
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
opencode-avatar
Advanced tools
Dynamic desktop avatar plugin for OpenCode that reacts to your coding activities
A dynamic desktop avatar plugin for OpenCode that displays animated character reactions based on your coding activities.
Warning: If you use a lot of varied tools (like from an MCP), it will generate a lot of images per tool usage, which may cost alot with Nano Banana Pro. Character images for a tool are only generated as used.
Then add to your OpenCode config:
{
"$schema": "https://opencode.ai/config.json",
"plugin": ["opencode-avatar"]
}
Create a config file at ~/.config/opencode/opencode-avatar.json:
{
"falKey": "your_fal_ai_api_key_here"
}
Get your FAL.ai API key from fal.ai.
You can optionally add a "prompt" field to customize how avatars are generated. This text will be appended to all avatar generation prompts:
{
"falKey": "your_fal_ai_api_key_here",
"prompt": "in a futuristic cyberpunk style with neon lights"
}
The prompt will be added to the end of the AI generation request, allowing you to customize the avatar style, theme, or appearance consistently across all avatar variants.
The plugin automatically downloads a default avatar (avatar.png) to ~/.config/opencode/avatar.png if it doesn't exist. This serves as the source image for generating animated variants.
To use your own custom avatar:
avatar.png image in ~/.config/opencode/The plugin generates and caches avatar variants in the same directory:
avatar_write.png - Writing poseavatar_read.png - Reading poseavatar_thinking_hard.png - Thinking animationAll avatars are stored in ~/.config/opencode/ for persistence across updates.
| State | Trigger | Description |
|---|---|---|
| Default | Session idle | Neutral pose, waiting for input |
| Thinking | User message | "Thinking hard" animation while processing |
| Tool Active | Tool execution | Pose based on current tool (write, read, etc.) |
Avatar images are cached with predictable filenames:
avatar_write.png - Writing toolavatar_read.png - Reading toolavatar_thinking_hard.png - Thinking stateThe avatar responds automatically, but you can also:
Check the console output for detailed information.
The output shows:
├── index.ts # Main plugin logic
├── electron.ts # Desktop window management
├── avatar.png # Default avatar image
└── dist/ # Compiled output
chat.message - Detects user inputtool.execute.before - Detects tool usageevent - Handles session state changes| Endpoint | Method | Description |
|---|---|---|
/health | GET | Health check |
/heartbeat | POST | Keep-alive signal |
/set-avatar | POST | Change displayed avatar |
/generate-avatar | POST | Generate new avatar |
/shutdown | POST | Graceful shutdown |
~/.config/opencode/opencode-avatar.jsonfocusable: false in window confignpm run build
# Test Electron window
npm run start
# Test with thinking avatar
npm run start:thinking
MIT License - see LICENSE file for details.
FAQs
Dynamic desktop avatar plugin for OpenCode that reacts to your coding activities
The npm package opencode-avatar receives a total of 33 weekly downloads. As such, opencode-avatar popularity was classified as not popular.
We found that opencode-avatar demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.