registry / Persistence / ohmycode
ohmycode
Modern, playful, and colorful interactive Kanban for developers
This report shows the evidence for ohmycode@1.0.8, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package performs concrete, cross-platform login persistence from postinstall, rather than only when a user invokes its CLI. Its background server also binds broadly by default, increasing the impact of that persistence.
Static reason
One or more suspicious static signals were detected.
Trigger
npm postinstall during package installation; then each user login.
Impact
Persistent background execution and exposure of the local application's file/Git control APIs to the network.
Mechanism
Cross-platform startup registration plus detached server launch.
Attack narrative
On install, package.json runs bin/setup-startup.js. It writes a Windows Run registry entry, Linux autostart desktop file, or macOS LaunchAgent so ohmycode runs at future logins without an explicit setup command. The CLI launches its server detached; its compiled server defaults to 0.0.0.0 and exposes project file write and Git-management routes. This is unconsented install-time persistence with a broad local control surface.
AI rationale
The package performs concrete, cross-platform login persistence from postinstall, rather than only when a user invokes its CLI. Its background server also binds broadly by default, increasing the impact of that persistence.
Evidence
package.jsonbin/setup-startup.jsbin/ohmycode.jsbuild/index.jsbuild/server/chunks/_server.ts-DmJ1tcuW.js~/.ohmycode/ohmycode-silent.vbsHKCU\Software\Microsoft\Windows\CurrentVersion\Run~/.config/autostart/ohmycode.desktop~/Library/LaunchAgents/com.ohmycode.startup.plist
Network endpoints1
0.0.0.0:${PORT}
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json invokes setup-startup.js via postinstall.
- setup-startup.js creates OS login-start persistence on Windows, Linux, and macOS.
- Windows branch writes a VBS launcher and modifies HKCU Run through reg add.
- Linux and macOS branches write autostart/LaunchAgent files that execute ohmycode.
- The persisted CLI detaches a local server and leaves it running in the background.
- build/index.js binds that server to 0.0.0.0 by default.
Evidence against
- README describes a Git/Kanban desktop-style tool with a system tray.
- No credential harvesting, remote endpoint, or payload download was found in inspected entrypoints.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
12 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node bin/setup-startup.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/setup-startup.jsView file
1import { exec } from 'child_process';
L2: import fs from 'fs';
High
Child Process
Package source references child process execution.
bin/setup-startup.jsView on unpkg · L11Manifest entrypoint (scripts.postinstall) carries capability families absent from dist/build output: environment+network, execution+network
L1: import { exec } from 'child_process';
L2: import fs from 'fs';
...
L5:
L6: const homeDir = os.homedir();
L7:
...
L14: const vbsPath = path.join(omcDir, 'ohmycode-silent.vbs');
L15: const appData = process.env.APPDATA || path.join(homeDir, 'AppData', 'Roaming');
L16: const cmdPath = path.join(appData, 'npm', 'ohmycode.cmd');
High
Entrypoint Build Divergence
Findings
9 High6 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/setup-startup.js
HighShellbuild/server/chunks/_server.ts-LO208n8J.js
HighEntrypoint Build Divergencebin/setup-startup.js
HighCross File Remote Execution Contextbin/ohmycode.js
HighTrigger Reachable Persistencebin/setup-startup.js
HighBase64 Obscured Urlbuild/client/_app/immutable/nodes/2.CwLYsk-Z.js
HighShips High Entropy Blobbuild/client/_app/immutable/nodes/2.CwLYsk-Z.js.gz
HighSemantic Analysis Limitedbuild/index.js
MediumDynamic Requirebuild/server/index.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to ohmycode@1.0.8.
The versions list below shows the verdict for each recorded version.
- Avoid installing ohmycode@1.0.8. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.