registry / oh-my-opencode / 4.18.0
oh-my-opencode@4.18.0
⚠ Under reviewThe Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis flagged 23 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsTelemetryUrlStrings
Oversized source lightweight scan
dist/cli/index.js2.87 MB file, sampled 256 KB
FilesystemNetworkChildProcessEnvironmentVarsCryptoShellHighEntropyStringsTelemetryUrlStrings127.0.0.1cli.github.com
Source & flagged code
14 flaggedpackage.jsonView file
•scripts.postinstall = node postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/oh-my-opencode.jsView file
4L5: import { spawnSync } from "node:child_process";
L6: import { existsSync, readFileSync } from "node:fs";
High
Child Process
Package source references child process execution.
bin/oh-my-opencode.jsView on unpkg · L4Findings
1 Critical8 High7 Medium7 Low
CriticalPrevious Version Dangerous Deltapackages/omo-codex/plugin/components/codegraph/dist/cli.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/oh-my-opencode.js
HighShelldist/tui.js
HighCopied Package Dependency Bridgepostinstall.mjs
HighCross File Remote Execution Contextbin/oh-my-opencode.js
HighRuntime Package Installpackages/omo-codex/scripts/install-local-entrypoint.test.mjs
HighPayload In Excluded Dirdist/skills/ast-grep/tests/smoke.ps1
HighOversized Source Filedist/cli-node/index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Require
Affected versions and remediation
This report applies to oh-my-opencode@4.18.0.
See all versions of oh-my-opencode for other recorded verdicts.
- Review the evidence and your use of oh-my-opencode@4.18.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.