registry / oh-my-codex-pennix / 0.18.78

oh-my-codex-pennix@0.18.78

Multi-agent orchestration layer for OpenAI Codex CLI — Pennix fork

AI Security Review

scanned 16h ago · by lpm-firewall-ai

No confirmed malicious install-time attack surface is established. The package is an AI/Codex orchestration CLI with powerful user-invoked setup, update, MCP, hook, and evaluator features, but postinstall only records an OMX-owned install stamp.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm global install runs postinstall; broader capabilities require explicit omx commands

Impact

Install-time impact is limited to an OMX-owned state file; explicit commands can modify Codex/OMX configuration and run local tools as documented CLI functionality.

Mechanism

guarded install stamp plus user-invoked agent tooling

Rationale

Source inspection shows the lifecycle hook does not plant or register foreign/broad AI-agent control surfaces; it only writes a package-owned install-state stamp on global installs. The high-risk primitives are explicit CLI/MCP/orchestration features aligned with the package purpose, with no concrete malicious exfiltration or persistence behavior confirmed.

Evidence

package.jsondist/scripts/postinstall.jsdist/utils/paths.jsdist/cli/update.jsdist/cli/setup.jsdist/config/omx-first-party-mcp.jsdist/mcp/code-intel-server.jsdist/autoresearch/runtime.js$CODEX_HOME/.omx/install-state.json.omx/state/update-check.json.omx/logs/update-*.log$CODEX_HOME/config.toml$CODEX_HOME/skills/$CODEX_HOME/prompts/$CODEX_HOME/agents/.codex/agents/.codex/skills/~/.claude/settings.json

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for block

package.json defines postinstall lifecycle script
dist/cli/setup.js can write Codex config, prompts, skills, native agents, plugin cache, and optional MCP config when user runs setup
dist/cli/update.js can run npm install -g and schedule a detached update after user confirmation
dist/mcp/code-intel-server.js invokes npx/tsc/ast-grep as MCP tool behavior
dist/autoresearch/runtime.js can run git and a configured evaluator command with shell:true

Evidence against

dist/scripts/postinstall.js is guarded to global installs and only updates $CODEX_HOME/.omx/install-state.json plus logs a setup reminder
No postinstall setup of AGENTS.md, Codex config.toml, Claude settings, MCP servers, hooks, or shell startup files observed
Setup/plugin/MCP writes are exposed through explicit omx setup or plugin commands, not automatic install-time mutation
Network/package-manager activity found in update/code-intel paths is user-invoked and package-aligned
No credential harvesting, exfiltration endpoint, remote payload fetch-and-execute, or destructive install behavior found

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 407 file(s), 5.14 MB of source, external domains: api.github.com, api.telegram.org, discord.com, github.com, registry.npmjs.org

Source & flagged code

8 flagged

package.jsonView file

Lines 1-40json

2 "name": "oh-my-codex-pennix",

3 "version": "0.18.78",

4 "description": "Multi-agent orchestration layer for OpenAI Codex CLI — Pennix fork",

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "omx": "dist/cli/omx.js"

9 },

10 "scripts": {

11 "build": "node -e \"const fs=require('fs'); fs.rmSync('dist',{recursive:true,force:true});\" && tsc && node -e \"require('fs').chmodSync('dist/cli/omx.js', 0o755)\"",

12 "build:explore": "cargo build -p omx-explore-harness",

13 "build:full": "npm run build && npm run build:explore:release && npm run build:sparkshell && npm run build:api",

14 "build:explore:release": "node dist/scripts/build-explore-harness.js",

15 "check:no-unused": "tsc -p tsconfig.no-unused.json",

16 "clean:native-package-assets": "node dist/scripts/cleanup-explore-harness.js",

17 "dev": "tsc --watch",

18 "lint": "biome lint src",

19 "prepack": "npm run build && npm run verify:native-agents && npm run sync:plugin && npm run verify:plugin-bundle && npm run clean:native-package-assets",

