oh-my-codex@0.21.45
Multi-agent orchestration layer for OpenAI Codex CLI
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe install hook is gated to global installs and hydrates the package's native runtime, which is consistent with the tool's purpose. The eval collector's automatic use of OPENAI_API_KEY with a third-party provider creates a real credential-handling risk, so this version warrants a warning rather than a publish block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
A user runs the eval collector with a model name that matches its internal-model pattern.
Impact
The OpenAI credential is presented to a third-party provider; the source does not establish whether this forwarding is expected or authorized by the user.
Mechanism
The collector configures https://api.layofflabs.com/v1 as the provider base URL and uses OPENAI_API_KEY as the provider's environment key.
AI rationale
The install hook is gated to global installs and hydrates the package's native runtime, which is consistent with the tool's purpose. The eval collector's automatic use of OPENAI_API_KEY with a third-party provider creates a real credential-handling risk, so this version warrants a warning rather than a publish block.
Evidence
dist/evals/astra-defaults/collector.js
Network endpoints2
api.layofflabs.comgithub.com
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The eval collector uses OPENAI_API_KEY for a provider it automatically selects as layofflabs, whose API base URL is https://api.layofflabs.com/v1.
- The postinstall hook does nothing for non-global installs; for global installs it hydrates the package's native runtime.
- Native runtime assets are fetched using the package repository's release configuration.
Evidence against
- The package describes itself as a Codex CLI orchestration tool, and its main and bin point to the expected dist entry points.
- The prepare script exits if the package's built entry points already exist; otherwise it bootstraps dependencies with scripts disabled and builds the package.
- The collector is an eval utility that clones the package's own repository at a configured revision; the reviewed source does not show it running at import or install time.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
23 flaggedpackage.jsonView file
•scripts.postinstall = node -e "const fs=require('fs');const p='./dist/scripts/postinstall.js';if(fs.existsSync(p))import(p).then(m=>m.main?.()).catch(e=>console.warn('[omx] Postinstall skipped after a n...
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "const fs=require('fs');const p='./dist/scripts/postinstall.js';if(fs.existsSync(p))import(p).then(m=>m.main?.()).catch(e=>console.warn('[omx] Postinstall skipped after a n...
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/cli/__tests__/detached-leader-teardown.test.jsView file
340patternName = github_fine_grained
severity = critical
line = 340
Findings
3 Critical17 High6 Medium5 Low
CriticalRed Install Lifecycle Scriptpackage.json
CriticalCritical Secretdist/cli/__tests__/detached-leader-teardown.test.js
CriticalSecret Patterndist/cli/__tests__/detached-leader-teardown.test.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/autoresearch/runtime.js
HighShelldist/autoresearch/runtime.js
HighRuntime Package Installdist/evals/astra-defaults/collector.js
HighSemantic Analysis Limiteddist/cli/api.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/ralplan/documented-leader-preflight.js
HighKnown Malware Source Similaritydist/scripts/smoke-packed-install.js
Affected versions and remediation
This report applies to oh-my-codex@0.21.45.
See all versions of oh-my-codex for other recorded verdicts.
- Review the evidence and your use of oh-my-codex@0.21.45 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.