oh-my-codex@0.21.10
Multi-agent orchestration layer for OpenAI Codex CLI
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe benchmark utility conditionally forwards an existing OpenAI key through Codex to a package-selected endpoint. Because this is an explicitly run evaluation tool, the evidence supports a warning rather than a publish block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs the evaluation collector with a suite containing a matching internal model name.
Impact
The key may be sent to that endpoint as part of the provider request; the source does not establish how the recipient uses it.
Mechanism
The collector configures Codex to use the LayoffLabs endpoint and maps its authentication setting to OPENAI_API_KEY before launching Codex.
AI rationale
The benchmark utility conditionally forwards an existing OpenAI key through Codex to a package-selected endpoint. Because this is an explicitly run evaluation tool, the evidence supports a warning rather than a publish block.
Evidence
dist/evals/astra-defaults/collector.jsdist/scripts/eval/collect-astra-defaults.js
Network endpoints1
api.layofflabs.com/v1
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The benchmark collector automatically selects the LayoffLabs provider for matching internal model names.
- The collector configures Codex to use the LayoffLabs endpoint and the environment variable named OPENAI_API_KEY for authentication.
- The evaluation script passes its optional provider setting into the collector; when run without that setting, the collector’s model-based provider selection still applies.
- The collector launches Codex to make the configured request when the benchmark runs.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
13 flaggedpackage.jsonView file
•scripts.postinstall = node -e "const fs=require('fs');const p='./dist/scripts/postinstall.js';if(fs.existsSync(p))import(p).then(m=>m.main?.()).catch(e=>console.warn('[omx] Postinstall skipped after a n...
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "const fs=require('fs');const p='./dist/scripts/postinstall.js';if(fs.existsSync(p))import(p).then(m=>m.main?.()).catch(e=>console.warn('[omx] Postinstall skipped after a n...
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/cli/__tests__/detached-leader-teardown.test.jsView file
340patternName = github_fine_grained
severity = critical
line = 340
Findings
4 Critical6 High6 Medium5 Low
CriticalRed Install Lifecycle Scriptpackage.json
CriticalCritical Secretdist/cli/__tests__/detached-leader-teardown.test.js
CriticalPrevious Version Dangerous Deltadist/evals/astra-defaults/collector.js
CriticalSecret Patterndist/cli/__tests__/detached-leader-teardown.test.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/autoresearch/runtime.js
HighShelldist/autoresearch/runtime.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli/setup.js
HighRuntime Package Installdist/evals/astra-defaults/collector.js
HighSemantic Analysis Limiteddist/cli/api.js#virtual:normalized:round1
Affected versions and remediation
This report applies to oh-my-codex@0.21.10.
See all versions of oh-my-codex for other recorded verdicts.
- Review the evidence and your use of oh-my-codex@0.21.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.