registry / oh-my-opencode / 5.1.23
oh-my-opencode@5.1.23
The Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools
AI Security Review
scanned 28d ago · by lpm-firewall-aiThe automatic install hook mutates OpenCode’s plugin cache by deleting this vendor’s cached package directories. This is a bounded first-party lifecycle risk, so it warrants a warning rather than a block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
npm installation runs the package postinstall hook.
Impact
Cached copies of this package’s OpenCode plugin may be removed, prompting a later refresh.
Mechanism
The hook scans two OpenCode cache directories and recursively removes directories whose names begin with this package’s vendor names and an @ separator.
AI rationale
The automatic install hook mutates OpenCode’s plugin cache by deleting this vendor’s cached package directories. This is a bounded first-party lifecycle risk, so it warrants a warning rather than a block.
Evidence
package.jsonpostinstall.mjs
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package runs postinstall.mjs automatically after installation.
- That hook removes matching oh-my-opencode and oh-my-openagent directories from OpenCode’s user cache recursively.
- The cache cleanup is limited to OpenCode cache directories and package names belonging to this package’s vendor.
Evidence against
- The inspected CLI integration code copies bundled MCP runtimes only when the project’s .mcp.json already references them.
- The inspected QA-script locations exercise test configuration paths and do not establish install-time agent configuration changes.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
23 flaggedpackage.jsonView file
1Install-time code directly mutates a foreign AI-agent control surface:
L62: "docs/reference/web-terminal-visual-qa.md",
L63: ".opencode/command",
L64: ".opencode/skills",
L65: ".agents/command",
L66: ".agents/skills",
L67: "packages/lsp-tools-mcp/package.json",
...
L97: "packages/prompts-core/prompts/ultrawork/codex.md",
L98: "packages/omo-codex/plugin/.codex-plugin",
L99: "!packages/omo-codex/plugin/node_modules",
...
L147: "test:fast": "bun run script/test-fast.ts",
L148: "test:senpi": "bun run build:senpi-plugin && tsgo --noEmit -p packages/omo-senpi/tsconfig.json && bun test --timeout 20000 packages/omo-senpi && bun test ./.agents/skills/senpi-qa/...
L149: "test:windows-codex": "bun run test:codex",
Write operation from dist/tui.js:
L2183: // packages/utils/src/xdg-data-dir.ts
L2184: i
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
package.jsonView on unpkg · L1•scripts.postinstall = node postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.mjs
Findings
4 Critical14 High9 Medium6 Low
CriticalSame File Env Network Executiondist/skills/browser/runtime/omowright/index.js
CriticalDownload Executedist/skills/browser/runtime/omowright/index.js
CriticalRemote Response Code Executiondist/index.js
CriticalAi Agent Control Hijackpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/oh-my-opencode.js
HighShelldist/cli-node/index.js
HighEvaldist/skills/ulw-research/scripts/layout-probe.test.ts
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/cli-node/index.js
HighSandbox Evasion Gated Capabilitydist/skills/browser/runtime/omowright/index.js
Affected versions and remediation
This report applies to oh-my-opencode@5.1.23.
See all versions of oh-my-opencode for other recorded verdicts.
- Review the evidence and your use of oh-my-opencode@5.1.23 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.