registry / oh-my-opencode / 5.1.35
oh-my-opencode@5.1.35
The Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools
AI Security Review
scanned 19d ago · by lpm-firewall-aiInspected source resolves the lifecycle and dynamic-code findings as package maintenance and schema-validation behavior. The scanner's remote-response execution claim is not supported by the inspected execution sink, and the agent-integration locations show conditional MCP runtime copying.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
npm installation triggers postinstall.mjs.
Impact
No confirmed unauthorized data transfer, remote code execution, or broad agent configuration change was established.
Mechanism
The hook checks the host OpenCode version, removes matching oh-my-opencode cache directories, and locates the installed platform binary.
AI rationale
Inspected source resolves the lifecycle and dynamic-code findings as package maintenance and schema-validation behavior. The scanner's remote-response execution claim is not supported by the inspected execution sink, and the agent-integration locations show conditional MCP runtime copying.
Decision evidence
public snapshotAI called this Clean at 83.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json runs postinstall.mjs; the inspected hook checks the OpenCode version, clears this package's own plugin cache entries, and resolves the platform binary.
- Both CLI bundles conditionally copy declared bundled MCP runtime files when their source arguments appear in .mcp.json.
- The flagged new Function call in dist/index.js compiles generated schema-validation code.
- Flagged test files identify themselves as tests or smoke tests; the LSP process source imports spawn APIs for process handling.
Evidence against
- The package has an automatic postinstall hook and the bundle contains dynamic code generation, but inspected source does not show remote response code reaching that execution sink.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinified
Source & flagged code
25 flaggedpackage.jsonView file
1Install-time code directly mutates a foreign AI-agent control surface:
L62: "docs/reference/web-terminal-visual-qa.md",
L63: ".opencode/command",
L64: ".opencode/skills",
L65: ".agents/command",
L66: ".agents/skills",
L67: "packages/lsp-tools-mcp/package.json",
...
L97: "packages/prompts-core/prompts/ultrawork/codex.md",
L98: "packages/omo-codex/plugin/.codex-plugin",
L99: "!packages/omo-codex/plugin/node_modules",
...
L147: "test:fast": "bun run script/test-fast.ts",
L148: "test:senpi": "bun run build:senpi-plugin && tsgo --noEmit -p packages/omo-senpi/tsconfig.json && bun test --timeout 20000 packages/omo-senpi && bun test ./.agents/skills/senpi-qa/...
L149: "test:windows-codex": "bun run test:codex",
Write operation from dist/tui.js:
L2183: // packages/utils/src/xdg-data-dir.ts
L2184: i
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
package.jsonView on unpkg · L1•scripts.postinstall = node postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.mjs
Findings
6 Critical14 High9 Medium6 Low
CriticalSame File Env Network Executiondist/skills/browser/runtime/omowright/index.js
CriticalDownload Executedist/skills/browser/runtime/omowright/index.js
CriticalEncrypted Payload Temp Executiondist/cli-node/index.js
CriticalRemote Response Code Executiondist/index.js
CriticalAi Agent Control Hijackpackage.json
CriticalPrevious Version Dangerous Deltadist/cli-node/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/oh-my-opencode.js
HighShelldist/cli-node/index.js
HighEvaldist/skills/ulw-research/scripts/layout-probe.test.ts
HighCredential Redirect Persistencedist/index.js
Affected versions and remediation
This report applies to oh-my-opencode@5.1.35.
See all versions of oh-my-opencode for other recorded verdicts.
- Review the evidence and your use of oh-my-opencode@5.1.35 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.