20 "postinstall": "node -e \"const fs=require('fs');const p='./dist/scripts/postinstall.js';if(fs.existsSync(p))import(p).then(m=>m.main?.()).catch(e=>console.warn('[omx] Postinstall skipped after a non-fatal error: '+(e?.message??e)))\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L20

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

21 "setup": "node dist/cli/omx.js setup",

22 "doctor": "node dist/cli/omx.js doctor",

23 "ask:claude": "./src/scripts/ask-claude.sh",

24 "ask:gemini": "./src/scripts/ask-gemini.sh",

25 "test:explore": "cargo test -p omx-explore-harness && node --test dist/cli/__tests__/explore.test.js dist/hooks/__tests__/explore-routing.test.js dist/hooks/__tests__/explore-sparkshell-guidance-contract.test.js",

26 "test:team:cross-rebase-smoke": "npm run build && npm run test:team:cross-rebase-smoke:compiled",

27 "test:team:cross-rebase-smoke:compiled": "node dist/scripts/run-test-files.js dist/team/__tests__/cross-rebase-smoke.test.js",

28 "test:team:worker-runtime-identity": "npm run build && npm run test:team:worker-runtime-identity:compiled",

29 "test:team:worker-runtime-identity:compiled": "node dist/scripts/run-test-files.js dist/team/__tests__/worker-runtime-identity.test.js",

30 "test:recent-bug-regressions": "npm run build && npm run test:recent-bug-regressions:compiled",

31 "test:recent-bug-regressions:compiled": "node dist/scripts/run-test-files.js dist/hooks/__tests__/keyword-detector.test.js dist/scripts/__tests__/codex-native-hook.test.js dist/cli/__tests__/launch-fallback.test.js dist/team/__tests__/runtime.test.js dist/team/__tests__/hardening-e2e.test.js",

32 "test:plugin-boundaries:compiled": "node dist/scripts/run-test-files.js dist/cli/__tests__/codex-plugin-layout.test.js dist/cli/__tests__/package-bin-contract.test.js dist/cli/__tests__/setup-hooks-shared-ownership.test.js dist/catalog/__tests__/plugin-bundle-ssot.test.js",

33 "test:node": "node dist/scripts/run-test-files.js dist",

34 "test:node:cross-platform": "npm run test:node",

35 "test": "npm run build && npm run verify:native-agents && npm run verify:plugin-bundle && npm run test:node && node dist/scripts/generate-catalog-docs.js --check",

36 "test:ci:compiled": "npm run verify:native-agents && npm run verify:plugin-bundle && npm run test:node && node dist/scripts/generate-catalog-docs.js --check",

37 "coverage:team-critical": "npm run build && npm run coverage:team-critical:compiled",

38 "coverage:team-critical:compiled": "c8 --all --src dist/team --src dist/state --include 'dist/team/**/*.js' --include 'dist/state/**/*.js' --exclude '**/__tests__/**' --reporter=text-summary --reporter=lcov --reporter=json-summary --report-dir coverage/team --check-coverage --lines=78 --functions=90 --branches=70 --statements=78 node dist/scripts/run-test-files.js dist/team/__tests__ dist/state/__tests__",

39 "coverage:team-critical:cross-platform": "npm run coverage:team-critical",

40 "coverage:ts:full": "npm run build && npm run coverage:ts:full:compiled",

dist/autoresearch/runtime.jsView file

Lines 1-21javascript

1import { execFileSync, spawnSync } from 'child_process';

2import { existsSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/autoresearch/runtime.jsView on unpkg · L1

3import { mkdir, readFile, symlink, writeFile } from 'fs/promises';

4import { dirname, join } from 'path';

dist/cli/hooks.jsView file

Lines 20-60javascript

20 if (event.event !== 'turn-complete') return;

22 const current = Number((await sdk.state.read('sample-seen-count')) ?? 0);

23 const next = Number.

