registry / oh-my-opencode / 4.15.0

oh-my-opencode@4.15.0

The Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 22 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 384 file(s), 6.34 MB of source, external domains: 127.0.0.1, api.github.com, biomejs.dev, bun.sh, clangd.llvm.org, cli.github.com, clojure-lsp.io, deno.land, eu-assets.i.posthog.com, eu.i.posthog.com, github.com, gleam.run, json-schema.org, mcp.context7.com, models.dev, nodejs.org, posthog.com, registry.npmjs.org, sentry.io, us-assets.i.posthog.com, us.i.posthog.com, yandex.com, your-server.example.com

Oversized source lightweight scan

dist/cli/index.js2.85 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoShellHighEntropyStringsTelemetryUrlStrings127.0.0.1cli.github.comgithub.comyour-server.example.com

dist/cli-node/index.js2.81 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoShellHighEntropyStringsTelemetryUrlStrings127.0.0.1github.comyour-server.example.com

dist/index.js5.18 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsHighEntropyStringsTelemetryUrlStringsposthog.comsentry.ious.i.posthog.com

Source & flagged code

13 flagged

package.jsonView file

Lines 95-135json

95 "./tui": "./dist/tui.js",

96 "./schema.json": "./dist/oh-my-opencode.schema.json"

97 },

98 "scripts": {

99 "build": "bun run build:git-bash-mcp && bun run build:lsp-tools-mcp && bun run build:lsp-daemon && bun run build:codex-plugin && bun build packages/omo-opencode/src/index.ts --outdir dist --target bun --format esm --external zod && bun build packages/omo-opencode/src/tui.ts --outdir dist --target bun --format esm --external @opentui/core --external @opentui/keymap --external @opentui/solid && bun run build:shared-skills-assets && bun run build:node-require-shim && tsc --emitDeclarationOnly && bun build packages/omo-opencode/src/cli/index.ts --outdir dist/cli --target bun --format esm && bu ...

100 "build:cli-node": "bun run script/build-cli-node.ts",

101 "build:codex-install": "bun run script/build-codex-install.ts",

102 "build:codex-plugin": "npm --prefix packages/omo-codex/plugin ci && bun run --cwd packages/omo-codex/plugin build",

103 "build:materialize-frontend": "node packages/omo-codex/plugin/scripts/materialize-shared-upstreams.mjs --strict",

104 "build:shared-skills-assets": "bun run build:materialize-frontend && rm -rf dist/skills && cp -R packages/shared-skills/skills dist/skills",

105 "build:lsp-tools-mcp": "npm --prefix packages/lsp-tools-mcp ci && npm --prefix packages/lsp-tools-mcp run build",

106 "build:lsp-daemon": "npm --prefix packages/lsp-daemon ci && npm --prefix packages/lsp-daemon run build",

107 "build:node-require-shim": "bun run script/patch-node-require-shim.ts",

108 "build:all": "bun run build && bun run build:binaries",

109 "build:binaries": "bun run script/build-binaries.ts",

110 "build:schema": "bun run script/build-schema.ts",

111 "build:model-capabilities": "bun run script/build-model-capabilities.ts",

112 "clean": "rm -rf dist",

113 "prepack": "bun run build:materialize-frontend",

114 "prepare": "bun run build",

115 "postinstall": "node postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L115

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L115

116 "prepublishOnly": "bun run clean && bun run build:lsp-tools-mcp && bun run build:lsp-daemon && bun run build",

117 "test:model-capabilities": "bun test packages/model-core/src/model-capability-aliases.test.ts packages/model-core/src/model-capability-guardrails.test.ts packages/model-core/src/model-capabilities.test.ts packages/omo-opencode/src/cli/doctor/checks/model-resolution.test.ts --bail",

118 "typecheck": "tsgo --noEmit && bun run typecheck:script && bun run typecheck:packages",

119 "typecheck:packages": "tsgo --noEmit -p packages/rules-engine/tsconfig.json && tsgo --noEmit -p packages/delegate-core/tsconfig.json && tsgo --noEmit -p packages/mcp-stdio-core/tsconfig.json && tsgo --noEmit -p packages/mcp-client-core/tsconfig.json &&

120 "typecheck:script": "tsgo --noEmit -p script/tsconfig.json",

121 "test": "bun test",

122 "test:codex": "bun run build:codex-install && bun run build:git-bash-mcp && bun run build:lsp-tools-mcp && bun run build:lsp-daemon && npm --prefix packages/lsp-tools-mcp test && npm --prefix packages/omo-codex/plugin ci && bun run --cwd packages/omo-codex/plugin build && npm --prefix packages/omo-codex/plugin/components/codegraph run typecheck && npm --prefix packages/omo-codex/plugin/components/codegraph test && node scripts/check-third-party-notices.mjs --ship && bun test packages/omo-opencode/src/cli/cli-installer.platform.test.ts packages/omo-codex/src/install/codex-cache.test.ts pack ...

