
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
opencode-browser
Advanced tools
An OpenCode plugin that integrates Browser MCP to enable browser automation capabilities within OpenCode. This plugin allows the AI to control a browser, navigate websites, fill forms, click elements, and perform other browser automation tasks.

Before using this plugin, you need:
Fastest path:
npx opencode-browser init
This creates or updates ./opencode.json with the required plugin and mcp.browsermcp entries while preserving any unrelated config you already have.
For a global setup instead of a project-local one:
npx opencode-browser init --global
Create or update your opencode.json configuration file. You can create this file in one of two locations:
~/.config/opencode/opencode.json./opencode.json (in your project root)Learn more about OpenCode configuration at https://opencode.ai/docs/config
Add this configuration to your opencode.json:
{
"$schema": "https://opencode.ai/config.json",
"plugin": ["opencode-browser"],
"mcp": {
"browsermcp": {
"type": "local",
"command": ["npx", "-y", "@browsermcp/mcp@0.1.3"],
"enabled": true
}
}
}
This configuration does two things:
opencode-browser from npmThat's it! No manual file copying required. OpenCode handles everything automatically.
The generated command pins the Browser MCP package version to avoid the extra @latest resolution step on startup and keep launches reproducible.
If you prefer to preview the generated config without writing it yet:
npx opencode-browser init --print
If you want to modify the plugin or test changes:
For global installation:
mkdir -p ~/.config/opencode/plugins
cp src/index.ts ~/.config/opencode/plugins/browser-mcp.ts
For project-specific installation:
mkdir -p .opencode/plugins
cp src/index.ts .opencode/plugins/browser-mcp.ts
The plugin will be automatically loaded on OpenCode startup.
The minimal configuration requires only the MCP server setup:
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"browsermcp": {
"type": "local",
"command": ["npx", "-y", "@browsermcp/mcp@0.1.3"],
"enabled": true
}
}
}
For more control, you can disable Browser MCP tools globally and enable them per agent:
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"browsermcp": {
"type": "local",
"command": ["npx", "-y", "@browsermcp/mcp@0.1.3"],
"enabled": true
}
},
"tools": {
"browsermcp_*": false
},
"agent": {
"browser-agent": {
"tools": {
"browsermcp_*": true
}
}
}
}
The plugin improves Browser MCP speed by shaping how the model uses browser tools:
If you need to pass environment variables to the Browser MCP server:
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"browsermcp": {
"type": "local",
"command": ["npx", "-y", "@browsermcp/mcp@0.1.3"],
"enabled": true,
"environment": {
"BROWSER_MCP_DEBUG": "true"
}
}
}
}
Once installed and configured, you can use browser automation in your OpenCode prompts:
Navigate to https://github.com and search for "opencode"
Go to the contact form at https://example.com/contact and fill in:
- Name: John Doe
- Email: john@example.com
- Message: Hello from OpenCode!
Then submit the form.
Visit https://news.ycombinator.com and get the titles of the top 5 stories
Go to https://example.com/login, log in with the test credentials,
navigate to the dashboard, and screenshot the main metrics panel
For best results when using browser automation:
You can also add browser automation guidelines to your AGENTS.md file:
## Browser Automation
When performing browser automation tasks:
- Always confirm the page has loaded before interacting
- Use descriptive selectors (prefer text content over CSS selectors)
- Take screenshots when verification is needed
- Handle errors gracefully (page not found, element not visible, etc.)
- Close tabs when the task is complete
The plugin biases the model toward faster browser workflows:
navigate calls when the destination URL is knownsnapshot, screenshot, and wait calls unless they are actually neededThe plugin still detects browser connection issues, but it no longer adds artificial retry sleeps:
The plugin automatically detects when Browser MCP tools are being used and applies browser-specific guidance.
During session compaction, the plugin preserves browser automation context, ensuring the AI remembers:
The plugin annotates Browser MCP tool definitions with performance notes, especially for slower tools like snapshots, screenshots, and waits.
If you see connection errors:
The plugin will display messages like:
[Browser MCP] The browser connection looks unavailable. Re-enable the Browser MCP extension or browser, then retry.[Browser MCP] Connection restored. Continuing without extra retry delay.opencode.json has the correct MCP configurationnode --version.ts or .jsEnable debug logging by modifying the plugin or checking OpenCode logs:
# Check OpenCode logs
opencode --verbose
If you want to modify the plugin:
src/index.tsThe plugin uses OpenCode's plugin system hooks:
experimental.chat.system.transform: Inject speed-oriented browser guidancetool.definition: Add performance hints to Browser MCP toolstool.execute.after: Post-process browser tool resultsexperimental.session.compacting: Preserve browser contextContributions are welcome! Please:
MIT License - See LICENSE file for details
For issues and questions:
See CHANGELOG.md for a detailed list of changes in each version.
FAQs
OpenCode plugin that integrates Browser MCP for browser automation
We found that opencode-browser demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.