registry / oh-my-codex-pennix / 0.18.72

oh-my-codex-pennix@0.18.72

Multi-agent orchestration layer for OpenAI Codex CLI — Pennix fork

AI Security Review

scanned 22h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No confirmed malicious attack surface was established. The package is an AI/Codex extension platform with broad agent hooks and setup-time Codex control-surface writes, but the risky mutations are user-invoked or plugin-scoped rather than unconsented lifecycle delivery.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

global npm install records stamp; explicit omx setup/update or plugin enablement activates Codex integration

Impact

Can install package-owned Codex skills, prompts, native agents, hooks, AGENTS.md guidance, plugin cache, and config when the user invokes setup; no confirmed credential theft or covert persistence.

Mechanism

agent extension setup and Codex hook/plugin registration

Policy narrative

The package is capable of deep Codex integration: setup can write Codex config, hooks, native agents, skills, prompts, plugin cache, AGENTS.md, and local OMX state. Inspection did not show lifecycle-triggered unconsented control-surface mutation beyond a global-install version stamp; activation of the broader control surface requires explicit setup/update or plugin registration.

Rationale

This is not malicious by source inspection because the install lifecycle does not plant hooks or agent instructions and the broad Codex mutations are package-aligned, explicit setup/plugin behavior. It remains warn-worthy because the package provides an agent extension lifecycle with powerful Codex hook and orchestration capabilities.

Evidence

package.jsondist/scripts/postinstall.jsdist/cli/update.jsdist/cli/setup.jsdist/utils/paths.jsplugins/oh-my-codex/.codex-plugin/plugin.jsonplugins/oh-my-codex/hooks/hooks.jsonplugins/oh-my-codex/hooks/codex-native-hook.mjs$CODEX_HOME/.omx/install-state.json$CODEX_HOME/config.toml$CODEX_HOME/hooks.json$CODEX_HOME/AGENTS.md$CODEX_HOME/skills/$CODEX_HOME/prompts/$CODEX_HOME/agents/.codex/config.toml.codex/hooks.jsonAGENTS.md.omx/hud-config.json.omx/setup-scope.json

Network endpoints2

registry.npmjs.org/oh-my-codex-pennix/latestgithub.com/PennixRv/oh-my-codex.git

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json defines postinstall and prepare lifecycle hooks.
dist/scripts/postinstall.js runs only for global npm lifecycle and writes install stamp state.
dist/cli/setup.js explicitly installs Codex skills/prompts/agents, hooks, AGENTS.md, config.toml, plugin cache, and tmux assets.
plugins/oh-my-codex/.codex-plugin/plugin.json declares a Codex plugin with hooks and MCP metadata.
plugins/oh-my-codex/hooks/hooks.json registers command hooks for Codex SessionStart/Tool/Prompt/Stop events.
dist/cli/update.js can run npm global update and deferred setup refresh after user approval.

Evidence against

postinstall does not run setup, register hooks, or mutate AGENTS/config; it only records version state.
Setup/config mutation is exposed through explicit omx setup/update flows, with backups, prompts, dry-run/force handling, and project/user scope controls.
MCP compatibility defaults to none and first-party MCP registrations are optional or preserved by prompt.
Network endpoints are package-aligned npm registry/GitHub update sources, not exfiltration endpoints.
No credential harvesting or covert file exfiltration found in inspected lifecycle paths.
Runtime child_process use is aligned with CLI orchestration, git/npm/tmux diagnostics, and user-invoked tools.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 407 file(s), 5.13 MB of source, external domains: api.github.com, api.telegram.org, discord.com, github.com, registry.npmjs.org

Source & flagged code

8 flagged

package.jsonView file

Lines 1-40json

2 "name": "oh-my-codex-pennix",

3 "version": "0.18.72",

4 "description": "Multi-agent orchestration layer for OpenAI Codex CLI — Pennix fork",

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "omx": "dist/cli/omx.js"

9 },

10 "scripts": {

11 "build": "node -e \"const fs=require('fs'); fs.rmSync('dist',{recursive:true,force:true});\" && tsc && node -e \"require('fs').chmodSync('dist/cli/omx.js', 0o755)\"",

