@ai-sdk/harness-opencode
Clear documentation, release notes, and type declarations make integration straightforward. The linked project shows strong ongoing activity and ownership, though repository package identification and workflow permissions deserve attention.
86%
Total Score
100
100
94
88
100
Health Score Breakdown
The repository name does not match the package and its README does not mention the package, leaving some uncertainty about the exact package-to-repository mapping despite the broader monorepo context.
All 12 workflows were analyzed, actions are fully pinned, and 11 workflows use read-only permissions; high-confidence findings about blanket GitHub App permissions and template injection are workflow hygiene concerns, while the cache findings are low-confidence.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-796970 @ai-sdk/harness-opencode is vulnerable to Authorization Bypass in versions 1.0.11 - 1.0.27. | 1.0.11 - 1.0.27 | Medium |
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 ws Version 8.21.0 | — | — |
@ai-sdk/harness Version 1.0.121 | — | — |
@ai-sdk/provider-utils Version 5.0.45 | — | — |
Weekly Downloads
Info
- Last Published
- 11 hours ago
- Created
- 3 months ago
- Unpacked Size
- 0.8 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.