Vladkarok's request to verify a newer Omabump snapshot remains open in omacom/omarchy-plugin-marketplace#10910. During review, HANCORE-linux identified a Voxtype package hook that read a handoff file from a shared temporary directory without checking ownership and accepted an attacker-controlled executable as the system launcher.
Vladkarok confirmed the mechanism and explained that the same hook ran through ordinary package upgrades, placing the repair in the package rather than the plugin. The author described a proposed change using root-only storage and restricting restored executable paths, then planned to update Omabump's pinned recipe after that fix merged. omacom/omarchy-plugin-marketplace#10910:issuecomment-6098036843 records that response; the supplied discussion does not establish completion of the package repair.
