open-omni@1.2.0

One or more suspicious static signals were detected.

A user runs the open-omni CLI.

Browser session cookies from unrelated domains can be disclosed to Instagram.

Automatic browser-cookie harvesting and cross-domain cookie forwarding.

On every CLI launch, the program defaults to browser auto mode and invokes yt-dlp to export browser cookies into a temporary file. It then parses that file without supplying a target domain, so the resulting header can include every exported cookie. When processing an Instagram URL, it attaches that header to a request to Instagram. This exposes cookies belonging to unrelated sites to a third party. The program also fetches an executable downloader from a release URL and makes it executable during runtime.

The automatic, unfiltered browser-cookie export followed by forwarding those values to Instagram is a concrete credential-exfiltration path. The absence of an install hook does not remove this runtime attack behavior.