
Research
TeamPCP Compromises Telnyx Python SDK to Deliver Credential-Stealing Malware
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.
opencode-lazy
Advanced tools
Plugin manager for OpenCode. Search, install, and manage plugins without leaving your session.
Plugin manager for OpenCode. Search, install, and manage plugins without leaving your session.
Inspired by lazy.nvim — you should never have to leave your editor to manage plugins.
The plugin registers a /plugin slash command and four tools via OpenCode's plugin hooks. When you run a command, the LLM calls the appropriate tool, which hits the npm registry and modifies your opencode.json directly. Config modifications use jsonc-parser to preserve any comments in your config files.
npm install -g opencode-lazy
Then add to the plugin array in your opencode.json:
{
"plugin": ["opencode-lazy"]
}
/plugin search <query> Search npm for OpenCode plugins
/plugin install <name> Add a plugin to your config
/plugin list Show all installed plugins
/plugin remove <name> Remove a plugin from your config
/plugin search auth
Searches the npm registry for packages prefixed with opencode- and returns matching results with name, version, and description. Supports scoped packages (@org/opencode-*).
/plugin install opencode-wakatime
Validates the package on npm, adds it to your opencode.json plugin array. Restart OpenCode to activate.
By default, plugins are added to the global config (~/.config/opencode/opencode.json). The LLM can also install to the project config if you ask.
/plugin list
Shows all plugins from both global and project configs.
/plugin remove opencode-wakatime
Removes the plugin from your config. Restart OpenCode to apply.
/plugin command via the config hook at startuptool hook (plugin_search, plugin_install, plugin_list, plugin_remove)registry.npmjs.org/-/v1/search)opencode- or tagged with opencode-pluginopencode.json using jsonc-parser to preserve comments and formatting~/.config/opencode/) and project-level configs/plugin command uses a small number of tokens since the LLM is in the loopThis project is not built by the OpenCode team and is not affiliated with OpenCode in any way.
MIT
FAQs
Plugin manager for OpenCode. Search, install, and manage plugins without leaving your session.
The npm package opencode-lazy receives a total of 172 weekly downloads. As such, opencode-lazy popularity was classified as not popular.
We found that opencode-lazy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.

Security News
/Research
Widespread GitHub phishing campaign uses fake Visual Studio Code security alerts in Discussions to trick developers into visiting malicious website.