registry / oh-my-hi / 0.15.0

oh-my-hi@0.15.0

Oh, so that's what your coding agents have been doing! — Claude Code & Codex harness insights dashboard

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 38 file(s), 725 KB of source, external domains: 127.0.0.1, api.github.com, code.claude.com, developers.openai.com, docs.anthropic.com, github.com, platform.claude.com, registry.npmjs.org, www.anthropic.com, www.w3.org

Source & flagged code

8 flagged

package.jsonView file

Lines 6-35json

6 "type": "git",

7 "url": "https://github.com/netil/oh-my-hi.git"

8 },

9 "author": "Jae Sung Park <alberto.park@gmail.com>",

10 "license": "MIT",

11 "bin": {

12 "oh-my-hi": "bin/oh-my-hi.mjs",

13 "omh": "bin/oh-my-hi.mjs"

14 },

15 "keywords": [

16 "claude-code",

17 "plugin",

18 "dashboard",

19 "harness",

20 "insights",

21 "analytics"

22 ],

23 "scripts": {

24 "test": "node --experimental-test-coverage --test test/*.test.mjs",

25 "build": "node scripts/generate-dashboard.mjs --data-only",

26 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 },

28 "homepage": "https://github.com/netil/oh-my-hi",

29 "dependencies": {

30 "better-sqlite3": "^11.7.0",

31 "billboard.js": "^4.0.3",

32 "esbuild": "^0.27.4"

33 }

34}

bin/oh-my-hi.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2// bin/oh-my-hi.mjs — standalone CLI entry point.

3//

4// Lets the dashboard run WITHOUT Claude Code: `npx oh-my-hi`, or a global

5// install exposing `oh-my-hi` / `omh`. It's a thin launcher that delegates to

6// the dashboard generator, which builds output/ and (in full mode) starts the

7// local server and opens a browser. All flags (--data-only, --help, --update,

8// <path>…) pass straight through.

9//

10// Data selection is by config-dir discovery (CLAUDE_CONFIG_DIR / CODEX_HOME),

11// independent of how this launcher was invoked.

scripts/serve.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2// @ts-check

3// serve.mjs — local HTTP server for oh-my-hi dashboard.

4//

5// Serves output/ as static files and exposes two API endpoints backed by

6// the SQLite snapshot written by generate-dashboard.mjs:

7// GET /api/meta — data.json with usage arrays stripped + segment index

8// GET /api/usage?... — queried usage payload from SQLite

9// GET /api/usage?format=csv|json&from=&to=&scope=

10// — token-usage export download (see handleUsageExport)

11// GET /api/search?q=... — FTS5 full-text search over user prompts

scripts/generate-dashboard.mjsView file

Lines 3-50javascript

3// generate-dashboard.mjs — oh-my-hi dashboard generator

5/**

6 * @typedef {{ id: string, label: string, type: 'global'|'project',

7 * configPath: string, projectPath: string|null }} Scope

8 */

10/**

11 * @typedef {{ globalClaudeTokens: number, projectClaudeTokens: number,

12 * autoMemoryTokens: number, skillsDescTokens: number,

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/oh-my-hi.mjsView file

11// independent of how this launcher was invoked. L12: import { spawn } from 'child_process'; L13: import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/oh-my-hi.mjsView on unpkg · L11

scripts/serve.mjsView file

413if (process.platform === 'darwin') execSync(`open "${launchUrl}"`); L414: else if (process.platform === 'win32') execSync(`start "" "${launchUrl}"`, { shell: true }); L415: else execSync(`xdg-open "${launchUrl}"`);

High

Shell

Package source references shell execution.

scripts/serve.mjsView on unpkg · L413

12L13: import http from 'http'; L14: import fs from 'fs'; L15: import path from 'path'; L16: import { execSync, spawnSync } from 'child_process'; L17: import { fileURLToPath } from 'url'; ... L25: // OMH_OUTPUT_DIR override matches generate-dashboard.mjs (also used by tests). L26: const OUTPUT_DIR = process.env.OMH_OUTPUT_DIR || path.join(ROOT, 'output'); L27: const LEGACY_DB_PATH = path.join(OUTPUT_DIR, 'oh-my-hi.sqlite');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/serve.mjsView on unpkg · L12

scripts/generate-dashboard.mjsView file

23import fs from 'fs'; L24: import { execSync, spawnSync, spawn } from 'child_process'; L25: ... L57: const __filename = fileURLToPath(import.meta.url); L58: const __dirname = path.dirname(__filename); L59: const ROOT = path.resolve(__dirname, '..'); L60: const TEMPLATES = path.join(ROOT, 'templates'); L61: const OUTPUT = process.env.OMH_OUTPUT_DIR || path.join(ROOT, 'output'); L62: ... L64: // Dev build: script is running from the source git checkout (the folder L65: // with .git and package.json name === "oh-my-hi"). Always L66: // rebuilds HTML from templates (skips mtime short-circuit),