dist/cli/index.jsView file

Lines 1-24javascript

1/**

2 * oh-my-codex-pennix CLI

3 * Multi-agent orchestration for OpenAI Codex CLI

4 */

5import { execFileSync, spawn } from "child_process";

6import { basename, dirname, join, posix, resolve, win32 } from "path";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/index.jsView on unpkg · L4

7import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync }

dist/mcp/code-intel-server.jsView file

Lines 526-566javascript

526 symbol,

527 includeDeclaration: effectiveIncludeDeclaration,

528 referenceCount: filteredRefs.length,

529 references: filteredRefs.slice(0, 100),

530 });

531 }

532 catch (err) {

src/scripts/run-autoresearch-showcase.shView file

•path = src/scripts/run-autoresearch-showcase.sh kind = build_helper sizeBytes = 1989 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/scripts/run-autoresearch-showcase.shView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "const fs=require('fs');const p='./dist/scripts/postinstall.js';if(fs.existsSync(p))import(p).then(m=>m.main?.()).catch(e=>console.warn('[omx] Postinstall skipped after a n...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/autoresearch/runtime.jsView file

1import { execFileSync, spawnSync } from 'child_process'; L2: import { existsSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/autoresearch/runtime.jsView on unpkg · L1

283encoding: 'utf-8', L284: shell: true, L285: maxBuffer: 1024 * 1024,

High

Shell

Package source references shell execution.

dist/autoresearch/runtime.jsView on unpkg · L283

dist/cli/hooks.jsView file

40const moduleUrl = `${pathToFileURL(filePath).href}?t=${Date.now()}`; L41: const mod = await import(moduleUrl); L42: if (typeof mod.onHookEvent !== 'function') {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/hooks.jsView on unpkg · L40

dist/cli/index.jsView file

4*/ L5: import { execFileSync, spawn } from "child_process"; L6: import { basename, dirname, join, posix, resolve, win32 } from "path"; ... L62: export { parseTmuxPaneSnapshot, isHudWatchPane, findHudWatchPaneIds } from "../hud/tmux.js"; L63: rememberOmxLaunchContext({ argv1: process.argv[1], cwd: process.cwd(), env: process.env }); L64: import { classifySpawnError, resolveTmuxBinaryForPlatform, spawnPlatformCommandSync, } from "../utils/platform-command.js"; ... L223: const ALLOWED_SHELLS = new Set([ L224: "/bin/sh", L225: "/bin/bash", ... L522: } L523: export function resolveCodexLaunchPolicy(env = process.env, _platform = process.platform, tmuxAvailable = isTmuxAvailable(), nativeWindows = isNativeWindows(), stdinIsTTY = Boolean... L524: if (explicitPolicy === "direct")

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/index.jsView on unpkg · L4

dist/mcp/code-intel-server.jsView file

546try { L547: const { stdout } = await exec('npx', ['tsc', '--version'], { timeout: 10000 }); L548: checks['typescript'] = { available: true, version: stdout.trim() }; ... L551: process.stderr.write(`[code-intel-server] operation failed: ${err}\n`); L552: checks['typescript'] = { available: false, note: 'Install: npm i -D typescript' }; L553: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/mcp/code-intel-server.jsView on unpkg · L546

src/scripts/run-autoresearch-showcase.shView file

•path = src/scripts/run-autoresearch-showcase.sh kind = build_helper sizeBytes = 1989 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/scripts/run-autoresearch-showcase.shView on unpkg

Findings

1 Critical4 High6 Medium5 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/autoresearch/runtime.js

HighShelldist/autoresearch/runtime.js

HighRuntime Package Installdist/mcp/code-intel-server.js

MediumDynamic Requiredist/cli/hooks.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/cli/index.js

MediumShips Build Helpersrc/scripts/run-autoresearch-showcase.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

package.jsonView file

Lines 1-40json

2 "name": "oh-my-codex-pennix",

3 "version": "0.18.78",

4 "description": "Multi-agent orchestration layer for OpenAI Codex CLI — Pennix fork",

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "omx": "dist/cli/omx.js"

