registry / oh-my-opencode / 5.1.28
oh-my-opencode@5.1.28
The Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools
AI Security Review
scanned 27d ago · by lpm-firewall-aiThe automatic postinstall mutates an OpenCode plugin cache, warranting a warning under the agent-extension lifecycle policy. The inspected behavior is narrowly scoped to this package’s plugin cache and does not establish a blocking attack.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Installing the package through npm runs its postinstall script.
Impact
Existing cached copies of this package’s plugin can be deleted and later regenerated; no broader agent configuration mutation was established.
Mechanism
The script scans two OpenCode cache directories and recursively removes directories whose names start with the package’s plugin-name prefixes.
AI rationale
The automatic postinstall mutates an OpenCode plugin cache, warranting a warning under the agent-extension lifecycle policy. The inspected behavior is narrowly scoped to this package’s plugin cache and does not establish a blocking attack.
Evidence
package.jsonpostinstall.mjs
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The npm postinstall hook runs postinstall.mjs automatically.
- Postinstall scans the OpenCode cache and removes only directories matching this package’s plugin-name prefixes.
- The cache deletion is recursive and forced, so installing the package can remove cached plugin copies.
Evidence against
- The inspected download path stores a fetched archive and validates its entries before extraction; it does not execute the response as code.
- The inspected agent integration references are project or user configuration paths, not proof of unconsented broad control-surface mutation.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
23 flaggedpackage.jsonView file
1Install-time code directly mutates a foreign AI-agent control surface:
L62: "docs/reference/web-terminal-visual-qa.md",
L63: ".opencode/command",
L64: ".opencode/skills",
L65: ".agents/command",
L66: ".agents/skills",
L67: "packages/lsp-tools-mcp/package.json",
...
L97: "packages/prompts-core/prompts/ultrawork/codex.md",
L98: "packages/omo-codex/plugin/.codex-plugin",
L99: "!packages/omo-codex/plugin/node_modules",
...
L147: "test:fast": "bun run script/test-fast.ts",
L148: "test:senpi": "bun run build:senpi-plugin && tsgo --noEmit -p packages/omo-senpi/tsconfig.json && bun test --timeout 20000 packages/omo-senpi && bun test ./.agents/skills/senpi-qa/...
L149: "test:windows-codex": "bun run test:codex",
Write operation from dist/tui.js:
L2183: // packages/utils/src/xdg-data-dir.ts
L2184: i
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
package.jsonView on unpkg · L1•scripts.postinstall = node postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.mjs
Findings
4 Critical14 High9 Medium6 Low
CriticalSame File Env Network Executiondist/skills/browser/runtime/omowright/index.js
CriticalDownload Executedist/skills/browser/runtime/omowright/index.js
CriticalRemote Response Code Executiondist/index.js
CriticalAi Agent Control Hijackpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/oh-my-opencode.js
HighShelldist/cli-node/index.js
HighEvaldist/skills/ulw-research/scripts/layout-probe.test.ts
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/cli-node/index.js
HighSandbox Evasion Gated Capabilitydist/skills/browser/runtime/omowright/index.js
Affected versions and remediation
This report applies to oh-my-opencode@5.1.28.
See all versions of oh-my-opencode for other recorded verdicts.
- Review the evidence and your use of oh-my-opencode@5.1.28 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.