
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@itlackey/openkit
Advanced tools
Developer toolkit to package and publish OpenCode extensions (agents, commands, plugins, skills, tools, themes) as one npm plugin.
Ship production-ready OpenCode extensions as one npm package.
OpenKit gives you a CLI and installer library for packaging and distributing agents, commands, plugins, skills, tools, and themes. Add files to opencode/, publish once, and your users install with a single command or plugin entry.
overwrite: false).OpenKit includes a CLI for managing openkit-compatible packages in your project.
Find openkit-compatible packages on npm and GitHub:
npx @itlackey/openkit search [query]
Searches npm for packages with the openkit keyword and GitHub for repositories with the openkit topic.
Install a package and copy its extensions into your project:
npx @itlackey/openkit add <package>
This will:
opencode/ assets into your project's .opencode/ directory.opencode.json.Remove a package and clean up its extensions:
npx @itlackey/openkit remove <package>
This will:
.opencode/.opencode.json.bun add @itlackey/openkit
If you also register tools directly in your plugin, add @opencode-ai/plugin too.
Drop files into the opencode/ directory in your package:
opencode/
├── agents/ # .md — agent definitions (primary or subagent)
├── commands/ # .md — slash commands
├── plugins/ # .ts — full Plugin API
├── skills/ # SKILL.md in named folders
├── tools/ # .ts — custom tools
└── themes/ # .json — color themes
Create a plugin that uses the OpenKit installer to copy your extensions into the user's project:
import { createInstallerPlugin } from "@itlackey/openkit/install"
export const plugin = createInstallerPlugin({
name: "my-opencode-extension",
sourceUrl: import.meta.url,
})
Add your package to the project's opencode.json:
{
"$schema": "https://opencode.ai/config.json",
"plugin": ["my-opencode-extension"]
}
When OpenCode starts, the installer copies your opencode/ files into the project's .opencode/ directory. Existing files are never overwritten by default, so user customizations stay intact.
Use this when your package only ships file-based extensions (agents, commands, skills, tools, themes):
import { createInstallerPlugin } from "@itlackey/openkit/install"
export const plugin = createInstallerPlugin({
name: "my-opencode-extension",
sourceUrl: import.meta.url,
})
Mix the installer with your own tools and hooks:
import { type Plugin, tool } from "@opencode-ai/plugin"
import { installExtensions } from "@itlackey/openkit/install"
export const plugin: Plugin = async (input) => {
await installExtensions({
sourceUrl: import.meta.url,
targetDir: input.directory,
name: "my-opencode-extension",
})
return {
tool: {
"my-tool": tool({
description: "Example tool",
args: {
message: tool.schema.string().describe("Message to echo"),
},
async execute({ message }) {
return `my-tool: ${message}`
},
}),
},
}
}
{
"name": "my-opencode-extension",
"type": "module",
"main": "./dist/index.js",
"types": "./dist/index.d.ts",
"exports": {
".": {
"types": "./dist/index.d.ts",
"default": "./dist/index.js"
}
},
"files": ["dist", "opencode"],
"dependencies": {
"@itlackey/openkit": "^0.1.0"
}
}
| Option | Required | Default | Description |
|---|---|---|---|
name | yes | — | Label for log messages |
dirs | no | all 6 types | Limit which subdirectories to install |
overwrite | no | false | Overwrite existing files |
sourceUrl | yes | — | Pass import.meta.url to resolve the package's opencode/ directory |
Each extension type lives in a subdirectory under opencode/:
| Directory | File type | Description |
|---|---|---|
agents/ | .md | Agent definitions (primary or subagent) |
commands/ | .md | Slash commands |
plugins/ | .ts | Full Plugin API implementations |
skills/ | SKILL.md in named folders | Prompt templates |
tools/ | .ts | Custom tools |
themes/ | .json | Color themes |
This package includes OpenCode-ready plugin management helpers:
openkit-search — search for OpenKit-compatible packagesopenkit-add — install and register a package in opencode.jsonopenkit-remove — remove a package and clean copied extension filesopenkit skill — guidance for selecting the best plugin using OpenKit search + curl@openkit-agent — subagent for plugin discovery and lifecycle managementFrom your assistant, call these tools directly:
openkit-search with query: "discord moderation"openkit-add with packageName: "@example/opencode-discord"openkit-remove with packageName: "@example/opencode-discord"Use @openkit-agent when users ask to:
The agent uses the OpenKit tools above and follows the openkit skill workflow for candidate evaluation and recommendations.
Before running npm publish:
my-opencode-extension) and concise description.opencode, opencode-plugin, opencode-extension, openkit.main/exports point to compiled JS in dist/ and types points to declarations.files includes everything users need (dist, opencode).opencode.json plugin entry in a sample project.FAQs
Developer toolkit to package and publish OpenCode extensions (agents, commands, plugins, skills, tools, themes) as one npm plugin.
We found that @itlackey/openkit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.