Loading npm security reports…
A curated, opinionated set of OpenCode plugins for spec-first, review-driven, safer agentic development.
LPM treats this as warn-only first-party agent extension lifecycle risk. Explicit `vvoc install` and `vvoc sync` mutate OpenCode/vvoc configuration, managed prompts, skills, and a global skills symlink. The package also has a prepare-only Lefthook setup hook. No automatic npm-install mutation or concrete malicious chain was established.
`package.json` has `prepare: lefthook install --force`, a VCS-hook setup action.
package.jsonView on unpkg`dist/commands/install.js` explicitly registers the package in OpenCode runtime/TUI configuration.
dist/commands/install.jsView on unpkg`dist/commands/sync.js` rewrites managed OpenCode agents, prompts, skills, and vvoc config on user invocation.
dist/commands/sync.jsView on unpkg`dist/lib/opencode.js` writes OpenCode config and creates a global managed-skills symlink.
dist/lib/opencode.jsView on unpkg`package.json` has `prepare: lefthook install --force`, a VCS-hook setup action.
package.jsonView on unpkg`dist/commands/install.js` explicitly registers the package in OpenCode runtime/TUI configuration.
dist/commands/install.jsView on unpkg`dist/commands/sync.js` rewrites managed OpenCode agents, prompts, skills, and vvoc config on user invocation.
dist/commands/sync.jsView on unpkg`dist/lib/opencode.js` writes OpenCode config and creates a global managed-skills symlink.
dist/lib/opencode.jsView on unpkg