registry / oh-my-opencode / 5.1.24
oh-my-opencode@5.1.24
⚠ Under reviewThe Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools
AI Security Review
scanned 28d ago · by lpm-firewall-aiThe inspected excerpts do not independently establish malicious behavior, and the flagged dynamic function call is part of validator generation. A clean verdict requires citations for 14 distinct paths, which exceeds the 8-citation limit, so this requires manual review.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Package installation runs the declared postinstall hook; CLI setup runs when explicitly invoked.
Impact
No confirmed malicious impact was established from the inspected excerpts; the source citation limit prevents a clean verdict under the required coverage rule.
Mechanism
The inspected hook checks platform binary availability and removes matching entries from the package’s OpenCode cache. The CLI bundles conditionally copy MCP runtimes based on project configuration.
AI rationale
The inspected excerpts do not independently establish malicious behavior, and the flagged dynamic function call is part of validator generation. A clean verdict requires citations for 14 distinct paths, which exceeds the 8-citation limit, so this requires manual review.
Evidence
postinstall.mjspackage.jsondist/cli-node/index.jsdist/cli/index.js
Decision evidence
public snapshotAI called this Manual Review at 73.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json defines a postinstall hook that runs postinstall.mjs.
- postinstall.mjs removes matching oh-my-opencode and oh-my-openagent entries from the OpenCode cache.
- The two LSP QA scripts point their configuration paths into a home directory used for isolated QA.
- Both CLI bundles copy an MCP runtime only when its source argument appears in the project’s .mcp.json.
- The inspected new Function call generates a validator from schema code.
- The launcher imports child_process to start the selected platform binary.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
GitDependency
Source & flagged code
23 flaggedpackage.jsonView file
1Install-time code directly mutates a foreign AI-agent control surface:
L62: "docs/reference/web-terminal-visual-qa.md",
L63: ".opencode/command",
L64: ".opencode/skills",
L65: ".agents/command",
L66: ".agents/skills",
L67: "packages/lsp-tools-mcp/package.json",
...
L97: "packages/prompts-core/prompts/ultrawork/codex.md",
L98: "packages/omo-codex/plugin/.codex-plugin",
L99: "!packages/omo-codex/plugin/node_modules",
...
L147: "test:fast": "bun run script/test-fast.ts",
L148: "test:senpi": "bun run build:senpi-plugin && tsgo --noEmit -p packages/omo-senpi/tsconfig.json && bun test --timeout 20000 packages/omo-senpi && bun test ./.agents/skills/senpi-qa/...
L149: "test:windows-codex": "bun run test:codex",
Write operation from dist/tui.js:
L2183: // packages/utils/src/xdg-data-dir.ts
L2184: i
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
package.jsonView on unpkg · L1•scripts.postinstall = node postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.mjs
Findings
4 Critical14 High9 Medium6 Low
CriticalSame File Env Network Executiondist/skills/browser/runtime/omowright/index.js
CriticalDownload Executedist/skills/browser/runtime/omowright/index.js
CriticalRemote Response Code Executiondist/index.js
CriticalAi Agent Control Hijackpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/oh-my-opencode.js
HighShelldist/cli-node/index.js
HighEvaldist/skills/ulw-research/scripts/layout-probe.test.ts
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/cli-node/index.js
HighSandbox Evasion Gated Capabilitydist/skills/browser/runtime/omowright/index.js
Affected versions and remediation
This report applies to oh-my-opencode@5.1.24.
See all versions of oh-my-opencode for other recorded verdicts.
- Review the evidence and your use of oh-my-opencode@5.1.24 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.