12 "build:explore": "cargo build -p omx-explore-harness",

13 "build:full": "npm run build && npm run build:explore:release && npm run build:sparkshell && npm run build:api",

14 "build:explore:release": "node dist/scripts/build-explore-harness.js",

15 "check:no-unused": "tsc -p tsconfig.no-unused.json",

16 "clean:native-package-assets": "node dist/scripts/cleanup-explore-harness.js",

17 "dev": "tsc --watch",

18 "lint": "biome lint src",

19 "prepack": "npm run build && npm run verify:native-agents && npm run sync:plugin && npm run verify:plugin-bundle && npm run clean:native-package-assets",

20 "postinstall": "node -e \"const fs=require('fs');const p='./dist/scripts/postinstall.js';if(fs.existsSync(p))import(p).then(m=>m.main?.()).catch(e=>console.warn('[omx] Postinstall skipped after a non-fatal error: '+(e?.message??e)))\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L20

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

21 "setup": "node dist/cli/omx.js setup",

22 "doctor": "node dist/cli/omx.js doctor",

23 "ask:claude": "./src/scripts/ask-claude.sh",

24 "ask:gemini": "./src/scripts/ask-gemini.sh",

25 "test:explore": "cargo test -p omx-explore-harness && node --test dist/cli/__tests__/explore.test.js dist/hooks/__tests__/explore-routing.test.js dist/hooks/__tests__/explore-sparkshell-guidance-contract.test.js",

26 "test:team:cross-rebase-smoke": "npm run build && npm run test:team:cross-rebase-smoke:compiled",

27 "test:team:cross-rebase-smoke:compiled": "node dist/scripts/run-test-files.js dist/team/__tests__/cross-rebase-smoke.test.js",

28 "test:team:worker-runtime-identity": "npm run build && npm run test:team:worker-runtime-identity:compiled",

29 "test:team:worker-runtime-identity:compiled": "node dist/scripts/run-test-files.js dist/team/__tests__/worker-runtime-identity.test.js",

30 "test:recent-bug-regressions": "npm run build && npm run test:recent-bug-regressions:compiled",

31 "test:recent-bug-regressions:compiled": "node dist/scripts/run-test-files.js dist/hooks/__tests__/keyword-detector.test.js dist/scripts/__tests__/codex-native-hook.test.js dist/cli/__tests__/launch-fallback.test.js dist/team/__tests__/runtime.test.js dist/team/__tests__/hardening-e2e.test.js",

32 "test:plugin-boundaries:compiled": "node dist/scripts/run-test-files.js dist/cli/__tests__/codex-plugin-layout.test.js dist/cli/__tests__/package-bin-contract.test.js dist/cli/__tests__/setup-hooks-shared-ownership.test.js dist/catalog/__tests__/plugin-bundle-ssot.test.js",

33 "test:node": "node dist/scripts/run-test-files.js dist",

34 "test:node:cross-platform": "npm run test:node",

35 "test": "npm run build && npm run verify:native-agents && npm run verify:plugin-bundle && npm run test:node && node dist/scripts/generate-catalog-docs.js --check",

36 "test:ci:compiled": "npm run verify:native-agents && npm run verify:plugin-bundle && npm run test:node && node dist/scripts/generate-catalog-docs.js --check",

37 "coverage:team-critical": "npm run build && npm run coverage:team-critical:compiled",

38 "coverage:team-critical:compiled": "c8 --all --src dist/team --src dist/state --include 'dist/team/**/*.js' --include 'dist/state/**/*.js' --exclude '**/__tests__/**' --reporter=text-summary --reporter=lcov --reporter=json-summary --report-dir coverage/team --check-coverage --lines=78 --functions=90 --branches=70 --statements=78 node dist/scripts/run-test-files.js dist/team/__tests__ dist/state/__tests__",

39 "coverage:team-critical:cross-platform": "npm run coverage:team-critical",

40 "coverage:ts:full": "npm run build && npm run coverage:ts:full:compiled",

dist/autoresearch/runtime.jsView file

Lines 1-21javascript

1import { execFileSync, spawnSync } from 'child_process';

2import { existsSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/autoresearch/runtime.jsView on unpkg · L1

