registry / oh-my-opencode-serverlocal / 0.1.12

oh-my-opencode-serverlocal@0.1.12

Custom serverlocal fork of oh-my-opencode-slim — fully owned, custom prompts + commands, dist synced via opencode-dotfiles

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 1.38 MB of source, external domains: 127.0.0.1, github.com, mcp.context7.com, mcp.exa.ai, mcp.grep.app, mcp.tavily.com, ohmyopencodeslim.com, registry.npmjs.org, unpkg.com, www.ibm.com, www.w3.org

Source & flagged code

6 flagged

dist/index.jsView file

49// src/utils/compat.ts L50: import { spawn as nodeSpawn } from "node:child_process"; L51: import { writeFile as fsWriteFile } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L49

124} L125: function escapePowerShellPath(path4) { L126: return path4.replace(/'/g, "''");

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L124

49// src/utils/compat.ts L50: import { spawn as nodeSpawn } from "node:child_process"; L51: import { writeFile as fsWriteFile } from "node:fs/promises"; ... L58: if (!stream.readable) { L59: resolve(Buffer.concat(chunks).toString("utf-8")); L60: return; ... L70: options?.stdin ?? "ignore", L71: options?.stdout ?? "pipe", L72: options?.stderr ?? "pipe" ... L106: function getWindowsBuildNumber() { L107: if (process.platform !== "win32") L108: return null;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L49

49// src/utils/compat.ts L50: import { spawn as nodeSpawn } from "node:child_process"; L51: import { writeFile as fsWriteFile } from "node:fs/promises"; ... L9124: _resolve: { value: function(href) { L9125: return new URL4(this._documentBaseURL).resolve(href); L9126: } }, ... L18774: try { L18775: const content = fs.readFileSync(configPath, "utf-8"); L18776: let rawConfig;

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L49

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L49

dist/cli/index.jsView file

Lines 1-41javascript

1#!/usr/bin/env bun

2// @bun

3import { createRequire } from "node:module";

4var __defProp = Object.defineProperty;

5var __returnValue = (v) => v;

Source & flagged code

6 flagged · loading source

dist/index.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code