registry / oh-my-opencode / 5.1.38
oh-my-opencode@5.1.38
The Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools
AI Security Review
scanned 17d ago · by lpm-firewall-aiInspected source supports normal package setup and runtime behavior. The postinstall cache invalidation is scoped to this package’s OpenCode cache entries, and the scanner’s dynamic-evaluation and process-management matches resolve to test or LSP utility code.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
npm installation triggers the postinstall hook; the CLI wrapper runs when invoked by the user.
Impact
No confirmed compromise, credential disclosure, or unconsented broad agent configuration change was established.
Mechanism
The hook removes only cache directories matching configured package-name prefixes, then resolves a platform binary. The CLI passes the caller’s arguments to that binary.
AI rationale
Inspected source supports normal package setup and runtime behavior. The postinstall cache invalidation is scoped to this package’s OpenCode cache entries, and the scanner’s dynamic-evaluation and process-management matches resolve to test or LSP utility code.
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json runs `postinstall.mjs` during installation; the hook targets cache entries prefixed for this package’s OpenCode names.
- postinstall.mjs checks for a matching platform binary and reports when none is available; no unrelated install-time behavior was identified in the inspected hook.
- The LSP end-to-end scripts use Codex configuration paths as test inputs for rejection cases.
- The bundled CLI copies an MCP runtime only when its source argument appears in the project’s `.mcp.json`.
- dist/tui.js begins with ordinary bundled module helpers; no attack behavior was established from the inspected entry excerpt.
- The browser runtime excerpt implements browser network inspection and trace helpers; no unrelated credential transfer or attack behavior was established.
- The CLI wrapper runs the resolved platform binary with the caller’s arguments.
- The flagged `new Function` is in a layout-probe test helper, and its input is the test’s local path-function source.
Evidence against
- The package has an automatic postinstall hook that removes matching OpenCode plugin cache directories; the inspected code limits deletion to directories whose names start with this package’s configured package prefixes.
Source & flagged code
24 flaggedpackage.jsonView file
1Install-time code directly mutates a foreign AI-agent control surface:
L62: "docs/reference/web-terminal-visual-qa.md",
L63: ".opencode/command",
L64: ".opencode/skills",
L65: ".agents/command",
L66: ".agents/skills",
L67: "packages/lsp-tools-mcp/package.json",
...
L97: "packages/prompts-core/prompts/ultrawork/codex.md",
L98: "packages/omo-codex/plugin/.codex-plugin",
L99: "!packages/omo-codex/plugin/node_modules",
...
L147: "test:fast": "bun run script/test-fast.ts",
L148: "test:senpi": "bun run build:senpi-plugin && tsgo --noEmit -p packages/omo-senpi/tsconfig.json && bun test --timeout 20000 packages/omo-senpi && bun test ./.agents/skills/senpi-qa/...
L149: "test:windows-codex": "bun run test:codex",
Write operation from dist/tui.js:
L2183: // packages/utils/src/xdg-data-dir.ts
L2184: i
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
package.jsonView on unpkg · L1•scripts.postinstall = node postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.mjs
Findings
5 Critical14 High9 Medium6 Low
CriticalSame File Env Network Executiondist/skills/browser/runtime/omowright/index.js
CriticalDownload Executedist/skills/browser/runtime/omowright/index.js
CriticalEncrypted Payload Temp Executiondist/cli-node/index.js
CriticalAi Agent Control Hijackpackage.json
CriticalPrevious Version Dangerous Deltadist/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/oh-my-opencode.js
HighShelldist/cli-node/index.js
HighEvaldist/skills/ulw-research/scripts/layout-probe.test.ts
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/cli-node/index.js
Affected versions and remediation
This report applies to oh-my-opencode@5.1.38.
See all versions of oh-my-opencode for other recorded verdicts.
- Review the evidence and your use of oh-my-opencode@5.1.38 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.