registry / oh-my-opencode / 5.1.46
oh-my-opencode@5.1.46
The Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools
AI Security Review
scanned 11d ago · by lpm-firewall-aiSource inspection resolved the scanner’s flagged tests, dependency modules, and browser bundle as package functionality or test material. The lifecycle hook’s cache cleanup is limited to this package’s matching OpenCode entries, and the runtime telemetry is package-aligned with disable controls; no malicious behavior was identified.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installing the package runs its postinstall hook; loading the plugin can record a daily activity event.
Impact
No credential theft, unrelated account action, broad agent configuration change, or other confirmed attack was established.
Mechanism
The install hook removes matching OpenCode plugin cache directories and checks the platform binary. Plugin telemetry sends a daily event with a hashed hostname and system metadata to the package’s PostHog endpoint, subject to configuration and environment disable flags.
AI rationale
Source inspection resolved the scanner’s flagged tests, dependency modules, and browser bundle as package functionality or test material. The lifecycle hook’s cache cleanup is limited to this package’s matching OpenCode entries, and the runtime telemetry is package-aligned with disable controls; no malicious behavior was identified.
Evidence
postinstall.mjsdist/index.js
Network endpoints1
us.i.posthog.com
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest declares a postinstall hook that checks the platform binary; the hook removes only OpenCode cache directories matching this package’s current or former names.
- The CLI wrapper selects an optional platform binary and starts it for the invoked command.
- Plugin loading can send a daily usage event to the package’s PostHog host. The event includes a hashed hostname and system metadata; configuration and environment flags can disable telemetry.
- The flagged test files contain test fixtures or test cases, including the dynamic function construction in the selector-path test.
- The inspected Zod dependency files expose schema validation and localized error modules; the OpenTUI dependency entry is a terminal UI module.
- The source snapshot command runs the caller-provided argument array with shell execution disabled.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
23 flaggedpackage.jsonView file
1Install-time code directly mutates a foreign AI-agent control surface:
L62: "docs/reference/web-terminal-visual-qa.md",
L63: ".opencode/command",
L64: ".opencode/skills",
L65: ".agents/command",
L66: ".agents/skills",
L67: "packages/lsp-tools-mcp/package.json",
...
L97: "packages/prompts-core/prompts/ultrawork/codex.md",
L98: "packages/omo-codex/plugin/.codex-plugin",
L99: "!packages/omo-codex/plugin/node_modules",
...
L150: "test:fast": "bun run script/test-fast.ts",
L151: "test:senpi": "bun run build:senpi-plugin && tsgo --noEmit -p packages/omo-senpi/tsconfig.json && bun test --timeout 20000 packages/omo-senpi && bun test ./.agents/skills/senpi-qa/...
L152: "test:windows-codex": "bun run test:codex",
Write operation from dist/tui.js:
L2183: // packages/utils/src/xdg-data-dir.ts
L2184: i
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
package.jsonView on unpkg · L1•scripts.postinstall = node postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.mjs
Findings
5 Critical13 High9 Medium6 Low
CriticalSame File Env Network Executiondist/skills/browser/runtime/omowright/index.js
CriticalDownload Executedist/skills/browser/runtime/omowright/index.js
CriticalEncrypted Payload Temp Executiondist/cli-node/index.js
CriticalAi Agent Control Hijackpackage.json
CriticalPrevious Version Dangerous Deltadist/skills/ulw-research/scripts/source-commands.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/oh-my-opencode.js
HighShelldist/cli-node/index.js
HighEvaldist/skills/ulw-research/scripts/layout-probe.test.ts
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltration
Affected versions and remediation
This report applies to oh-my-opencode@5.1.46.
See all versions of oh-my-opencode for other recorded verdicts.
- Review the evidence and your use of oh-my-opencode@5.1.46 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.