registry / oh-my-opencode / 5.1.29
oh-my-opencode@5.1.29
The Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe scanner hints led to package-specific setup, QA fixtures, test code, and bundled runtime behavior on inspection. The lifecycle hook’s cache cleanup is limited to this package’s plugin names, and no concrete malicious behavior was established.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
npm install runs the package postinstall hook; CLI setup and runtime actions require their corresponding user invocation.
Impact
The inspected behavior can remove this package’s cached plugin copies and perform package setup; no secret theft, broad agent configuration change, or malicious payload execution was established.
Mechanism
The postinstall code checks for a platform binary and clears cached directories whose names match this package’s plugin names. The inspected CLI code copies bundled MCP runtime files only when configured source arguments match.
AI rationale
The scanner hints led to package-specific setup, QA fixtures, test code, and bundled runtime behavior on inspection. The lifecycle hook’s cache cleanup is limited to this package’s plugin names, and no concrete malicious behavior was established.
Evidence
postinstall.mjsdist/cli-node/index.jsdist/cli/index.js
Decision evidence
public snapshotAI called this Clean at 87.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json confirms the registry install hook only runs postinstall.mjs; the executable also has prepare and build hooks.
- postinstall checks platform binaries and removes cached directories only when their names begin with this package’s two plugin names.
- The QA target scripts describe disposable Codex/OpenCode environments, and the CLI runtime-copy code only copies bundled MCP files when matching source arguments exist.
- The flagged probe, browser runtime, terminal bundle, LSP implementation, cancellation test, and smoke test show test, bundled-library, or LSP process-management context; no concrete attack behavior was established in the inspected excerpts.
- The bundled archive downloader fetches an archive and writes it to a cache path; the inspected flow validates archive entries before extraction.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
23 flaggedpackage.jsonView file
1Install-time code directly mutates a foreign AI-agent control surface:
L62: "docs/reference/web-terminal-visual-qa.md",
L63: ".opencode/command",
L64: ".opencode/skills",
L65: ".agents/command",
L66: ".agents/skills",
L67: "packages/lsp-tools-mcp/package.json",
...
L97: "packages/prompts-core/prompts/ultrawork/codex.md",
L98: "packages/omo-codex/plugin/.codex-plugin",
L99: "!packages/omo-codex/plugin/node_modules",
...
L147: "test:fast": "bun run script/test-fast.ts",
L148: "test:senpi": "bun run build:senpi-plugin && tsgo --noEmit -p packages/omo-senpi/tsconfig.json && bun test --timeout 20000 packages/omo-senpi && bun test ./.agents/skills/senpi-qa/...
L149: "test:windows-codex": "bun run test:codex",
Write operation from dist/tui.js:
L2183: // packages/utils/src/xdg-data-dir.ts
L2184: i
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
package.jsonView on unpkg · L1•scripts.postinstall = node postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.mjs
Findings
4 Critical14 High9 Medium6 Low
CriticalSame File Env Network Executiondist/skills/browser/runtime/omowright/index.js
CriticalDownload Executedist/skills/browser/runtime/omowright/index.js
CriticalRemote Response Code Executiondist/index.js
CriticalAi Agent Control Hijackpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/oh-my-opencode.js
HighShelldist/cli-node/index.js
HighEvaldist/skills/ulw-research/scripts/layout-probe.test.ts
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/cli-node/index.js
HighSandbox Evasion Gated Capabilitydist/skills/browser/runtime/omowright/index.js
Affected versions and remediation
This report applies to oh-my-opencode@5.1.29.
See all versions of oh-my-opencode for other recorded verdicts.
- Review the evidence and your use of oh-my-opencode@5.1.29 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.