registry / oh-my-opencode / 5.0.1
oh-my-opencode@5.0.1
The Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe automatic cache mutation is a concrete, package-aligned agent-extension lifecycle capability. Its scope is limited to the package's own identifiers, so the evidence supports a warning rather than a block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Installing the npm package runs its postinstall hook.
Impact
It can force an OpenCode plugin refresh without an explicit OpenCode command, creating a guarded extension-lifecycle risk.
Mechanism
The hook recursively removes cache directories whose names begin with the package's current or former OpenCode plugin name.
AI rationale
The automatic cache mutation is a concrete, package-aligned agent-extension lifecycle capability. Its scope is limited to the package's own identifiers, so the evidence supports a warning rather than a block.
Evidence
package.jsonpostinstall.mjs
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package runs postinstall.mjs automatically after installation.
- The install hook recursively deletes matching OpenCode plugin cache directories.
- The deletion targets this package and its renamed package identifier, making later OpenCode loads update from the package source.
Evidence against
- The inspected deletion is limited to package-name-prefixed OpenCode cache entries.
- The inspected LSP configuration references are test assertions that reject malformed and outside-project inputs.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
GitDependency
Source & flagged code
23 flaggedpackage.jsonView file
1Install-time code directly mutates a foreign AI-agent control surface:
L57: "docs/reference/web-terminal-visual-qa.md",
L58: ".opencode/command",
L59: ".opencode/skills",
L60: ".agents/command",
L61: ".agents/skills",
L62: "packages/lsp-tools-mcp/package.json",
...
L92: "packages/prompts-core/prompts/ultrawork/codex.md",
L93: "packages/omo-codex/plugin/.codex-plugin",
L94: "!packages/omo-codex/plugin/node_modules",
...
L142: "test:fast": "bun run script/test-fast.ts",
L143: "test:senpi": "bun run build:senpi-plugin && tsgo --noEmit -p packages/omo-senpi/tsconfig.json && bun test --timeout 20000 packages/omo-senpi && bun test ./.agents/skills/senpi-qa/...
L144: "test:windows-codex": "bun run test:codex",
Write operation from dist/tui.js:
L2183: // packages/utils/src/xdg-data-dir.ts
L2184: i
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
package.jsonView on unpkg · L1•scripts.postinstall = node postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.mjs
Findings
4 Critical14 High9 Medium6 Low
CriticalSame File Env Network Executiondist/skills/browser/runtime/omowright/index.js
CriticalDownload Executedist/skills/browser/runtime/omowright/index.js
CriticalRemote Response Code Executiondist/index.js
CriticalAi Agent Control Hijackpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/oh-my-opencode.js
HighShelldist/cli-node/index.js
HighEvaldist/skills/ulw-research/scripts/layout-probe.test.ts
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/cli-node/index.js
HighSandbox Evasion Gated Capabilitydist/skills/browser/runtime/omowright/index.js
Affected versions and remediation
This report applies to oh-my-opencode@5.0.1.
See all versions of oh-my-opencode for other recorded verdicts.
- Review the evidence and your use of oh-my-opencode@5.0.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.