verify:plugin-bundle && npm run test:node && node dist/scripts/generate-catalog-docs.js --check",

37 "coverage:team-critical": "npm run build && npm run coverage:team-critical:compiled",

38 "coverage:team-critical:compiled": "c8 --all --src dist/team --src dist/state --include 'dist/team/**/*.js' --include 'dist/state/**/*.js' --exclude '**/__tests__/**' --reporter=text-summary --reporter=lcov --reporter=json-summary --report-dir coverage/team --check-coverage --lines=78 --functions=90 --branches=70 --statements=78 node dist/scripts/run-test-files.js dist/team/__tests__ dist/state/__tests__",

39 "coverage:team-critical:cross-platform": "npm run coverage:team-critical",

40 "coverage:ts:full": "npm run build && npm run coverage:ts:full:compiled",

dist/autoresearch/runtime.jsView file

Lines 1-21javascript

1import { execFileSync, spawnSync } from 'child_process';

2import { existsSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/autoresearch/runtime.jsView on unpkg · L1

3import { mkdir, readFile, symlink, writeFile } from 'fs/promises';

4import { dirname, join } from 'path';

dist/cli/hooks.jsView file

Lines 20-60javascript

20 if (event.event !== 'turn-complete') return;

22 const current = Number((await sdk.state.read('sample-seen-count')) ?? 0);

23 const next = Number.

dist/cli/index.jsView file

Lines 1-24javascript

1/**

2 * oh-my-codex-pennix CLI

3 * Multi-agent orchestration for OpenAI Codex CLI

4 */

5import { execFileSync, spawn } from "child_process";

6import { basename, dirname, join, posix, resolve, win32 } from "path";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/index.jsView on unpkg · L4

7import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync }

dist/mcp/code-intel-server.jsView file

Lines 526-566javascript

526 symbol,

527 includeDeclaration: effectiveIncludeDeclaration,

528 referenceCount: filteredRefs.length,

529 references: filteredRefs.slice(0, 100),

530 });

531 }

532 catch (err) {

src/scripts/run-autoresearch-showcase.shView file

•path = src/scripts/run-autoresearch-showcase.sh kind = build_helper sizeBytes = 1989 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/scripts/run-autoresearch-showcase.shView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "const fs=require('fs');const p='./dist/scripts/postinstall.js';if(fs.existsSync(p))import(p).then(m=>m.main?.()).catch(e=>console.warn('[omx] Postinstall skipped after a n...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/autoresearch/runtime.jsView file

1import { execFileSync, spawnSync } from 'child_process'; L2: import { existsSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/autoresearch/runtime.jsView on unpkg · L1

283encoding: 'utf-8', L284: shell: true, L285: maxBuffer: 1024 * 1024,

High

Shell

Package source references shell execution.

dist/autoresearch/runtime.jsView on unpkg · L283

dist/cli/hooks.jsView file

40const moduleUrl = `${pathToFileURL(filePath).href}?t=${Date.now()}`; L41: const mod = await import(moduleUrl); L42: if (typeof mod.onHookEvent !== 'function') {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/hooks.jsView on unpkg · L40

dist/cli/index.jsView file

4*/ L5: import { execFileSync, spawn } from "child_process"; L6: import { basename, dirname, join, posix, resolve, win32 } from "path"; ... L62: export { parseTmuxPaneSnapshot, isHudWatchPane, findHudWatchPaneIds } from "../hud/tmux.js"; L63: rememberOmxLaunchContext({ argv1: process.argv[1], cwd: process.cwd(), env: process.env }); L64: import { classifySpawnError, resolveTmuxBinaryForPlatform, spawnPlatformCommandSync, } from "../utils/platform-command.js"; ... L223: const ALLOWED_SHELLS = new Set([ L224: "/bin/sh", L225: "/bin/bash", ... L522: } L523: export function resolveCodexLaunchPolicy(env = process.env, _platform = process.platform, tmuxAvailable = isTmuxAvailable(), nativeWindows = isNativeWindows(), stdinIsTTY = Boolean... L524: if (explicitPolicy === "direct")

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/index.jsView on unpkg · L4

dist/mcp/code-intel-server.jsView file

546try { L547: const { stdout } = await exec('npx', ['tsc', '--version'], { timeout: 10000 }); L548: checks['typescript'] = { available: true, version: stdout.trim() }; ... L551: process.stderr.write(`[code-intel-server] operation failed: ${err}\n`); L552: checks['typescript'] = { available: false, note: 'Install: npm i -D typescript' }; L553: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/mcp/code-intel-server.jsView on unpkg · L546

src/scripts/run-autoresearch-showcase.shView file

•path = src/scripts/run-autoresearch-showcase.sh kind = build_helper sizeBytes = 1989 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/scripts/run-autoresearch-showcase.shView on unpkg