3import { mkdir, readFile, symlink, writeFile } from 'fs/promises';

4import { dirname, join } from 'path';

dist/cli/hooks.jsView file

Lines 20-60javascript

20 if (event.event !== 'turn-complete') return;

22 const current = Number((await sdk.state.read('sample-seen-count')) ?? 0);

23 const next = Number.

dist/cli/index.jsView file

Lines 1-24javascript

1/**

2 * oh-my-codex-pennix CLI

3 * Multi-agent orchestration for OpenAI Codex CLI

4 */

5import { execFileSync, spawn } from "child_process";

6import { basename, dirname, join, posix, resolve, win32 } from "path";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/index.jsView on unpkg · L4

7import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync }

dist/mcp/code-intel-server.jsView file

Lines 526-566javascript

526 symbol,

527 includeDeclaration: effectiveIncludeDeclaration,

528 referenceCount: filteredRefs.length,

529 references: filteredRefs.slice(0, 100),

530 });

531 }

532 catch (err) {

src/scripts/run-autoresearch-showcase.shView file

•path = src/scripts/run-autoresearch-showcase.sh kind = build_helper sizeBytes = 1989 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/scripts/run-autoresearch-showcase.shView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "const fs=require('fs');const p='./dist/scripts/postinstall.js';if(fs.existsSync(p))import(p).then(m=>m.main?.()).catch(e=>console.warn('[omx] Postinstall skipped after a n...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/autoresearch/runtime.jsView file

1import { execFileSync, spawnSync } from 'child_process'; L2: import { existsSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/autoresearch/runtime.jsView on unpkg · L1

283encoding: 'utf-8', L284: shell: true, L285: maxBuffer: 1024 * 1024,

High

Shell

Package source references shell execution.

dist/autoresearch/runtime.jsView on unpkg · L283

dist/cli/hooks.jsView file

40const moduleUrl = `${pathToFileURL(filePath).href}?t=${Date.now()}`; L41: const mod = await import(moduleUrl); L42: if (typeof mod.onHookEvent !== 'function') {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/hooks.jsView on unpkg · L40

dist/cli/index.jsView file

4*/ L5: import { execFileSync, spawn } from "child_process"; L6: import { basename, dirname, join, posix, resolve, win32 } from "path"; ... L62: export { parseTmuxPaneSnapshot, isHudWatchPane, findHudWatchPaneIds } from "../hud/tmux.js"; L63: rememberOmxLaunchContext({ argv1: process.argv[1], cwd: process.cwd(), env: process.env }); L64: import { classifySpawnError, resolveTmuxBinaryForPlatform, spawnPlatformCommandSync, } from "../utils/platform-command.js"; ... L223: const ALLOWED_SHELLS = new Set([ L224: "/bin/sh", L225: "/bin/bash", ... L522: } L523: export function resolveCodexLaunchPolicy(env = process.env, _platform = process.platform, tmuxAvailable = isTmuxAvailable(), nativeWindows = isNativeWindows(), stdinIsTTY = Boolean... L524: if (explicitPolicy === "direct")

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/index.jsView on unpkg · L4

dist/mcp/code-intel-server.jsView file

546try { L547: const { stdout } = await exec('npx', ['tsc', '--version'], { timeout: 10000 }); L548: checks['typescript'] = { available: true, version: stdout.trim() }; ... L551: process.stderr.write(`[code-intel-server] operation failed: ${err}\n`); L552: checks['typescript'] = { available: false, note: 'Install: npm i -D typescript' }; L553: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/mcp/code-intel-server.jsView on unpkg · L546

src/scripts/run-autoresearch-showcase.shView file

•path = src/scripts/run-autoresearch-showcase.sh kind = build_helper sizeBytes = 1989 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/scripts/run-autoresearch-showcase.shView on unpkg

Findings

1 Critical4 High6 Medium5 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/autoresearch/runtime.js

HighShelldist/autoresearch/runtime.js

HighRuntime Package Installdist/mcp/code-intel-server.js

MediumDynamic Requiredist/cli/hooks.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/cli/index.js

