opencode-ai
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:child-process-import | AI (semgrep): postinstall.mjs uses child_process to set up platform-specific binary; standard pattern for this CLI distribution package. | ai | |
| publish-pattern | rapid-publish | AI (publish-pattern): Automated CI/CD releases many platform-specific packages in rapid succession; stable pattern for this package. | ai | |
| bogus-package | bogus-package | AI (bogus-package): 1.7M weekly downloads and 330-day history confirm legitimacy; missing metadata fields are typical for thin CLI binary wrapper packages. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Postinstall resolves platform-specific prebuilt binary from optionalDependencies; standard pattern for native binary distribution (like esbuild, turbo). | ai | |
| npm-metadata | no-description | AI (npm-metadata): Established package (1.7M downloads, 329 days old) with auto-published versions; missing description is a metadata gap, not a malice signal. | ai |
Versions (showing 51 of 100)
| Version | Deps | Published |
|---|---|---|
| 1.18.8 | 0 / 0 | |
| 1.18.6 | 0 / 0 | |
| 1.18.5 | 0 / 0 | |
| 1.18.0 | 0 / 0 | |
| 1.17.16 | 0 / 0 | |
| 1.17.14 | 0 / 0 | |
| 1.17.6 | 0 / 0 | |
| 1.17.4 | 0 / 0 | |
| 1.15.8 | 0 / 0 | |
| 1.15.4 | 0 / 0 | |
| 1.15.0 | 0 / 0 | |
| 1.14.50 | 0 / 0 | |
| 1.14.47 | 0 / 0 | |
| 1.14.45 | 0 / 0 | |
| 1.14.43 | 0 / 0 | |
| 1.14.42 | 0 / 0 | |
| 1.14.38 | 0 / 0 | |
| 1.14.37 | 0 / 0 | |
| 1.14.36 | 0 / 0 | |
| 1.14.33 | 0 / 0 | |
| 1.14.30 | 0 / 0 | |
| 1.14.29 | 0 / 0 | |
| 1.14.25 | 0 / 0 | |
| 1.14.24 | 0 / 0 | |
| 1.14.23 | 0 / 0 | |
| 1.14.22 | 0 / 0 | |
| 1.14.19 | 0 / 0 | |
| 1.14.18 | 0 / 0 | |
| 1.4.17 | 0 / 0 | |
| 1.4.12 | 0 / 0 | |
| 1.4.11 | 0 / 0 | |
| 1.4.9 | 0 / 0 | |
| 1.4.8 | 0 / 0 | |
| 1.4.7 | 0 / 0 | |
| 1.4.6 | 0 / 0 | |
| 1.4.4 | 0 / 0 | |
| 1.4.3 | 0 / 0 | |
| 1.4.0 | 0 / 0 | |
| 1.3.17 | 0 / 0 | |
| 1.3.16 | 0 / 0 | |
| 1.3.15 | 0 / 0 | |
| 1.3.14 | 0 / 0 | |
| 1.3.13 | 0 / 0 | |
| 1.3.12 | 0 / 0 | |
| 1.3.11 | 0 / 0 | |
| 1.3.10 | 0 / 0 | |
| 1.3.9 | 0 / 0 | |
| 1.3.8 | 0 / 0 | |
| 1.3.6 | 0 / 0 | |
| 1.3.4 | 0 / 0 | |
| 1.3.3 | 0 / 0 |
v1.18.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.18.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.18.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.18.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.17.16
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.17.14
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.