oh-my-codex@0.21.1
Multi-agent orchestration layer for OpenAI Codex CLI
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo concrete malicious install hook, self-dependency chain, harvesting, or exfiltration was found. The remote native payload loader is a real, user-triggered dangerous capability that warrants a warning rather than a block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Running an OMX native command such as the API command, or explicitly running omx setup.
Impact
A compromised release-manifest or archive endpoint could cause execution of a native payload in the user's context.
Mechanism
Remote native binary hydration followed by process execution.
AI rationale
No concrete malicious install hook, self-dependency chain, harvesting, or exfiltration was found. The remote native payload loader is a real, user-triggered dangerous capability that warrants a warning rather than a block.
Evidence
dist/cli/native-assets.jsdist/cli/api.jsdist/cli/index.jsdist/cli/setup.js~/.cache/oh-my-codex/native
Network endpoints1
github.com
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The install hook executes package code, although its implementation is limited to global-install advisory state.
- Native commands fetch a release manifest and archive, then execute the resolved native binary.
- The explicit setup command can configure Codex integration files.
Evidence against
- The postinstall implementation returns without action for local installs and only records a version stamp for global installs.
- No self-dependency, credential harvesting, secret exfiltration, or unconsented install-time Codex configuration mutation was found.
- Native archive handling includes size and SHA-256 checks, but the manifest supplying the hash is fetched remotely.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
11 flaggedpackage.jsonView file
•scripts.postinstall = node -e "const fs=require('fs');const p='./dist/scripts/postinstall.js';if(fs.existsSync(p))import(p).then(m=>m.main?.()).catch(e=>console.warn('[omx] Postinstall skipped after a n...
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "const fs=require('fs');const p='./dist/scripts/postinstall.js';if(fs.existsSync(p))import(p).then(m=>m.main?.()).catch(e=>console.warn('[omx] Postinstall skipped after a n...
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/autoresearch/runtime.jsView file
1import { execFileSync, spawnSync } from 'child_process';
L2: import { existsSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/autoresearch/runtime.jsView on unpkg · L1284encoding: 'utf-8',
L285: shell: true,
L286: maxBuffer: 1024 * 1024,
High
dist/runtime/bridge.jsView file
76// Lazy require to avoid static cycle: native-assets ↔ bridge.
L77: const { [redacted] } = require('../cli/native-assets.js');
L78: const cands = [redacted]('omx-runtime', version, process.platform, process.arch, process.env);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/runtime/bridge.jsView on unpkg · L76dist/scripts/smoke-packed-install.jsView file
4import { delimiter, dirname, isAbsolute, join, resolve } from 'node:path';
L5: import { spawn, spawnSync } from 'node:child_process';
L6: import { pathToFileURL } from 'node:url';
L7: import { TextDecoder } from 'node:util';
L8: import TOML, { parse as parseToml } from '@iarna/toml';
...
L204: }
L205: export function [redacted](testCase, baseEnv = process.env) {
L206: const insideTmux = testCase.insideTmux === true;
...
L261: });
L262: const CODEX_APP_SERVER_MAX_STDOUT_FRAME_LENGTH = 1_048_576;
L263: export class CodexExecutableNotFoundError extends Error {
...
L363: function resolvePinnedCodexExecutable(cwd, env, seam = {}) {
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/scripts/smoke-packed-install.jsView on unpkg · L4dist/cli/setup.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
me(receiptpath), { recursive: true });
await writefile(receiptpath, `${json.stringify(receipt, null, 2)}\n`);
}
catch {
}
}
async function isomxmanagedinstalledskilldir(skilldir) {
const skillmdpath = join(skilldir, "skill.md");
if (!existssync(skillmdpath))
return false;
try {
const metadata = parseskillfrontmatter(await readfile(skillmdpath, "utf-8"), skillmdpath);
return metadata.description.startswith(installed_skill_badge_prefix);
}
catch {
return false;
}
}
function [redacted](content, filepath = "skill.md"
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/cli/setup.jsView on unpkgdist/mcp/code-intel-server.jsView file
556try {
L557: const { stdout } = await exec('npx', ['tsc', '--version'], { timeout: 10000 });
L558: checks['typescript'] = { available: true, version: stdout.trim() };
...
L561: process.stderr.write(`[code-intel-server] operation failed: ${err}\n`);
L562: checks['typescript'] = { available: false, note: 'Install: npm i -D typescript' };
L563: }
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/mcp/code-intel-server.jsView on unpkg · L556src/scripts/run-autoresearch-showcase.shView file
•path = src/scripts/run-autoresearch-showcase.sh
kind = build_helper
sizeBytes = 1989
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
src/scripts/run-autoresearch-showcase.shView on unpkgdist/cli/api.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 10
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/cli/api.js#virtual:normalized:round1View on unpkgdist/ralplan/documented-leader-preflight.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = oh-my-codex@0.20.5
matchedIdentity = npm:b2gtbXktY29kZXg:0.20.5
similarity = 0.742
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/ralplan/documented-leader-preflight.jsView on unpkgFindings
2 Critical6 High6 Medium5 Low
CriticalRed Install Lifecycle Scriptpackage.json
CriticalPrevious Version Dangerous Deltadist/ralplan/documented-leader-preflight.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/autoresearch/runtime.js
HighShelldist/autoresearch/runtime.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli/setup.js
HighRuntime Package Installdist/mcp/code-intel-server.js
HighSemantic Analysis Limiteddist/cli/api.js#virtual:normalized:round1
MediumDynamic Requiredist/runtime/bridge.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/scripts/smoke-packed-install.js
MediumShips Build Helpersrc/scripts/run-autoresearch-showcase.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to oh-my-codex@0.21.1.
See all versions of oh-my-codex for other recorded verdicts.
- Review the evidence and your use of oh-my-codex@0.21.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.