registry / oh-my-opencode / 5.1.43
oh-my-opencode@5.1.43
The Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools
AI Security Review
scanned 13d ago · by lpm-firewall-aiSource inspection resolves the high-risk matches to package-scoped installation cleanup, request-timeout handling, test code, ordinary schema and browser functionality, and opt-out daily activity telemetry. The default telemetry is disclosed in configuration and does not establish a concrete attack.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Package installation runs the postinstall hook; loading the plugin triggers its activity event.
Impact
The inspected source did not establish credential theft, destructive behavior, remote payload execution, or broad agent control changes.
Mechanism
The install hook checks the OpenCode version and platform binary. Plugin telemetry sends a daily activity event with a hostname-derived hash to the default analytics endpoint and can be disabled through configuration or environment settings.
AI rationale
Source inspection resolves the high-risk matches to package-scoped installation cleanup, request-timeout handling, test code, ordinary schema and browser functionality, and opt-out daily activity telemetry. The default telemetry is disclosed in configuration and does not establish a concrete attack.
Evidence
package.jsonpostinstall.mjsdist/index.jsdist/skills/browser/runtime/omowright/index.js
Network endpoints1
us.i.posthog.com
Decision evidence
public snapshotAI called this Clean at 89.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest’s postinstall hook runs a platform check, and the cache cleanup is limited to OpenCode cache entries named for this package or its legacy name.
- The flagged LSP timer aborts a pending request when it times out; the flagged dynamic evaluation is in a selector test using a fixed HTML fixture.
- The smoke and CLI test files identify their test-harness context, and the schema dependency source contains parsing, validation, and localized error modules.
- The browser helper obtains cookies through the browser for the requested URL before making a fetch, consistent with domain-scoped browser cookies.
- Plugin startup records a daily activity event using a hostname-derived hash; the source provides configuration and environment controls to disable telemetry.
Evidence against
- Anonymous telemetry is enabled when its configuration is omitted and uses the default PostHog endpoint; the code limits the event to daily activity and allows configuration or environment opt-outs.
Behavioral surface
ChildProcessCrypto
Source & flagged code
23 flaggedpackage.jsonView file
1Install-time code directly mutates a foreign AI-agent control surface:
L62: "docs/reference/web-terminal-visual-qa.md",
L63: ".opencode/command",
L64: ".opencode/skills",
L65: ".agents/command",
L66: ".agents/skills",
L67: "packages/lsp-tools-mcp/package.json",
...
L97: "packages/prompts-core/prompts/ultrawork/codex.md",
L98: "packages/omo-codex/plugin/.codex-plugin",
L99: "!packages/omo-codex/plugin/node_modules",
...
L147: "test:fast": "bun run script/test-fast.ts",
L148: "test:senpi": "bun run build:senpi-plugin && tsgo --noEmit -p packages/omo-senpi/tsconfig.json && bun test --timeout 20000 packages/omo-senpi && bun test ./.agents/skills/senpi-qa/...
L149: "test:windows-codex": "bun run test:codex",
Write operation from dist/tui.js:
L2183: // packages/utils/src/xdg-data-dir.ts
L2184: i
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
package.jsonView on unpkg · L1•scripts.postinstall = node postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.mjs
Findings
5 Critical13 High9 Medium6 Low
CriticalSame File Env Network Executiondist/skills/browser/runtime/omowright/index.js
CriticalDownload Executedist/skills/browser/runtime/omowright/index.js
CriticalEncrypted Payload Temp Executiondist/cli-node/index.js
CriticalAi Agent Control Hijackpackage.json
CriticalPrevious Version Dangerous Deltapackages/omo-codex/plugin/components/lsp/dist/cli.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/oh-my-opencode.js
HighShelldist/cli-node/index.js
HighEvaldist/skills/ulw-research/scripts/layout-probe.test.ts
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltration
Affected versions and remediation
This report applies to oh-my-opencode@5.1.43.
See all versions of oh-my-opencode for other recorded verdicts.
- Review the evidence and your use of oh-my-opencode@5.1.43 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.