registry / oh-my-codex / 0.21.9
oh-my-codex@0.21.9
Multi-agent orchestration layer for OpenAI Codex CLI
AI Security Review
scanned 24d ago · by lpm-firewall-aiSource inspection supports a package-aligned Codex CLI with explicit setup and a global-install-only native runtime hydration step. The flagged eval process is fixture-driven, and the inspected evidence does not establish malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Global npm installation may invoke postinstall; agent setup is invoked through the package's setup command.
Impact
The inspected behavior supports the package's Codex orchestration function; no concrete attack impact was established.
Mechanism
The postinstall path skips local installs and attempts bounded native runtime hydration for global installs. The setup module provisions package assets and configuration through its CLI workflow.
AI rationale
Source inspection supports a package-aligned Codex CLI with explicit setup and a global-install-only native runtime hydration step. The flagged eval process is fixture-driven, and the inspected evidence does not establish malicious behavior.
Evidence
package.jsondist/scripts/postinstall.jsdist/cli/setup.js
Decision evidence
public snapshotAI called this Clean at 79.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest limits its postinstall to dispatching a local script; that script does nothing for local installs and hydrates the runtime only for global installs.
- The setup module is the package’s explicit setup command and installs Codex-related assets and configuration.
- The flagged eval collector launches Codex through npx as part of fixture collection; its source does not establish install-time execution.
- The flagged test and configuration locations concern Codex paths, agent setup, auth storage, plugin configuration, or local binary paths; the inspected excerpts do not show an attack.
- No concrete credential exfiltration, stealth persistence, destructive behavior, or unconsented broad control-surface mutation was established.
Evidence against
- The package has a postinstall lifecycle hook, and global installs may hydrate a native runtime binary.
- The setup command writes agent-related configuration, but it is reached through explicit setup and the examined source shows overwrite guards or user scope handling.
Behavioral surface
ChildProcess
Source & flagged code
12 flaggedpackage.jsonView file
•scripts.postinstall = node -e "const fs=require('fs');const p='./dist/scripts/postinstall.js';if(fs.existsSync(p))import(p).then(m=>m.main?.()).catch(e=>console.warn('[omx] Postinstall skipped after a n...
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "const fs=require('fs');const p='./dist/scripts/postinstall.js';if(fs.existsSync(p))import(p).then(m=>m.main?.()).catch(e=>console.warn('[omx] Postinstall skipped after a n...
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/cli/__tests__/detached-leader-teardown.test.jsView file
340patternName = github_fine_grained
severity = critical
line = 340
Findings
3 Critical6 High6 Medium5 Low
CriticalRed Install Lifecycle Scriptpackage.json
CriticalCritical Secretdist/cli/__tests__/detached-leader-teardown.test.js
CriticalSecret Patterndist/cli/__tests__/detached-leader-teardown.test.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/autoresearch/runtime.js
HighShelldist/autoresearch/runtime.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli/setup.js
HighRuntime Package Installdist/evals/astra-defaults/collector.js
HighSemantic Analysis Limiteddist/cli/api.js#virtual:normalized:round1
MediumDynamic Requiredist/cli/hooks.js
MediumNetwork
Affected versions and remediation
This report applies to oh-my-codex@0.21.9.
See all versions of oh-my-codex for other recorded verdicts.
- Review the evidence and your use of oh-my-codex@0.21.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.