registry / oh-my-customcode / 1.0.19

oh-my-customcode@1.0.19

Batteries-included agent harness for Claude Code

Static Scan Results

scanned 17d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 1.33 MB of source, external domains: docs.astral.sh, github.com, python.org, raw.githubusercontent.com, registry.npmjs.org

Source & flagged code

8 flagged

dist/index.jsView file

Lines 157-197javascript

157 for (const entry of entries) {

158 if (shouldSkipEntry(entry.name, options)) {

159 continue;

160 }

161 const srcPath = path.join(src, entry.name);

162 const destPath = path.join(dest, entry.name);

163 if (shouldSkipPath(destPath, dest, options.skipPaths)) {

164 continue;

165 }

166 if (entry.isSymbolicLink()) {

167 await handleSymlink(srcPath, destPath, options, fs);

168 } else if (entry.isDirectory()) {

169 await copyDirectory(srcPath, destPath, options);

170 } else if (entry.isFile()) {

171 await handleFile(srcPath, destPath, options, fs);

172 }

173 }

174}

175async function readJsonFile(path) {

176 const fs = await import("node:fs/promises");

177 const content = await fs.readFile(path, "utf-8");

178 return JSON.parse(content);

179}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L177

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L177

180async function writeJsonFile(path, data) {

181 const fs = await import("node:fs/promises");

182 const content = JSON.stringify(data, null, 2);

183 await fs.writeFile(path, content, "utf-8");

184}

185async function readTextFile(path) {

186 const fs = await import("node:fs/promises");

187 return fs.readFile(path, "utf-8");

188}

189async function writeTextFile(path, content) {

190 const fs = await import("node:fs/promises");

191 await ensureDirectory(dirname(path));

192 await fs.writeFile(path, content, "utf-8");

193}

194async function remove(path) {

195 const fs = await import("node:fs/promises");

196 const stat = await fs.stat(path);

197 if (stat.isDirectory()) {

Lines 826-866javascript

826 customComponents: overrides.customComponents ? deduplicateCustomComponents([

827 ...defaults.customComponents || [],

828 ...overrides.customComponents

829 ]) : defaults.customComponents

830 };

831}

832function migrateConfig

dist/cli/index.jsView file

21318} L21319: const execArgv = process2.execArgv ?? []; L21320: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {

High

Shell

Package source references shell execution.

dist/cli/index.jsView on unpkg · L21318

25004projectLatestSuffix: "(latest)", L25005: newVersionAvailable: "[Info] oh-my-customcode v{{latest}} available (current: v{{current}}). Run 'npm i -g oh-my-customcode' to upgrade.", L25006: selfUpdateDone: "✓ oh-my-customcode updated ({{from}} → {{to}})", ... L25008: selfUpdateReexec: "↻ Re-executing with updated CLI (v{{version}})...", L25009: reexecArgvMissing: "⚠ Cannot re-exec: process.argv[1] is empty — continuing without re-exec", L25010: allProjectSkippedSource: " ℹ Skipped: {{name}} (source project cannot self-update)",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L25004

30220{ pattern: /chmod\s+777/, name: "chmod 777", severity: "warn" }, L30221: { pattern: /\beval\s*\(/, name: "eval() usage", severity: "warn" }, L30222: {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli/index.jsView on unpkg · L30220

templates/.claude/install-hooks.shView file

•path = templates/.claude/install-hooks.sh kind = payload_in_excluded_dir sizeBytes = 3844 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/.claude/install-hooks.shView on unpkg

•path = templates/.claude/install-hooks.sh kind = build_helper sizeBytes = 3844 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/.claude/install-hooks.shView on unpkg

Source & flagged code

8 flagged · loading source

dist/index.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code