Findings

1 Critical4 High6 Medium5 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/autoresearch/runtime.js

HighShelldist/autoresearch/runtime.js

HighRuntime Package Installdist/mcp/code-intel-server.js

MediumDynamic Requiredist/cli/hooks.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/cli/index.js

MediumShips Build Helpersrc/scripts/run-autoresearch-showcase.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

package.jsonView file

Lines 1-40json

2 "name": "oh-my-codex-pennix",

3 "version": "0.18.71",

4 "description": "Multi-agent orchestration layer for OpenAI Codex CLI — Pennix fork",

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "omx": "dist/cli/omx.js"

9 },

10 "scripts": {

11 "build": "node -e \"const fs=require('fs'); fs.rmSync('dist',{recursive:true,force:true});\" && tsc && node -e \"require('fs').chmodSync('dist/cli/omx.js', 0o755)\"",

12 "build:explore": "cargo build -p omx-explore-harness",

13 "build:full": "npm run build && npm run build:explore:release && npm run build:sparkshell && npm run build:api",

14 "build:explore:release": "node dist/scripts/build-explore-harness.js",

15 "check:no-unused": "tsc -p tsconfig.no-unused.json",

16 "clean:native-package-assets": "node dist/scripts/cleanup-explore-harness.js",

17 "dev": "tsc --watch",

18 "lint": "biome lint src",

19 "prepack": "npm run build && npm run verify:native-agents && npm run sync:plugin && npm run verify:plugin-bundle && npm run clean:native-package-assets",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L20

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

21 "setup": "node dist/cli/omx.js setup",

22 "doctor": "node dist/cli/omx.js doctor",

23 "ask:claude": "./src/scripts/ask-claude.sh",

24 "ask:gemini": "./src/scripts/ask-gemini.sh",

26 "test:team:cross-rebase-smoke": "npm run build && npm run test:team:cross-rebase-smoke:compiled",

27 "test:team:cross-rebase-smoke:compiled": "node dist/scripts/run-test-files.js dist/team/__tests__/cross-rebase-smoke.test.js",

28 "test:team:worker-runtime-identity": "npm run build && npm run test:team:worker-runtime-identity:compiled",

29 "test:team:worker-runtime-identity:compiled": "node dist/scripts/run-test-files.js dist/team/__tests__/worker-runtime-identity.test.js",

30 "test:recent-bug-regressions": "npm run build && npm run test:recent-bug-regressions:compiled",

33 "test:node": "node dist/scripts/run-test-files.js dist",

34 "test:node:cross-platform": "npm run test:node",

35 "test": "npm run build && npm run verify:native-agents && npm run verify:plugin-bundle && npm run test:node && node dist/scripts/generate-catalog-docs.js --check",

36 "test:ci:compiled": "npm run verify:native-agents && npm run verify:plugin-bundle && npm run test:node && node dist/scripts/generate-catalog-docs.js --check",

37 "coverage:team-critical": "npm run build && npm run coverage:team-critical:compiled",

39 "coverage:team-critical:cross-platform": "npm run coverage:team-critical",

40 "coverage:ts:full": "npm run build && npm run coverage:ts:full:compiled",

dist/autoresearch/runtime.jsView file

Lines 1-21javascript

1import { execFileSync, spawnSync } from 'child_process';

2import { existsSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/autoresearch/runtime.jsView on unpkg · L1

3import { mkdir, readFile, symlink, writeFile } from 'fs/promises';

4import { dirname, join } from 'path';

dist/cli/hooks.jsView file

Lines 20-60javascript

20 if (event.event !== 'turn-complete') return;

22 const current = Number((await sdk.state.read('sample-seen-count')) ?? 0);

23 const next = Number.

dist/cli/index.jsView file

Lines 1-24javascript

1/**

2 * oh-my-codex-pennix CLI

3 * Multi-agent orchestration for OpenAI Codex CLI

4 */

5import { execFileSync, spawn } from "child_process";

6import { basename, dirname, join, posix, resolve, win32 } from "path";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/index.jsView on unpkg · L4

7import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync }

dist/mcp/code-intel-server.jsView file

Lines 526-566javascript

526 symbol,

527 includeDeclaration: effectiveIncludeDeclaration,

528 referenceCount: filteredRefs.length,

529 references: filteredRefs.slice(0, 100),

530 });

531 }

532 catch (err) {

src/scripts/run-autoresearch-showcase.shView file

•path = src/scripts/run-autoresearch-showcase.sh kind = build_helper sizeBytes = 1989 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/scripts/run-autoresearch-showcase.shView on unpkg