registry / oh-my-opencode / 4.16.3
oh-my-opencode@4.16.3
The Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection contradicts the scanner's malicious classification, but the bundled agent plugin has real lifecycle, telemetry, configuration-migration, and executable-provisioning capabilities. Per policy this is a warn-level first-party agent extension risk, not malware.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
npm postinstall; subsequently, user-installed Codex plugin SessionStart hooks.
Impact
A user-enabled agent extension can alter its managed configuration and execute downloaded tooling; no concrete malicious or unconsented install-time control-surface takeover was confirmed.
Mechanism
Package-owned agent hooks, telemetry, and checksum-verified runtime provisioning.
AI rationale
Source inspection contradicts the scanner's malicious classification, but the bundled agent plugin has real lifecycle, telemetry, configuration-migration, and executable-provisioning capabilities. Per policy this is a warn-level first-party agent extension risk, not malware.
Evidence
package.jsonpostinstall.mjspackages/omo-codex/plugin/.codex-plugin/plugin.jsonpackages/omo-codex/plugin/hooks/session-start-checking-auto-update.jsonpackages/omo-codex/plugin/scripts/auto-update.mjspackages/omo-codex/plugin/components/codegraph/dist/cli.js~/.cache/opencode~/.omo/codegraphCodex config.toml
Network endpoints3
us.i.posthog.comgithub.com/colbymchenry/codegraph/releases/download/v1.0.1/codegraph-linux-x64.tar.gzregistry.npmjs.org/@colbymchenry/codegraph-win32-x64/-/codegraph-win32-x64-1.0.1.tgz
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json runs postinstall.mjs on npm install.
- postinstall.mjs removes matching OpenCode plugin-cache directories.
- Codex SessionStart hook runs auto-update.mjs, which migrates OMO/Codex configuration.
- codegraph/dist/cli.js downloads checksum-pinned executables and later provisions them under ~/.omo/codegraph.
- telemetry hook sends activity through PostHog to us.i.posthog.com.
Evidence against
- postinstall.mjs only checks a local CLI, resolves its platform package, and invalidates this package's named cache entries.
- No postinstall network request, credential harvesting, or foreign agent-config write was found.
- Codegraph download URLs and SHA-256 values are fixed in source.
- The PowerShell file is an explicit ast-grep smoke test, not an inert hidden payload.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
14 flaggedpackage.jsonView file
•scripts.postinstall = node postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/oh-my-opencode.jsView file
4L5: import { spawnSync } from "node:child_process";
L6: import { existsSync, readFileSync } from "node:fs";
High
Child Process
Package source references child process execution.
bin/oh-my-opencode.jsView on unpkg · L4Findings
1 Critical8 High7 Medium7 Low
CriticalPrevious Version Dangerous Deltapackages/omo-codex/plugin/components/codegraph/dist/cli.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/oh-my-opencode.js
HighShelldist/tui.js
HighCopied Package Dependency Bridgepostinstall.mjs
HighCross File Remote Execution Contextbin/oh-my-opencode.js
HighRuntime Package Installpackages/omo-codex/scripts/install-local-entrypoint.test.mjs
HighPayload In Excluded Dirdist/skills/ast-grep/tests/smoke.ps1
HighOversized Source Filedist/cli-node/index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Require
Affected versions and remediation
This report applies to oh-my-opencode@4.16.3.
See all versions of oh-my-opencode for other recorded verdicts.
- Review the evidence and your use of oh-my-opencode@4.16.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.