← candidates

npm oh-my-codex-pennix @0.18.20

Signals fired

Prior profile (what it deviated from)

{
  "had_install_script": true,
  "maintainers": [
    "pennix"
  ],
  "versions": 5
}

Evidence (package doc at flag time)

{
  "dependencies_count": 3,
  "dist": {
    "integrity": "sha512-I953bR+YXOeTCuxgkxoPuPJuzdxiXQOFQeZnfT8xf3WSSI3O1/eDQCqikbKeQf70HYf6BezMVdw+oFZuJTGUxA==",
    "tarball": "https://registry.npmjs.org/oh-my-codex-pennix/-/oh-my-codex-pennix-0.18.20.tgz",
    "unpackedSize": 24595856
  },
  "dist-tags": {
    "latest": "0.18.20"
  },
  "latest_version": "0.18.20",
  "maintainers": [
    {
      "email": "pennaliflake@gmail.com",
      "name": "pennix"
    }
  ],
  "num_versions": 7,
  "repository": {
    "type": "git",
    "url": "git+https://github.com/PennixRv/oh-my-codex.git"
  },
  "scripts": {
    "ask:claude": "./src/scripts/ask-claude.sh",
    "ask:gemini": "./src/scripts/ask-gemini.sh",
    "build": "node -e \"const fs=require('fs'); fs.rmSync('dist',{recursive:true,force:true});\" && tsc && node -e \"require('fs').chmodSync('dist/cli/omx.js', 0o755)\"",
    "build:api": "node dist/scripts/build-api.js",
    "build:explore": "cargo build -p omx-explore-harness",
    "build:explore:release": "node dist/scripts/build-explore-harness.js",
    "build:full": "npm run build && npm run build:explore:release && npm run build:sparkshell && npm run build:api",
    "build:sparkshell": "node dist/scripts/build-sparkshell.js",
    "check:no-unused": "tsc -p tsconfig.no-unused.json",
    "clean:native-package-assets": "node dist/scripts/cleanup-explore-harness.js",
    "coverage:team-critical": "npm run build && npm run coverage:team-critical:compiled",
    "coverage:team-critical:compiled": "c8 --all --src dist/team --src dist/state --include 'dist/team/**/*.js' --include 'dist/state/**/*.js' --exclude '**/__tests__/**' --reporter=text-summary --reporter=lcov --reporter=json-summary --report-dir coverage/team --check-coverage --lines=78 --functions=90 --branches=70 --statements=78 node dist/scripts/run-test-files.js dist/team/__tests__ dist/state/__tests__",
    "coverage:team-critical:cross-platform": "npm run coverage:team-critical",
    "coverage:ts:full": "npm run build && npm run coverage:ts:full:compiled",
    "coverage:ts:full:compiled": "c8 --all --src dist --exclude '**/__tests__/**' --exclude 'dist/bin/**' --exclude 'dist/**/*.d.ts' --reporter=text-summary --reporter=lcov --reporter=json-summary --report-dir coverage/ts-full node dist/scripts/run-test-files.js dist",
    "coverage:ts:full:cross-platform": "npm run coverage:ts:full",
    "dev": "tsc --watch",
    "doctor": "node dist/cli/omx.js doctor",
    "lint": "biome lint src",
    "postinstall": "node -e \"const fs=require('fs');const p='./dist/scripts/postinstall.js';if(fs.existsSync(p))import(p).then(m=>m.main?.()).catch(e=>console.warn('[omx] Postinstall skipped after a non-fatal error: '+(e?.message??e)))\"",
    "postpack": "npm run clean:native-package-assets",
    "prepack": "npm run build && npm run verify:native-agents && npm run sync:plugin && npm run verify:plugin-bundle && npm run clean:native-package-assets",
    "prepare": "node src/scripts/prepare-build.js",
    "prompt:inventory": "node dist/scripts/prompt-inventory.js",
    "setup": "node dist/cli/omx.js setup",
    "smoke:packed-install": "node dist/scripts/smoke-packed-install.js",
    "sync:plugin": "node dist/scripts/sync-plugin-mirror.js",
    "sync:plugin:check": "node dist/scripts/sync-plugin-mirror.js --check",
