oh-my-codex@0.21.6
Multi-agent orchestration layer for OpenAI Codex CLI
AI Security Review
scanned 24d ago · by lpm-firewall-aiThe package has a real agent configuration capability through explicit setup, which warrants a warning under the review policy. The inspected postinstall behavior does not establish an unconsented agent-control mutation or another concrete attack.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs the package setup command.
Impact
The generated instructions can affect later AI-agent behavior in that scope.
Mechanism
Setup merges generated agent instructions into an AGENTS.md file for the selected scope.
AI rationale
The package has a real agent configuration capability through explicit setup, which warrants a warning under the review policy. The inspected postinstall behavior does not establish an unconsented agent-control mutation or another concrete attack.
Evidence
dist/cli/setup.js
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package defines a postinstall hook that imports its postinstall module.
- The postinstall handler returns without action for local installs; global installs hydrate a native runtime and update an install stamp.
- Setup is a callable CLI operation that writes managed agent instructions into project or user configuration.
- Setup is invoked through the CLI setup flow, so the agent configuration changes are user-command initiated.
Evidence against
- The inspected postinstall path does not invoke setup or mutate agent configuration.
- The setup operation includes scope and merge options and writes managed content through its setup flow.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
11 flaggedpackage.jsonView file
•scripts.postinstall = node -e "const fs=require('fs');const p='./dist/scripts/postinstall.js';if(fs.existsSync(p))import(p).then(m=>m.main?.()).catch(e=>console.warn('[omx] Postinstall skipped after a n...
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "const fs=require('fs');const p='./dist/scripts/postinstall.js';if(fs.existsSync(p))import(p).then(m=>m.main?.()).catch(e=>console.warn('[omx] Postinstall skipped after a n...
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/autoresearch/runtime.jsView file
1import { execFileSync, spawnSync } from 'child_process';
L2: import { existsSync } from 'fs';
High
Child Process
Package source references child process execution.
dist/autoresearch/runtime.jsView on unpkg · L1273encoding: 'utf-8',
L274: shell: true,
L275: maxBuffer: 1024 * 1024,
High
dist/cli/hooks.jsView file
40const moduleUrl = `${pathToFileURL(filePath).href}?t=${Date.now()}`;
L41: const mod = await import(moduleUrl);
L42: if (typeof mod.onHookEvent !== 'function') {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/cli/hooks.jsView on unpkg · L40dist/scripts/smoke-packed-install.jsView file
4import { delimiter, dirname, isAbsolute, join, resolve } from 'node:path';
L5: import { spawn, spawnSync } from 'node:child_process';
L6: import { pathToFileURL } from 'node:url';
L7: import { TextDecoder } from 'node:util';
L8: import TOML, { parse as parseToml } from '@iarna/toml';
...
L204: }
L205: export function [redacted](testCase, baseEnv = process.env, runtimeBinary) {
L206: const insideTmux = testCase.insideTmux === true;
...
L269: });
L270: const CODEX_APP_SERVER_MAX_STDOUT_FRAME_LENGTH = 1_048_576;
L271: export class CodexExecutableNotFoundError extends Error {
...
L371: function resolvePinnedCodexExecutable(cwd, env, seam = {}) {
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/scripts/smoke-packed-install.jsView on unpkg · L4dist/cli/setup.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
me(receiptpath), { recursive: true });
await writefile(receiptpath, `${json.stringify(receipt, null, 2)}\n`);
}
catch {
}
}
async function isomxmanagedinstalledskilldir(skilldir) {
const skillmdpath = join(skilldir, "skill.md");
if (!existssync(skillmdpath))
return false;
try {
const metadata = parseskillfrontmatter(await readfile(skillmdpath, "utf-8"), skillmdpath);
return metadata.description.startswith(installed_skill_badge_prefix);
}
catch {
return false;
}
}
function [redacted](content, filepath = "skill.md"
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/cli/setup.jsView on unpkgdist/mcp/code-intel-server.jsView file
556try {
L557: const { stdout } = await exec('npx', ['tsc', '--version'], { timeout: 10000 });
L558: checks['typescript'] = { available: true, version: stdout.trim() };
...
L561: process.stderr.write(`[code-intel-server] operation failed: ${err}\n`);
L562: checks['typescript'] = { available: false, note: 'Install: npm i -D typescript' };
L563: }
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/mcp/code-intel-server.jsView on unpkg · L556src/scripts/run-autoresearch-showcase.shView file
•path = src/scripts/run-autoresearch-showcase.sh
kind = build_helper
sizeBytes = 1989
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
src/scripts/run-autoresearch-showcase.shView on unpkgdist/cli/api.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 10
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/cli/api.js#virtual:normalized:round1View on unpkgdist/cli/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = oh-my-codex@0.21.5
matchedIdentity = npm:b2gtbXktY29kZXg:0.21.5
similarity = 0.725
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli/index.jsView on unpkgFindings
2 Critical6 High6 Medium5 Low
CriticalRed Install Lifecycle Scriptpackage.json
CriticalPrevious Version Dangerous Deltadist/cli/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/autoresearch/runtime.js
HighShelldist/autoresearch/runtime.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli/setup.js
HighRuntime Package Installdist/mcp/code-intel-server.js
HighSemantic Analysis Limiteddist/cli/api.js#virtual:normalized:round1
MediumDynamic Requiredist/cli/hooks.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/scripts/smoke-packed-install.js
MediumShips Build Helpersrc/scripts/run-autoresearch-showcase.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to oh-my-codex@0.21.6.
See all versions of oh-my-codex for other recorded verdicts.
- Review the evidence and your use of oh-my-codex@0.21.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.