
Security News
/Research
Popular node-ipc npm Package Infected with Credential Stealer
Socket detected malicious node-ipc versions with obfuscated stealer/backdoor behavior in a developing npm supply chain attack.
@opencode-cloud/core
Advanced tools
A production-ready toolkit for deploying opencode as a persistent cloud service.
opencode-cloud / occ)curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | shnpx opencode-cloud --version
Or install globally:
npm install -g opencode-cloud
occ --version
cargo install opencode-cloud
opencode-cloud --version
git clone https://github.com/pRizz/opencode-cloud.git
cd opencode-cloud
just build
cargo run -p opencode-cloud -- --version
# Show version
occ --version
# Start the service (builds image on first run)
occ start
# Start on a custom port
occ start --port 8080
# Start and open browser
occ start --open
# Check service status
occ status
# View logs
occ logs
# Follow logs in real-time
occ logs -f
# Stop the service
occ stop
# Restart the service
occ restart
# Install as a system service (starts on login/boot)
occ install
# Uninstall the system service
occ uninstall
# View configuration
occ config show
When developing locally or after updating opencode-cloud, you may need to rebuild the Docker image to pick up changes in the embedded Dockerfile:
# Rebuild using Docker cache (fast - only rebuilds changed layers)
occ start --cached-rebuild
# Rebuild from scratch without cache (slow - for troubleshooting)
occ start --full-rebuild
--cached-rebuild (recommended for most cases):
--full-rebuild (for troubleshooting):
When to rebuild:
--cached-rebuild--cached-rebuild--cached-rebuild first, then --full-rebuild--full-rebuildConfiguration is stored at:
~/.config/opencode-cloud/config.jsonData (PID files, etc.) is stored at:
~/.local/share/opencode-cloud/# Install dependencies
pnpm install
# Configure git hooks (once after cloning)
git config core.hooksPath .githooks
# Build everything
just build
# Compile and run occ (arguments automatically get passed to the binary)
just run --version
# Run tests
just test
# Format and lint
just fmt
just lint
Note: The git hooks automatically sync
README.mdto npm package directories on commit.
This is a monorepo with:
packages/core - Rust core library with NAPI-RS bindingspackages/cli-rust - Rust CLI binarypackages/cli-node - Node.js CLI wrapper (calls into core via NAPI)The npm package compiles the Rust core on install (no prebuilt binaries).
The packages/core/Cargo.toml file must use explicit values rather than workspace = true references. This is because when users install the npm package, they only get packages/core/ without the workspace root Cargo.toml, so workspace inheritance would fail.
When updating package metadata (version, edition, rust-version, etc.), keep both files in sync:
Cargo.toml (workspace root)packages/core/Cargo.tomlUse scripts/set-all-versions.sh <version> to update versions across all files automatically.
MIT
FAQs
Core NAPI bindings for opencode-cloud (internal package)
The npm package @opencode-cloud/core receives a total of 119 weekly downloads. As such, @opencode-cloud/core popularity was classified as not popular.
We found that @opencode-cloud/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
Socket detected malicious node-ipc versions with obfuscated stealer/backdoor behavior in a developing npm supply chain attack.

Security News
TeamPCP and BreachForums are promoting a Shai-Hulud supply chain attack contest with a $1,000 prize for the biggest package compromise.

Security News
Packagist urges PHP projects to update Composer after a GitHub token format change exposed some GitHub Actions tokens in CI logs.