
Security News
OpenCode User Hit with Hostile Backlash After Reporting Free AI Loophole
An OpenCode user faced harassment after reporting a free AI usage loophole, drawing a bitter backlash in a GitHub thread that has since been deleted.
@cjhyy/code-shell-web
Advanced tools
CodeShell web client logic layer — remote-app state (chatReducer + server-event fold), reconnecting WebSocket hook, pairing/device-credential/risk helpers, and the mobile i18n namespace. Browser-only (no Electron, no Node); seed of the standalone browser
Browser-only state and UI helpers for CodeShell's remote client. The package contains no Electron code and imports CodeShell core contracts as types only.
The root entry exports:
import { useRemoteApp, useRemoteSocket, classifyRisk, translate } from "@cjhyy/code-shell-web";
The reusable browser logic is emitted to dist/. The package also ships the
standalone Vite application in dist-app/; @cjhyy/code-shell-server/serve
uses those assets for the ready-made headless web host.
bun run --cwd packages/web build
bun run --cwd packages/web build:app
bun run --cwd packages/web dev:app
build cleans both output directories before compiling the library and
building the application, so published assets cannot contain stale files.
This package may use browser APIs and type-only core protocol imports. It must not import Electron, Desktop preload globals, Node-only runtime modules or core runtime implementations.
MIT.
FAQs
CodeShell web client logic layer — remote-app state (chatReducer + server-event fold), reconnecting WebSocket hook, pairing/device-credential/risk helpers, and the mobile i18n namespace. Browser-only (no Electron, no Node); seed of the standalone browser
The npm package @cjhyy/code-shell-web receives a total of 586 weekly downloads. As such, @cjhyy/code-shell-web popularity was classified as not popular.
We found that @cjhyy/code-shell-web demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
An OpenCode user faced harassment after reporting a free AI usage loophole, drawing a bitter backlash in a GitHub thread that has since been deleted.

Threat Research
/Security News
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.

Threat Research
Malicious Firefox extensions mimic Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys, with one fetching its payload remotely.