opencode-ai

Lifecycle scriptsdanger

A postinstall script runs during installation, increasing dependency-installation complexity and the consequences of a compromised or broken release.

Build provenancecaution

No build attestation is present, so consumers cannot independently verify how the published binary was produced. Trusted publisher identity is present, but it does not replace artifact provenance.

Package file treecaution

The four-file artifact is a platform-binary wrapper containing LICENSE, package.json, postinstall.mjs, and a Windows executable; this is a coherent CLI packaging shape but provides little transparency in the artifact itself.

Package scaffoldingcaution

The published artifact has no README, tests, changelog, or release notes. Tests and changelogs normally belong in source repositories, but the missing README reduces usability for a CLI package.

Release historycaution

The package is mature at 498 days old and has extensive release activity, but 10,498 releases in the last 12 months with a median interval of about 23 minutes is unusually rapid and makes release selection harder to audit.