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/generate-dashboard.mjsView on unpkg · L23

23Cross-file remote execution chain: scripts/generate-dashboard.mjs spawns templates/app.js; helper contains network access plus dynamic code execution. L23: import fs from 'fs'; L24: import { execSync, spawnSync, spawn } from 'child_process'; L25: ... L57: const __filename = fileURLToPath(import.meta.url); L58: const __dirname = path.dirname(__filename); L59: const ROOT = path.resolve(__dirname, '..'); L60: const TEMPLATES = path.join(ROOT, 'templates'); L61: const OUTPUT = process.env.OMH_OUTPUT_DIR || path.join(ROOT, 'output'); L62: ... L64: // Dev build: script is running from the source git checkout (the folder L65: // with .git and package.json name === "oh-my-hi"). Always L66: // rebuilds HTML from templates (skips mtime short-circuit),

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/generate-dashboard.mjsView on unpkg · L23

30console.log('oh-my-hi: installing dependencies...'); L31: execSync('npm install --omit=dev', { cwd: __boot_root, stdio: 'inherit' }); L32: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/generate-dashboard.mjsView on unpkg · L30

Findings

7 High4 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/oh-my-hi.mjs

HighShellscripts/serve.mjs

HighSame File Env Network Executionscripts/serve.mjs

HighSandbox Evasion Gated Capabilityscripts/generate-dashboard.mjs

HighCross File Remote Execution Contextscripts/generate-dashboard.mjs

HighRuntime Package Installscripts/generate-dashboard.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

package.jsonView file

Lines 6-35json

6 "type": "git",

7 "url": "https://github.com/netil/oh-my-hi.git"

8 },

9 "author": "Jae Sung Park <alberto.park@gmail.com>",

10 "license": "MIT",

11 "bin": {

12 "oh-my-hi": "bin/oh-my-hi.mjs",

13 "omh": "bin/oh-my-hi.mjs"

14 },

15 "keywords": [

16 "claude-code",

17 "plugin",

18 "dashboard",

19 "harness",

20 "insights",

21 "analytics"

22 ],

23 "scripts": {

24 "test": "node --experimental-test-coverage --test test/*.test.mjs",

25 "build": "node scripts/generate-dashboard.mjs --data-only",

26 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 },

28 "homepage": "https://github.com/netil/oh-my-hi",

29 "dependencies": {

30 "better-sqlite3": "^11.7.0",

31 "billboard.js": "^4.0.3",

32 "esbuild": "^0.27.4"

33 }

34}

bin/oh-my-hi.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2// bin/oh-my-hi.mjs — standalone CLI entry point.

3//

4// Lets the dashboard run WITHOUT Claude Code: `npx oh-my-hi`, or a global

5// install exposing `oh-my-hi` / `omh`. It's a thin launcher that delegates to

6// the dashboard generator, which builds output/ and (in full mode) starts the

7// local server and opens a browser. All flags (--data-only, --help, --update,

8// <path>…) pass straight through.

9//

10// Data selection is by config-dir discovery (CLAUDE_CONFIG_DIR / CODEX_HOME),

11// independent of how this launcher was invoked.

scripts/serve.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2// @ts-check

3// serve.mjs — local HTTP server for oh-my-hi dashboard.

4//

5// Serves output/ as static files and exposes two API endpoints backed by

6// the SQLite snapshot written by generate-dashboard.mjs:

7// GET /api/meta — data.json with usage arrays stripped + segment index

8// GET /api/usage?... — queried usage payload from SQLite

9// GET /api/usage?format=csv|json&from=&to=&scope=

10// — token-usage export download (see handleUsageExport)

11// GET /api/search?q=... — FTS5 full-text search over user prompts

scripts/generate-dashboard.mjsView file

Lines 3-50javascript

3// generate-dashboard.mjs — oh-my-hi dashboard generator

5/**

6 * @typedef {{ id: string, label: string, type: 'global'|'project',

7 * configPath: string, projectPath: string|null }} Scope

8 */

10/**

11 * @typedef {{ globalClaudeTokens: number, projectClaudeTokens: number,

12 * autoMemoryTokens: number, skillsDescTokens: number,