
Research
/Security News
PolinRider Spreads Through Compromised GitHub Accounts and Packagist
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.
@omniroute/opencode-provider
Advanced tools
OpenCode provider helper for the OmniRoute AI Gateway. Generates a schema-valid provider entry for opencode.json that delegates the runtime to @ai-sdk/openai-compatible.
Helper for connecting OpenCode to a running OmniRoute AI gateway.
The package emits a schema-valid entry for opencode.json (https://opencode.ai/config.json) that delegates the actual runtime to @ai-sdk/openai-compatible. It does not ship any new HTTP client — OmniRoute already exposes an OpenAI-compatible surface, and OpenCode already speaks it through the AI SDK.
Pre-1.0. The API may still change. See
CHANGELOGin the OmniRoute repo for breaking notes.
npm install --save-dev @omniroute/opencode-provider
# or
pnpm add -D @omniroute/opencode-provider
You also need OpenCode's own runtime dep, but that's a transitive concern — OpenCode itself ships with @ai-sdk/openai-compatible. This package only generates configuration.
opencode.jsonimport { writeFileSync } from "node:fs";
import { buildOmniRouteOpenCodeConfig } from "@omniroute/opencode-provider";
const config = buildOmniRouteOpenCodeConfig({
baseURL: "http://localhost:20128", // or your OmniRoute deployment URL
apiKey: process.env.OMNIROUTE_API_KEY ?? "sk_omniroute",
});
writeFileSync("opencode.json", JSON.stringify(config, null, 2));
The resulting opencode.json:
{
"$schema": "https://opencode.ai/config.json",
"provider": {
"omniroute": {
"npm": "@ai-sdk/openai-compatible",
"name": "OmniRoute",
"options": {
"baseURL": "http://localhost:20128/v1",
"apiKey": "sk_omniroute",
},
"models": {
"claude-opus-4-5-thinking": { "name": "claude-opus-4-5-thinking" },
"claude-sonnet-4-5-thinking": { "name": "claude-sonnet-4-5-thinking" },
"gemini-3.1-pro-high": { "name": "gemini-3.1-pro-high" },
"gemini-3-flash": { "name": "gemini-3-flash" },
},
},
},
}
opencode.jsonimport { createOmniRouteProvider } from "@omniroute/opencode-provider";
const provider = createOmniRouteProvider({
baseURL: "http://localhost:20128",
apiKey: process.env.OMNIROUTE_API_KEY!,
});
// Place `provider` under provider.omniroute in your opencode.json
If you already have an opencode.json on disk and want a non-destructive merge from the OmniRoute side, use omniroute config opencode from the CLI (ships with the main OmniRoute install) — it preserves comments and unrelated keys.
createOmniRouteProvider(options): OpenCodeProviderEntryReturns the value to place under provider.omniroute inside opencode.json.
| Option | Type | Required | Description |
|---|---|---|---|
baseURL | string | Yes | OmniRoute base URL. Accepts http://host:port or http://host:port/v1. Trailing slashes are tolerated. |
apiKey | string | Yes | OmniRoute API key. Use sk_omniroute for local installs that have REQUIRE_API_KEY=false. |
displayName | string | No | Custom name shown in the OpenCode UI. Default: "OmniRoute". |
models | string[] | No | Override the surfaced model catalog. Default: 4 curated models — see OMNIROUTE_DEFAULT_OPENCODE_MODELS. |
modelLabels | Record<string,string> | No | Human-readable labels keyed by model id. |
Throws on empty/invalid input — baseURL must be a real URL, apiKey must be a non-empty string.
buildOmniRouteOpenCodeConfig(options): OpenCodeConfigDocumentSame options as above, but returns a full document with $schema and the provider.omniroute wrapper, ready to write to opencode.json.
normalizeBaseURL(input): stringExported for completeness. Strips trailing /, deduplicates a trailing /v1, and re-appends exactly one /v1. Throws on empty / non-URL input.
OMNIROUTE_PROVIDER_KEY — "omniroute" (the key used under provider.*).OMNIROUTE_PROVIDER_NPM — "@ai-sdk/openai-compatible" (the runtime delegate).OPENCODE_CONFIG_SCHEMA — "https://opencode.ai/config.json".OMNIROUTE_DEFAULT_OPENCODE_MODELS — readonly list of 4 default model ids.import { createOmniRouteProvider } from "@omniroute/opencode-provider";
createOmniRouteProvider({
baseURL: "http://localhost:20128",
apiKey: "sk_omniroute",
models: ["auto", "claude-opus-4-7", "gpt-5.5"],
modelLabels: {
auto: "Auto-Combo (recommended)",
"claude-opus-4-7": "Claude Opus 4.7",
"gpt-5.5": "GPT-5.5",
},
});
Duplicates and empty strings are dropped automatically, and order is preserved.
/v1/v1/... — you're on an old version (≤1.0.0). Update to ≥0.1.0 of this re-released package. The new build normalises baseURL automatically.401 Invalid API key — your OmniRoute instance has REQUIRE_API_KEY=true but the key you supplied doesn't exist there. Create one via the dashboard or set REQUIRE_API_KEY=false and use sk_omniroute.models list; the default 4 may be hidden by your provider visibility settings.@ai-sdk/openai-compatible — the runtime delegate that actually speaks HTTP.MIT — see LICENSE.
FAQs
OpenCode provider helper for the OmniRoute AI Gateway. Generates a schema-valid provider entry for opencode.json that delegates the runtime to @ai-sdk/openai-compatible.
The npm package @omniroute/opencode-provider receives a total of 121 weekly downloads. As such, @omniroute/opencode-provider popularity was classified as not popular.
We found that @omniroute/opencode-provider demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

Company News
Allow myself to introduce... myself.