
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Terminal UI for inspecting, filtering, and pruning OpenCode metadata stored on disk. The app is written in TypeScript, runs on Bun, and renders with @opentui/react.
Main workspace with Projects (left) and Sessions (right) panels.
Contextual help overlay with key bindings and tips.
/ to focus, Enter to apply, Esc or X to clear).? or H).bunx so even CI shells can run it without cloning.# Clone the repo and install deps
git clone git@github.com:kcrommett/oc-manager.git
cd oc-manager
bun install
# Or run on demand without cloning
bunx oc-manager --help
The repository ships with a focused .gitignore, keeping node_modules/, caches, and logs out of Git history.
# Preferred: zero-install command
bunx oc-manager --root ~/.local/share/opencode
# Local dev run (forwards extra args after --)
bun run tui -- --root ~/.local/share/opencode
# Legacy Python wrapper (still used by some automation)
./manage_opencode_projects.py --root ~/.local/share/opencode -- --help
Keyboard reference:
Tab/1/2 switch tabs, / search, X clear search, R reload, Q quit, ? help.Space toggle selection, A select all, M missing-only filter, D delete, Enter jump to Sessions.Space select, S toggle updated/created sort, D delete, C clear project filter, Enter details.bun install.bun run tui (pass storage flags after --).bun run dev for watch mode.bun run typecheck (tsc --noEmit).src/
bin/opencode-manager.ts # Bun-native CLI shim (binary name: oc-manager)
opencode-tui.tsx # Main TUI implementation (panels, search, help)
manage_opencode_projects.py # Legacy Python launcher for backwards compatibility
opencode-gen.sh # Spec snapshot helper script
PROJECT-SUMMARY.md # Extended design notes & roadmap
bun installbun run typecheckversion in package.jsonnpm publish (package exposes the oc-manager bin with public access)/tmp. Run bun run tui directly if tmux refuses to start.<text> nodes. When adding UI components, follow the existing helpers (e.g., KeyChip, Bullet).Esc while the search bar is focused, or hit X while in normal navigation.Issues and pull requests are welcome. Please include reproduction steps for metadata edge cases and run bun run typecheck before submitting patches.
MIT © OpenCode contributors. See LICENSE.
FAQs
Terminal UI for inspecting OpenCode metadata stores.
The npm package oc-manager receives a total of 0 weekly downloads. As such, oc-manager popularity was classified as not popular.
We found that oc-manager demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.