Dankestrick opened omacom/omarchy-plugin-marketplace#11590 to report a third-party store copying marketplace listings and installing a post-update hook. According to the report, that hook downloaded a remote catalog and could install packages with root privileges after an Omarchy update. Dankestrick explicitly said no malicious payload had been found in the material examined.
In an October 15 follow-up, Dankestrick reported that the domain had been suspended and two associated GitHub accounts removed following abuse reports. The remaining concern was the hook already installed on users' machines: the reporter said it would continue running and could regain its remote installation path if the domain returned. The issue remained open at the October 19 check; these findings and enforcement outcomes are attributed to the reporter.