123 "test:windows-codex": "bun run test:codex",

124 "build:git-bash-mcp": "bun run --cwd packages/git-bash-mcp build"

125 },

126 "keywords": [

127 "opencode",

128 "plugin",

129 "oracle",

130 "librarian",

131 "agents",

132 "ai",

133 "llm"

134 ],

135 "author": "YeonGyu-Kim",

Long lines were clipped for display.

bin/oh-my-opencode.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

2// bin/oh-my-opencode.js

3// Wrapper script that detects platform and spawns the correct binary

5import { spawnSync } from "node:child_process";

6import { existsSync, readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/oh-my-opencode.jsView on unpkg · L4

7import { createRequire } from

dist/tui.jsView file

4254import { promisify as promisify2 } from "util"; L4255: var execAsync; L4256: var init_execute_command = __esm(() => {

High

Shell

Package source references shell execution.

dist/tui.jsView on unpkg · L4254

189var init_js_yaml = __esm(() => { L190: /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */ L191: __create2 = Object.create; ... L619: for (;index < max; index++) { L620: if (!isHexCode(data.charCodeAt(index))) L621: return false; ... L3907: const osProvider = options.osProvider ?? os; L3908: const env = options.env ?? process.env; L3909: const preferredDir = env.XDG_DATA_HOME ?? path.join(osProvider.homedir(), ".local", "share"); L3910: return resolveWritableDirectory(preferredDir, `${appName}-data`, osProvider); ... L4214: // [redacted].ts L4215: import { execFile } from "child_process";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/tui.jsView on unpkg · L189

postinstall.mjsView file

Lines 60-100javascript

60 const result = require("child_process").execSync("opencode --version", {

61 encoding: "utf-8",

62 stdio: ["pipe", "pipe", "ignore"],

63 });

64 const version = result.

packages/omo-codex/scripts/install-local-entrypoint.test.mjsView file

64// when L65: const output = execFileSync( L66: process.execPath, ... L71: // then L72: assert.equal(output, "npx --yes oh-my-openagent@latest install --platform=codex --no-tui --codex-autonomous"); L73: });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

packages/omo-codex/scripts/install-local-entrypoint.test.mjsView on unpkg · L64

dist/skills/ast-grep/install.shView file

•path = dist/skills/ast-grep/install.sh kind = build_helper sizeBytes = 7581 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/skills/ast-grep/install.shView on unpkg

dist/skills/ast-grep/tests/smoke.ps1View file

•path = dist/skills/ast-grep/tests/smoke.ps1 kind = payload_in_excluded_dir sizeBytes = 5701 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/skills/ast-grep/tests/smoke.ps1View on unpkg

dist/cli-node/index.jsView file

•path = dist/cli-node/index.js kind = oversized_source_file sizeBytes = 2943305 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli-node/index.jsView on unpkg

•path = dist/cli-node/index.js kind = oversized_cli_entrypoint sizeBytes = 2943305 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli-node/index.jsView on unpkg

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/oh-my-opencode.jsView file

4L5: import { spawnSync } from "node:child_process"; L6: import { existsSync, readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/oh-my-opencode.jsView on unpkg · L4

4Cross-file remote execution chain: bin/oh-my-opencode.js spawns packages/omo-codex/scripts/install-dist/install-local.mjs; helper contains network access plus dynamic code execution. L4: L5: import { spawnSync } from "node:child_process"; L6: import { existsSync, readFileSync } from "node:fs"; ... L23: function getLibcFamily() { L24: if (process.platform !== "linux") { L25: return undefined; // Not needed on non-Linux ... L41: L42: if (process.env.OH_MY_OPENCODE_FORCE_BASELINE === "1") { L43: return false; ... L63: L64: return probe.stdout.toUpperCase().includes("AVX2"); L65: }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/oh-my-opencode.jsView on unpkg · L4

16L17: const require = createRequire(import.meta.url); L18:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/oh-my-opencode.jsView on unpkg · L16

dist/tui.jsView file

4254import { promisify as promisify2 } from "util"; L4255: var execAsync; L4256: var init_execute_command = __esm(() => {

High

Shell

Package source references shell execution.

dist/tui.jsView on unpkg · L4254

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/tui.jsView on unpkg · L189

postinstall.mjsView file

80package = oh-my-opencode; repositoryIdentity = oh-my-openagent; dependency = detect-libc L80: try { L81: const detectLibc = require("detect-libc"); L82: return detectLibc.familySync();

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

postinstall.mjsView on unpkg · L80

packages/omo-codex/scripts/install-local-entrypoint.test.mjsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

packages/omo-codex/scripts/install-local-entrypoint.test.mjsView on unpkg · L64

dist/skills/ast-grep/install.shView file

•path = dist/skills/ast-grep/install.sh kind = build_helper sizeBytes = 7581 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/skills/ast-grep/install.shView on unpkg

dist/skills/ast-grep/tests/smoke.ps1View file

•path = dist/skills/ast-grep/tests/smoke.ps1 kind = payload_in_excluded_dir sizeBytes = 5701 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/skills/ast-grep/tests/smoke.ps1View on unpkg

dist/cli-node/index.jsView file

•path = dist/cli-node/index.js kind = oversized_source_file sizeBytes = 2943305 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli-node/index.jsView on unpkg

