
Security News
OpenCode User Hit with Hostile Backlash After Reporting Free AI Loophole
An OpenCode user faced harassment after reporting a free AI usage loophole, drawing a bitter backlash in a GitHub thread that has since been deleted.
@beloved-lenora/opencode-todo
Advanced tools
Affected versions:
A plain per-session to-do list with subtasks is implemented, with the agent maintaining its own checklist and the TUI rendering it.
A plain per-session to-do list with subtasks is implemented, with the agent maintaining its own checklist and the TUI rendering it.
OpenCode v2 loads the published package from the plugins array in opencode.json:
{
"plugins": ["@beloved-lenora/opencode-todo@latest"],
}
Then restart the service (opencode service restart) so the plugin loads.
FAQs
security holding package
The npm package @beloved-lenora/opencode-todo receives a total of 215 weekly downloads. As such, @beloved-lenora/opencode-todo popularity was classified as not popular.
We found that @beloved-lenora/opencode-todo demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
An OpenCode user faced harassment after reporting a free AI usage loophole, drawing a bitter backlash in a GitHub thread that has since been deleted.

Threat Research
/Security News
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.

Threat Research
Malicious Firefox extensions mimic Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys, with one fetching its payload remotely.