registry / oh-my-codex / 0.21.28
oh-my-codex@0.21.28
Multi-agent orchestration layer for OpenAI Codex CLI
AI Security Review
scanned 14d ago · by lpm-firewall-aiSource inspection found no concrete attack behavior. The lifecycle hook’s runtime hydration is package-aligned, while agent and setup configuration changes are dispatched through the explicit CLI setup command.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The postinstall hook runs during installation; its source returns without action for local installs. Setup requires invoking the separate CLI setup command.
Impact
No harmful effect was established from the inspected behavior.
Mechanism
For global installs, postinstall hydrates the package’s native runtime and records an install version. Setup writes configured product files and preferences when explicitly invoked.
AI rationale
Source inspection found no concrete attack behavior. The lifecycle hook’s runtime hydration is package-aligned, while agent and setup configuration changes are dispatched through the explicit CLI setup command.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json invokes the postinstall hook, but dist/scripts/postinstall.js returns immediately for local installs; on global installs it hydrates the package’s native runtime and records the installed version.
- dist/cli/index.js dispatches setup only for the explicit setup command. The inspected setup code writes setup preferences; the postinstall path does not call setup.
- The required runtime and agent integration paths reviewed contain CLI, state, authentication, and configuration behavior; no install-time credential transfer or unconsented broad agent configuration write was established.
- The inspected manifests for the prepared TOML, MCP SDK, and LZMA dependencies have no install lifecycle scripts. The secret-like test data is used in redaction tests.
Evidence against
- The test secret pattern is synthetic redaction-test input, not evidence of a package credential.
- The scanner’s install-time setup concern is not supported by the source: the lifecycle hook does not invoke setup, which is dispatched by the explicit CLI command.
Behavioral surface
Source & flagged code
13 flaggedpackage.jsonView file
•scripts.postinstall = node -e "const fs=require('fs');const p='./dist/scripts/postinstall.js';if(fs.existsSync(p))import(p).then(m=>m.main?.()).catch(e=>console.warn('[omx] Postinstall skipped after a n...
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "const fs=require('fs');const p='./dist/scripts/postinstall.js';if(fs.existsSync(p))import(p).then(m=>m.main?.()).catch(e=>console.warn('[omx] Postinstall skipped after a n...
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/cli/__tests__/detached-leader-teardown.test.jsView file
340patternName = github_fine_grained
severity = critical
line = 340
Findings
4 Critical6 High6 Medium5 Low
CriticalRed Install Lifecycle Scriptpackage.json
CriticalCritical Secretdist/cli/__tests__/detached-leader-teardown.test.js
CriticalPrevious Version Dangerous Deltadist/auth/hotswap.js
CriticalSecret Patterndist/cli/__tests__/detached-leader-teardown.test.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/autoresearch/runtime.js
HighShelldist/autoresearch/runtime.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli/setup.js
HighRuntime Package Installdist/evals/astra-defaults/collector.js
HighSemantic Analysis Limiteddist/cli/api.js#virtual:normalized:round1
Medium
Affected versions and remediation
This report applies to oh-my-codex@0.21.28.
See all versions of oh-my-codex for other recorded verdicts.
- Review the evidence and your use of oh-my-codex@0.21.28 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.