    "test": "npm run build && npm run verify:native-agents && npm run verify:plugin-bundle && npm run test:node && node dist/scripts/generate-catalog-docs.js --check",
    "test:ci:compiled": "npm run verify:native-agents && npm run verify:plugin-bundle && npm run test:node && node dist/scripts/generate-catalog-docs.js --check",
    "test:compat:node": "npm run build && node dist/scripts/run-test-files.js dist/compat/__tests__",
    "test:compat:node:cross-platform": "npm run build && node dist/scripts/run-test-files.js dist/compat/__tests__",
    "test:compat:rust": "cargo build && OMX_COMPAT_TARGET=./target/debug/omx npm run test:compat:node",
    "test:explicit-terminal-contract:compiled": "node dist/scripts/run-test-files.js dist/runtime/__tests__/run-outcome.test.js dist/mcp/__tests__/state-server.test.js dist/hooks/__tests__/notify-fallback-watcher.test.js dist/hooks/__tests__/notify-hook-ralph-resume.test.js dist/scripts/__tests__/codex-native-hook.test.js",
    "test:explore": "cargo test -p omx-explore-harness && node --test dist/cli/__tests__/explore.test.js dist/hooks/__tests__/explore-routing.test.js dist/hooks/__tests__/explore-sparkshell-guidance-contract.test.js",
    "test:node": "node dist/scripts/run-test-files.js dist",
    "test:node:cross-platform": "npm run test:node",
    "test:plugin-boundaries:compiled": "node dist/scripts/run-test-files.js dist/cli/__tests__/codex-plugin-layout.test.js dist/cli/__tests__/package-bin-contract.test.js dist/cli/__tests__/setup-hooks-shared-ownership.test.js dist/catalog/__tests__/plugin-bundle-ssot.test.js",
    "test:ralph-persistence:compiled": "node dist/scripts/run-test-files.js dist/cli/__tests__/session-scoped-runtime.test.js dist/mcp/__tests__/trace-server.test.js dist/hud/__tests__/state.test.js dist/mcp/__tests__/state-server-ralph-phase.test.js dist/ralph/__tests__/persistence.test.js dist/verification/__tests__/ralph-persistence-gate.test.js",
    "test:recent-bug-regressions": "npm run build && npm run test:recent-bug-regressions:compiled",
    "test:recent-bug-regressions:compiled": "node dist/scripts/run-test-files.js dist/hooks/__tests__/keyword-detector.test.js dist/scripts/__tests__/codex-native-hook.test.js dist/cli/__tests__/launch-fallback.test.js dist/team/__tests__/runtime.test.js dist/team/__tests__/hardening-e2e.test.js",
    "test:reply-listener:live": "node dist/scripts/test-reply-listener-live.js",
    "test:sparkshell": "node dist/scripts/test-sparkshell.js",
    "test:team:cross-rebase-smoke": "npm run build && npm run test:team:cross-rebase-smoke:compiled",
    "test:team:cross-rebase-smoke:compiled": "node dist/scripts/run-test-files.js dist/team/__tests__/cross-rebase-smoke.test.js",
    "test:team:worker-runtime-identity": "npm run build && npm run test:team:worker-runtime-identity:compiled",
    "test:team:worker-runtime-identity:compiled": "node dist/scripts/run-test-files.js dist/team/__tests__/worker-runtime-identity.test.js",
    "verify:native-agents": "node dist/scripts/verify-native-agents.js",
    "verify:plugin-bundle": "node dist/scripts/sync-plugin-mirror.js --check"
  },
  "signal_details": {
    "_amplifiers": [
      "typosquat + install_script_payload: typosquat shape with active payload or stub-rush surface (+0.15)"
    ],
    "install_script_payload": "install/lifecycle script matches payload regex",
    "repo_too_new_for_version_history": "claimed repo created 6d ago but package has 7 versions (expect >= 50d for that history)",
    "typosquat": "combosquat of 'oh-my-codex'"
  },
  "time": {
    "created": "2026-06-17T05:44:32.878Z",
    "modified": "2026-06-23T02:08:39.149Z"
  }
}