MediumShips Build Helpersrc/scripts/run-autoresearch-showcase.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

package.jsonView file

Lines 1-40json

2 "name": "oh-my-codex-pennix",

3 "version": "0.18.72",

4 "description": "Multi-agent orchestration layer for OpenAI Codex CLI — Pennix fork",

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "omx": "dist/cli/omx.js"

9 },

10 "scripts": {

11 "build": "node -e \"const fs=require('fs'); fs.rmSync('dist',{recursive:true,force:true});\" && tsc && node -e \"require('fs').chmodSync('dist/cli/omx.js', 0o755)\"",

12 "build:explore": "cargo build -p omx-explore-harness",

13 "build:full": "npm run build && npm run build:explore:release && npm run build:sparkshell && npm run build:api",

14 "build:explore:release": "node dist/scripts/build-explore-harness.js",

15 "check:no-unused": "tsc -p tsconfig.no-unused.json",

16 "clean:native-package-assets": "node dist/scripts/cleanup-explore-harness.js",

17 "dev": "tsc --watch",

18 "lint": "biome lint src",

19 "prepack": "npm run build && npm run verify:native-agents && npm run sync:plugin && npm run verify:plugin-bundle && npm run clean:native-package-assets",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L20

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

21 "setup": "node dist/cli/omx.js setup",

22 "doctor": "node dist/cli/omx.js doctor",

23 "ask:claude": "./src/scripts/ask-claude.sh",

24 "ask:gemini": "./src/scripts/ask-gemini.sh",

26 "test:team:cross-rebase-smoke": "npm run build && npm run test:team:cross-rebase-smoke:compiled",

27 "test:team:cross-rebase-smoke:compiled": "node dist/scripts/run-test-files.js dist/team/__tests__/cross-rebase-smoke.test.js",

28 "test:team:worker-runtime-identity": "npm run build && npm run test:team:worker-runtime-identity:compiled",

29 "test:team:worker-runtime-identity:compiled": "node dist/scripts/run-test-files.js dist/team/__tests__/worker-runtime-identity.test.js",

30 "test:recent-bug-regressions": "npm run build && npm run test:recent-bug-regressions:compiled",

33 "test:node": "node dist/scripts/run-test-files.js dist",

34 "test:node:cross-platform": "npm run test:node",

35 "test": "npm run build && npm run verify:native-agents && npm run verify:plugin-bundle && npm run test:node && node dist/scripts/generate-catalog-docs.js --check",

36 "test:ci:compiled": "npm run verify:native-agents && npm run verify:plugin-bundle && npm run test:node && node dist/scripts/generate-catalog-docs.js --check",

37 "coverage:team-critical": "npm run build && npm run coverage:team-critical:compiled",

39 "coverage:team-critical:cross-platform": "npm run coverage:team-critical",

40 "coverage:ts:full": "npm run build && npm run coverage:ts:full:compiled",

dist/autoresearch/runtime.jsView file

Lines 1-21javascript

1import { execFileSync, spawnSync } from 'child_process';

2import { existsSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/autoresearch/runtime.jsView on unpkg · L1

3import { mkdir, readFile, symlink, writeFile } from 'fs/promises';

4import { dirname, join } from 'path';

dist/cli/hooks.jsView file

Lines 20-60javascript

20 if (event.event !== 'turn-complete') return;

22 const current = Number((await sdk.state.read('sample-seen-count')) ?? 0);

23 const next = Number.

dist/cli/index.jsView file

Lines 1-24javascript

1/**

2 * oh-my-codex-pennix CLI

3 * Multi-agent orchestration for OpenAI Codex CLI

4 */

5import { execFileSync, spawn } from "child_process";

6import { basename, dirname, join, posix, resolve, win32 } from "path";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/index.jsView on unpkg · L4

7import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync }

dist/mcp/code-intel-server.jsView file

Lines 526-566javascript

526 symbol,

527 includeDeclaration: effectiveIncludeDeclaration,

528 referenceCount: filteredRefs.length,

529 references: filteredRefs.slice(0, 100),

530 });

531 }

532 catch (err) {

src/scripts/run-autoresearch-showcase.shView file

•path = src/scripts/run-autoresearch-showcase.sh kind = build_helper sizeBytes = 1989 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/scripts/run-autoresearch-showcase.shView on unpkg