Loading npm security reports…
OpenCode Multi-Model Auto-Router plugin (ocmm). Per-agent model selection, variant -> param translation, intent-keyword mode injection.
LPM treats this as warn-only first-party agent extension lifecycle risk. A first-party Codex extension can register agent profiles, skills, and MCP servers when explicitly installed. No npm install-time execution or foreign control-surface mutation was found.
Package ships non-JavaScript build or shell helper files.
plugins/deepwork/skills/ast-grep/install.shView on unpkgPackage hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
plugins/deepwork/skills/ast-grep/tests/smoke.ps1View on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli/shim.jsView on unpkgPackage ships non-JavaScript build or shell helper files.
plugins/deepwork/skills/ast-grep/install.shView on unpkgPackage hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
plugins/deepwork/skills/ast-grep/tests/smoke.ps1View on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli/shim.jsView on unpkg