9 },

10 "scripts": {

11 "build": "node -e \"const fs=require('fs'); fs.rmSync('dist',{recursive:true,force:true});\" && tsc && node -e \"require('fs').chmodSync('dist/cli/omx.js', 0o755)\"",

12 "build:explore": "cargo build -p omx-explore-harness",

13 "build:full": "npm run build && npm run build:explore:release && npm run build:sparkshell && npm run build:api",

14 "build:explore:release": "node dist/scripts/build-explore-harness.js",

15 "check:no-unused": "tsc -p tsconfig.no-unused.json",

16 "clean:native-package-assets": "node dist/scripts/cleanup-explore-harness.js",

17 "dev": "tsc --watch",

18 "lint": "biome lint src",

19 "prepack": "npm run build && npm run verify:native-agents && npm run sync:plugin && npm run verify:plugin-bundle && npm run clean:native-package-assets",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L20

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

21 "setup": "node dist/cli/omx.js setup",

22 "doctor": "node dist/cli/omx.js doctor",

23 "ask:claude": "./src/scripts/ask-claude.sh",

24 "ask:gemini": "./src/scripts/ask-gemini.sh",

26 "test:team:cross-rebase-smoke": "npm run build && npm run test:team:cross-rebase-smoke:compiled",

27 "test:team:cross-rebase-smoke:compiled": "node dist/scripts/run-test-files.js dist/team/__tests__/cross-rebase-smoke.test.js",

28 "test:team:worker-runtime-identity": "npm run build && npm run test:team:worker-runtime-identity:compiled",

29 "test:team:worker-runtime-identity:compiled": "node dist/scripts/run-test-files.js dist/team/__tests__/worker-runtime-identity.test.js",

30 "test:recent-bug-regressions": "npm run build && npm run test:recent-bug-regressions:compiled",

33 "test:node": "node dist/scripts/run-test-files.js dist",

34 "test:node:cross-platform": "npm run test:node",

35 "test": "npm run build && npm run verify:native-agents && npm run verify:plugin-bundle && npm run test:node && node dist/scripts/generate-catalog-docs.js --check",

36 "test:ci:compiled": "npm run verify:native-agents && npm run verify:plugin-bundle && npm run test:node && node dist/scripts/generate-catalog-docs.js --check",

37 "coverage:team-critical": "npm run build && npm run coverage:team-critical:compiled",

39 "coverage:team-critical:cross-platform": "npm run coverage:team-critical",

40 "coverage:ts:full": "npm run build && npm run coverage:ts:full:compiled",

dist/autoresearch/runtime.jsView file

Lines 1-21javascript

1import { execFileSync, spawnSync } from 'child_process';

2import { existsSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/autoresearch/runtime.jsView on unpkg · L1

3import { mkdir, readFile, symlink, writeFile } from 'fs/promises';

4import { dirname, join } from 'path';

dist/cli/hooks.jsView file

Lines 20-60javascript

20 if (event.event !== 'turn-complete') return;

22 const current = Number((await sdk.state.read('sample-seen-count')) ?? 0);

23 const next = Number.

dist/cli/index.jsView file

Lines 1-24javascript

1/**

2 * oh-my-codex-pennix CLI

3 * Multi-agent orchestration for OpenAI Codex CLI

4 */

5import { execFileSync, spawn } from "child_process";

6import { basename, dirname, join, posix, resolve, win32 } from "path";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/index.jsView on unpkg · L4

7import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync }

dist/mcp/code-intel-server.jsView file

Lines 526-566javascript

526 symbol,

527 includeDeclaration: effectiveIncludeDeclaration,

528 referenceCount: filteredRefs.length,

529 references: filteredRefs.slice(0, 100),

530 });

531 }

532 catch (err) {

src/scripts/run-autoresearch-showcase.shView file

•path = src/scripts/run-autoresearch-showcase.sh kind = build_helper sizeBytes = 1989 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/scripts/run-autoresearch-showcase.shView on unpkg