registry  /  oh-my-opencode  /  4.16.2

oh-my-opencode@4.16.2

⚠ Under review

The Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 23 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsTelemetryUrlStrings
ManifestNo manifest risk signals triggered.
scanned 393 file(s), 6.29 MB of source, external domains: 127.0.0.1, api.github.com, biomejs.dev, bun.sh, clangd.llvm.org, cli.github.com, clojure-lsp.io, deno.land, eu-assets.i.posthog.com, eu.i.posthog.com, github.com, gleam.run, json-schema.org, mcp.context7.com, models.dev, nodejs.org, posthog.com, registry.npmjs.org, sentry.io, us-assets.i.posthog.com, us.i.posthog.com, yandex.com, your-server.example.com
Oversized source lightweight scan
dist/cli/index.js2.86 MB file, sampled 256 KB
FilesystemNetworkChildProcessEnvironmentVarsCryptoShellHighEntropyStringsTelemetryUrlStrings127.0.0.1cli.github.comgithub.comyour-server.example.com
dist/cli-node/index.js2.82 MB file, sampled 256 KB
FilesystemNetworkChildProcessEnvironmentVarsCryptoShellHighEntropyStringsTelemetryUrlStrings127.0.0.1cli.github.comgithub.comyour-server.example.com
dist/index.js5.19 MB file, sampled 256 KB
FilesystemNetworkChildProcessEnvironmentVarsHighEntropyStringsTelemetryUrlStringsposthog.comsentry.ious.i.posthog.com

Source & flagged code

14 flagged · loading source
package.jsonView file
•scripts.postinstall = node postinstall.mjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node postinstall.mjs
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
bin/oh-my-opencode.jsView file
4L5: import { spawnSync } from "node:child_process"; L6: import { existsSync, readFileSync } from "node:fs";
High
Child Process

Package source references child process execution.

bin/oh-my-opencode.jsView on unpkg · L4
4Cross-file remote execution chain: bin/oh-my-opencode.js spawns packages/omo-codex/scripts/install-dist/install-local.mjs; helper contains network access plus dynamic code execution. L4: L5: import { spawnSync } from "node:child_process"; L6: import { existsSync, readFileSync } from "node:fs"; ... L23: function getLibcFamily() { L24: if (process.platform !== "linux") { L25: return undefined; // Not needed on non-Linux ... L41: L42: if (process.env.OH_MY_OPENCODE_FORCE_BASELINE === "1") { L43: return false; ... L63: L64: return probe.stdout.toUpperCase().includes("AVX2"); L65: }
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/oh-my-opencode.jsView on unpkg · L4
16L17: const require = createRequire(import.meta.url); L18:
Medium
Dynamic Require

Package source references dynamic require/import behavior.

bin/oh-my-opencode.jsView on unpkg · L16
dist/tui.jsView file
74900parsed.args = ["/d", "/s", "/c", `"${shellCommand}"`]; L74901: parsed.command = process.env.comspec || "cmd.exe"; L74902: parsed.options.windowsVerbatimArguments = true;
High
Shell

Package source references shell execution.

dist/tui.jsView on unpkg · L74900
186var init_js_yaml = __esm(() => { L187: /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */ L188: __create2 = Object.create; ... L616: for (;index < max; index++) { L617: if (!isHexCode(data.charCodeAt(index))) L618: return false; ... L3905: const osProvider = options.osProvider ?? os; L3906: const env = options.env ?? process.env; L3907: const preferredDir = env.XDG_DATA_HOME ?? path.join(osProvider.homedir(), ".local", "share"); L3908: return resolveWritableDirectory(preferredDir, `${appName}-data`, osProvider); ... L4189: // [redacted].ts L4190: import { execFile } from "child_process";
Low
Weak Crypto

Package source references weak cryptographic algorithms.

dist/tui.jsView on unpkg · L186
postinstall.mjsView file
80package = oh-my-opencode; repositoryIdentity = oh-my-openagent; dependency = detect-libc L80: try { L81: const detectLibc = require("detect-libc"); L82: return detectLibc.familySync();
High
Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

postinstall.mjsView on unpkg · L80
packages/omo-codex/scripts/install-local-entrypoint.test.mjsView file
64// when L65: const output = execFileSync( L66: process.execPath, ... L71: // then L72: assert.equal(output, "npx --yes oh-my-openagent@latest install --platform=codex --no-tui --codex-autonomous"); L73: });
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

packages/omo-codex/scripts/install-local-entrypoint.test.mjsView on unpkg · L64
dist/skills/ast-grep/install.shView file
•path = dist/skills/ast-grep/install.sh kind = build_helper sizeBytes = 7581 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/skills/ast-grep/install.shView on unpkg
dist/skills/ast-grep/tests/smoke.ps1View file
•path = dist/skills/ast-grep/tests/smoke.ps1 kind = payload_in_excluded_dir sizeBytes = 5701 magicHex = [redacted]
High
Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/skills/ast-grep/tests/smoke.ps1View on unpkg
dist/cli-node/index.jsView file
•path = dist/cli-node/index.js kind = oversized_source_file sizeBytes = 2954127 magicHex = [redacted]
High
Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli-node/index.jsView on unpkg
•path = dist/cli-node/index.js kind = oversized_cli_entrypoint sizeBytes = 2954127 magicHex = [redacted]
Medium
Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli-node/index.jsView on unpkg
packages/omo-codex/plugin/components/codegraph/dist/cli.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = oh-my-opencode@4.15.0 matchedIdentity = npm:b2gtbXktb3BlbmNvZGU:4.15.0 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

packages/omo-codex/plugin/components/codegraph/dist/cli.jsView on unpkg

Findings

1 Critical8 High7 Medium7 Low
CriticalPrevious Version Dangerous Deltapackages/omo-codex/plugin/components/codegraph/dist/cli.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/oh-my-opencode.js
HighShelldist/tui.js
HighCopied Package Dependency Bridgepostinstall.mjs
HighCross File Remote Execution Contextbin/oh-my-opencode.js
HighRuntime Package Installpackages/omo-codex/scripts/install-local-entrypoint.test.mjs
HighPayload In Excluded Dirdist/skills/ast-grep/tests/smoke.ps1
HighOversized Source Filedist/cli-node/index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirebin/oh-my-opencode.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/skills/ast-grep/install.sh
MediumOversized Cli Entrypointdist/cli-node/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/tui.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings