
Security News
OpenCode User Hit with Hostile Backlash After Reporting Free AI Loophole
An OpenCode user faced harassment after reporting a free AI usage loophole, drawing a bitter backlash in a GitHub thread that has since been deleted.
@beloved-lenora/opencode-orchestrator
Advanced tools
Affected versions:
Fleet command: spawn worker sessions, steer them, stop runaways, retire the finished. One roster, two front doors: agent tools and a dashboard RPC with the same names, so the operator's agent and the dashboard never disagree.
Fleet command: spawn worker sessions, steer them, stop runaways, retire the finished. One roster, two front doors: agent tools and a dashboard RPC with the same names, so the operator's agent and the dashboard never disagree.
OpenCode v2 loads the published package from the plugins array in opencode.json:
{
"plugins": ["@beloved-lenora/opencode-orchestrator@latest"],
}
Then restart the service (opencode service restart) so the plugin loads.
| Tool | Does |
|---|---|
fleet_spawn | Start a worker session on a task. Returns its session id. |
fleet_send | Send a follow-up prompt to a roster session (queue by default, steer to interrupt and inject). |
fleet_stop | Interrupt a roster session's current run. |
fleet_retire | Delete a roster session and drop it from the roster. |
fleet_roster | List roster sessions with alive/gone flags. |
fleet_adopt | Track an existing session without briefing it. |
The dashboard exposes the same operations plus a per-session summary that combines the goal, checklist, guard, and Q&A states. A missing source yields empties, never an error. Every mutation emits a change event the dashboard subscribes to, so it stays current without polling.
Sessions spawned here are managed: every prompt they receive carries standing orders (work the task, report concisely, never approve permissions for anyone). Adopted sessions are monitored only and never rewritten.
The roster holds 20 sessions. Liveness is checked on read, so gone sessions show as gone instead of erroring.
/fleet dashboard: per-session cards sorted by recent activity (title, busy/attention/idle status, context bar, message counts, spend, queue). spawn worker sits in the header. Click a card to drill into transcript stats, the live summary section, and the action row. Roster sessions get send / steer / stop / retire (confirm-gated); strangers get adopt into fleet.send is roster-only. The fleet cannot steer strangers.queue; steer is opt-in per call.retire deletes the session.FAQs
security holding package
The npm package @beloved-lenora/opencode-orchestrator receives a total of 49 weekly downloads. As such, @beloved-lenora/opencode-orchestrator popularity was classified as not popular.
We found that @beloved-lenora/opencode-orchestrator demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
An OpenCode user faced harassment after reporting a free AI usage loophole, drawing a bitter backlash in a GitHub thread that has since been deleted.

Threat Research
/Security News
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.

Threat Research
Malicious Firefox extensions mimic Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys, with one fetching its payload remotely.