•path = dist/cli-node/index.js kind = oversized_cli_entrypoint sizeBytes = 2943305 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli-node/index.jsView on unpkg

Findings

8 High7 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/oh-my-opencode.js

HighShelldist/tui.js

HighCopied Package Dependency Bridgepostinstall.mjs

HighCross File Remote Execution Contextbin/oh-my-opencode.js

HighRuntime Package Installpackages/omo-codex/scripts/install-local-entrypoint.test.mjs

HighPayload In Excluded Dirdist/skills/ast-grep/tests/smoke.ps1

HighOversized Source Filedist/cli-node/index.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/oh-my-opencode.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/skills/ast-grep/install.sh

MediumOversized Cli Entrypointdist/cli-node/index.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/tui.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

13 flagged

package.jsonView file

Lines 95-135json

95 "./tui": "./dist/tui.js",

96 "./schema.json": "./dist/oh-my-opencode.schema.json"

97 },

98 "scripts": {

100 "build:cli-node": "bun run script/build-cli-node.ts",

101 "build:codex-install": "bun run script/build-codex-install.ts",

102 "build:codex-plugin": "npm --prefix packages/omo-codex/plugin ci && bun run --cwd packages/omo-codex/plugin build",

103 "build:materialize-frontend": "node packages/omo-codex/plugin/scripts/materialize-shared-upstreams.mjs --strict",

104 "build:shared-skills-assets": "bun run build:materialize-frontend && rm -rf dist/skills && cp -R packages/shared-skills/skills dist/skills",

105 "build:lsp-tools-mcp": "npm --prefix packages/lsp-tools-mcp ci && npm --prefix packages/lsp-tools-mcp run build",

106 "build:lsp-daemon": "npm --prefix packages/lsp-daemon ci && npm --prefix packages/lsp-daemon run build",

107 "build:node-require-shim": "bun run script/patch-node-require-shim.ts",

108 "build:all": "bun run build && bun run build:binaries",

109 "build:binaries": "bun run script/build-binaries.ts",

110 "build:schema": "bun run script/build-schema.ts",

111 "build:model-capabilities": "bun run script/build-model-capabilities.ts",

112 "clean": "rm -rf dist",

113 "prepack": "bun run build:materialize-frontend",

114 "prepare": "bun run build",

115 "postinstall": "node postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L115

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L115

116 "prepublishOnly": "bun run clean && bun run build:lsp-tools-mcp && bun run build:lsp-daemon && bun run build",

118 "typecheck": "tsgo --noEmit && bun run typecheck:script && bun run typecheck:packages",

120 "typecheck:script": "tsgo --noEmit -p script/tsconfig.json",

121 "test": "bun test",

123 "test:windows-codex": "bun run test:codex",

124 "build:git-bash-mcp": "bun run --cwd packages/git-bash-mcp build"

125 },

126 "keywords": [

127 "opencode",

128 "plugin",

129 "oracle",

130 "librarian",

131 "agents",

132 "ai",

133 "llm"

134 ],

135 "author": "YeonGyu-Kim",

Long lines were clipped for display.

bin/oh-my-opencode.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

2// bin/oh-my-opencode.js

3// Wrapper script that detects platform and spawns the correct binary

5import { spawnSync } from "node:child_process";

6import { existsSync, readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/oh-my-opencode.jsView on unpkg · L4

7import { createRequire } from

dist/tui.jsView file

4254import { promisify as promisify2 } from "util"; L4255: var execAsync; L4256: var init_execute_command = __esm(() => {

High

Shell

Package source references shell execution.

dist/tui.jsView on unpkg · L4254

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/tui.jsView on unpkg · L189

postinstall.mjsView file

Lines 60-100javascript

60 const result = require("child_process").execSync("opencode --version", {

61 encoding: "utf-8",

62 stdio: ["pipe", "pipe", "ignore"],

63 });

64 const version = result.

packages/omo-codex/scripts/install-local-entrypoint.test.mjsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

packages/omo-codex/scripts/install-local-entrypoint.test.mjsView on unpkg · L64

dist/skills/ast-grep/install.shView file

•path = dist/skills/ast-grep/install.sh kind = build_helper sizeBytes = 7581 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/skills/ast-grep/install.shView on unpkg

dist/skills/ast-grep/tests/smoke.ps1View file

•path = dist/skills/ast-grep/tests/smoke.ps1 kind = payload_in_excluded_dir sizeBytes = 5701 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/skills/ast-grep/tests/smoke.ps1View on unpkg

dist/cli-node/index.jsView file

•path = dist/cli-node/index.js kind = oversized_source_file sizeBytes = 2943305 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli-node/index.jsView on unpkg

•path = dist/cli-node/index.js kind = oversized_cli_entrypoint sizeBytes = 2943305 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli-node/index.jsView on unpkg