
Research
/Security News
CanisterWorm: npm Publisher Compromise Deploys Backdoor Across 29+ Packages
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.
@howaboua/opencode-planning-toolkit
Advanced tools
Comprehensive planning toolkit for OpenCode: manage specifications, track study plans, and automate roadmaps.
Keep your projects organized and your AI agents aligned.
This plugin adds structure to your development workflow with reusable specifications, actionable plans, and progress tracking—all integrated directly into OpenCode.
For developers:
For AI agents:
<available_plans> in the system prompt with all plan names and descriptionscreate_spec - Create a reusable specification (repo-level or feature-specific)create_plan - Create an actionable work plan with implementation steps (min 5)append_spec - Link an existing spec to a planread_plan - Read a plan with all linked spec content expanded inlinemark_plan_done - Mark a plan as completeAdd to your opencode.json:
{
"plugins": [
"@howaboua/opencode-planning-toolkit"
]
}
Or for local development:
{
"plugins": [
"file:///path/to/opencode-planning-toolkit/index.ts"
]
}
Define standards or requirements once, use them everywhere:
Ask the agent: "Create a repo-level spec for TypeScript coding standards"
The agent creates docs/specs/typescript-standards.md:
# Spec: typescript-standards
Scope: repo
- Use strict mode
- All functions must have explicit return types
- Prefer `const` over `let`
- No `any` types without justification
Turn a goal into actionable steps:
Ask the agent: "Create a plan for adding user authentication"
The agent creates docs/plans/user-auth.md:
---
plan name: user-auth
plan description: Add JWT-based authentication
plan status: active
---
## Idea
Add secure JWT authentication to the API with login, logout, and token refresh.
## Implementation
- Design JWT token structure and expiry policy
- Add /auth/login endpoint with password validation
- Add /auth/refresh endpoint for token renewal
- Add /auth/logout endpoint to invalidate tokens
- Write tests for all auth endpoints
## Required Specs
<!-- SPECS_START -->
<!-- SPECS_END -->
Attach relevant specs to ensure standards are followed:
Ask the agent: "Link typescript-standards spec to the user-auth plan"
The plan updates:
## Required Specs
<!-- SPECS_START -->
- typescript-standards
<!-- SPECS_END -->
When starting implementation, the agent reads the full context:
Ask the agent: "Read the user-auth plan and start implementing"
The agent receives the full plan with all linked spec content expanded inline.
Ask the agent: "Mark the user-auth plan as done"
Status updates from active → done.
your-project/
├── docs/
│ ├── specs/ # Reusable specifications
│ │ └── *.md # Each spec is a markdown file
│ └── plans/ # Work plans
│ └── *.md # Each plan is a markdown file
Specs naming: {name}.md (e.g., typescript-standards.md)
Plans naming: {name}.md (e.g., user-auth.md)
MIT
FAQs
Comprehensive planning toolkit for OpenCode: manage specifications, track study plans, and automate roadmaps.
The npm package @howaboua/opencode-planning-toolkit receives a total of 23 weekly downloads. As such, @howaboua/opencode-planning-toolkit popularity was classified as not popular.
We found that @howaboua/opencode-planning-toolkit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.