
Research
Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Exposes CI/CD Secrets
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.
@howaboua/opencode-roadmap-plugin
Advanced tools
Strategic roadmap planning and multi-agent coordination for OpenCode
Persistent project roadmaps for OpenCode. Coordinates work across sessions and parallel Task tool subagents.
OpenCode's built-in todo is session-scoped—it disappears when you restart. Task tool subagents are stateless—they can't see each other's work.
This plugin solves both:
in_progress and avoid conflictsAdd to your opencode.json:
{
"plugin": ["@howaboua/opencode-roadmap-plugin@latest"]
}
OpenCode installs it automatically on next launch.
createroadmapCreate or extend a project roadmap. Requires a feature list and a short spec for each feature.
"Create a roadmap with features: 1) Auth, 2) Profiles. Specs: Auth uses OAuth and must support password reset; Profiles needs avatar uploads and privacy settings"
"1", "2", "3") and include a brief spec- [ ] 1.01 ...) within featurespendingreadroadmapView current state and progress.
"Show me the roadmap"
"What's the status of feature 2?"
Before delegating work to Task tool subagents, instruct them to read the roadmap first so they understand their assigned action within the broader plan.
updateroadmapChange action status or description. Each update includes a brief note appended to the updates section.
"Mark action 1.01 as in_progress — Drafted schema notes"
"Action 2.03 is completed — Added tests for edge cases"
Statuses: pending → in_progress → completed | cancelled
Transitions are flexible—you can revert if plans change. Only cancelled is terminal.
Auto-archives the roadmap when all actions reach completed.
When multiple subagents work simultaneously:
in_progressin_progress actionThis prevents conflicts when subagents run in parallel.
You: "Plan out building a REST API with auth, users, and posts endpoints"
AI: Creates roadmap with 3 features, ~12 actions
You: "Implement feature 1"
AI: Reads roadmap → sees Feature 1 has 4 actions → uses todowrite for immediate steps → delegates to subagents → each subagent reads roadmap first → updates status when done
MIT
FAQs
Strategic roadmap planning and multi-agent coordination for OpenCode
The npm package @howaboua/opencode-roadmap-plugin receives a total of 5 weekly downloads. As such, @howaboua/opencode-roadmap-plugin popularity was classified as not popular.
We found that @howaboua/opencode-roadmap-plugin demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.

Research
/Security News
We identified over 20 additional malicious extensions, along with over 20 related sleeper extensions, some of which have already been weaponized.