@daytona/opencode
OpenCode plugin that automatically runs all sessions in Daytona sandboxes for isolated, reproducible development environments
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): Git manager intentionally spreads process.env to pass git credentials; standard pattern for git subprocess invocation. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): Git manager plugin legitimately shells out to git; child_process use is expected and scoped to git operations. | ai | |
| phantom-deps | phantom-dep:tar | AI (phantom-deps): Plugin framework loads deps by convention; phantom-dep is a stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:axios | AI (phantom-deps): Plugin framework loads deps by convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:pathe | AI (phantom-deps): Plugin framework loads deps by convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:busboy | AI (phantom-deps): Plugin framework loads deps by convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:dotenv | AI (phantom-deps): Plugin framework loads deps by convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:fast-glob | AI (phantom-deps): Plugin framework loads deps by convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:form-data | AI (phantom-deps): Plugin framework loads deps by convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:@iarna/toml | AI (phantom-deps): Plugin framework loads deps by convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:shell-quote | AI (phantom-deps): Plugin framework loads deps by convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:expand-tilde | AI (phantom-deps): Plugin framework loads deps by convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:isomorphic-ws | AI (phantom-deps): Plugin framework loads deps by convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:@aws-sdk/client-s3 | AI (phantom-deps): Framework-scoped; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@opentelemetry/api | AI (phantom-deps): Plugin framework loads deps by convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:@daytona/api-client | AI (phantom-deps): Same org scope; loaded by plugin framework convention. | ai | |
| phantom-deps | phantom-dep:@aws-sdk/lib-storage | AI (phantom-deps): Framework-scoped; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@opentelemetry/sdk-node | AI (phantom-deps): Plugin framework loads deps by convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:@opentelemetry/resources | AI (phantom-deps): Plugin framework loads deps by convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:@daytona/toolbox-api-client | AI (phantom-deps): Same org scope; loaded by plugin framework convention. | ai |
Versions (showing 9 of 9)
| Version | Deps | Published |
|---|---|---|
| 0.184.0 | 27 / 0 | |
| 0.183.0 | 27 / 0 | |
| 0.182.0 | 27 / 0 | |
| 0.179.0 | 27 / 0 | |
| 0.173.0 | 27 / 0 | |
| 0.171.0 | 27 / 0 | |
| 0.169.0 | 27 / 0 | |
| 0.167.0 | 27 / 0 | |
| 0.166.0 | 27 / 0 |
v0.184.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.183.0
2 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/daytonaio/daytona/blob/deb7e7f117a39d035c516c0c7ab8268c4460d699/.opencode/plugin/daytona/git/host-git-manager.js#L122 120 | const reservationCommitEmail = '[email protected]'; 121 | const reservationCommitMessage = 'OpenCode reservation'; > 122 | const commitEnv = { 123 | ...process.env, 124 | GIT_AUTHOR_NAME: reservationCommitName,
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.182.0
2 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/daytonaio/daytona/blob/e5f55b6b7891376fdd6431327eb0564b15301dd7/.opencode/plugin/daytona/git/host-git-manager.js#L122 120 | const reservationCommitEmail = '[email protected]'; 121 | const reservationCommitMessage = 'OpenCode reservation'; > 122 | const commitEnv = { 123 | ...process.env, 124 | GIT_AUTHOR_NAME: reservationCommitName,
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.179.0
2 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/daytonaio/daytona/blob/d00c37b05eb36250c210b799229ddc77d971b47e/.opencode/plugin/daytona/git/host-git-manager.js#L122 120 | const reservationCommitEmail = '[email protected]'; 121 | const reservationCommitMessage = 'OpenCode reservation'; > 122 | const commitEnv = { 123 | ...process.env, 124 | GIT_AUTHOR_NAME: reservationCommitName,
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.173.0
2 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/daytonaio/daytona/blob/a514f13e85af42c652d2aa5cddcd49591ac7d28e/.opencode/plugin/daytona/git/host-git-manager.js#L122 120 | const reservationCommitEmail = '[email protected]'; 121 | const reservationCommitMessage = 'OpenCode reservation'; > 122 | const commitEnv = { 123 | ...process.env, 124 | GIT_AUTHOR_NAME: reservationCommitName,
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.171.0
2 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/daytonaio/daytona/blob/8b7331b22243939820bfe5b8ca6b0ccf164ea878/.opencode/plugin/daytona/git/host-git-manager.js#L122 120 | const reservationCommitEmail = '[email protected]'; 121 | const reservationCommitMessage = 'OpenCode reservation'; > 122 | const commitEnv = { 123 | ...process.env, 124 | GIT_AUTHOR_NAME: reservationCommitName,
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.169.0
2 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/daytonaio/daytona/blob/7649a709b5665da122cef4b6442f14b5354d5362/.opencode/plugin/daytona/git/host-git-manager.js#L122 120 | const reservationCommitEmail = '[email protected]'; 121 | const reservationCommitMessage = 'OpenCode reservation'; > 122 | const commitEnv = { 123 | ...process.env, 124 | GIT_AUTHOR_NAME: reservationCommitName,
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.167.0
2 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/daytonaio/daytona/blob/609f8ddc84c3602e40dfa41c3be878b969d35749/.opencode/plugin/daytona/git/host-git-manager.js#L122 120 | const reservationCommitEmail = '[email protected]'; 121 | const reservationCommitMessage = 'OpenCode reservation'; > 122 | const commitEnv = { 123 | ...process.env, 124 | GIT_AUTHOR_NAME: reservationCommitName,
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.166.0
2 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/daytonaio/daytona/blob/5a29b8059df870ffc98c3d0d2200c246ae327b10/.opencode/plugin/daytona/git/host-git-manager.js#L122 120 | const reservationCommitEmail = '[email protected]'; 121 | const reservationCommitMessage = 'OpenCode reservation'; > 122 | const commitEnv = { 123 | ...process.env, 124 | GIT_AUTHOR_NAME: reservationCommitName,
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.