
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
opencode-plugin-zooplankton
Advanced tools
Unified global OpenCode plugin for ZooplanktonAI — coding standards, multi-agent skills (plan / orchestrate), commands, guides, and the autonomous-mode permission hook.
The unified global OpenCode plugin for ZooplanktonAI.
This repo is self-hosted: it uses the plugin it ships for its own development workflow.
Pushes instructions/coding-standards.md into every LLM call's system prompt array — including subagents — via the experimental.chat.system.transform hook. This ensures standards stay salient even in long multi-agent conversations where trailing instructions may be deprioritized.
Current rules:
master over main — use master as the default branch name for new repos./tmp/ and pass the path instead of inlining.use context7) for library docs, gh_grep for cross-repo examples; prefer these over open-ended web search.Multi-agent software development skills auto-discovered by OpenCode via config.skills.paths:
Registered on startup via the config hook into config.command:
/zooplankton-init — Scaffold zooplankton.json, agent MD files, and plan/retro templates for a project./zooplankton-update — Refresh agent MD files from the latest guides (after plugin upgrade)./zooplankton-add-agent — Add a new agent MD file to the project./zooplankton-plan — Run the plan skill standalone (design + decompose)./zooplankton-orchestrate — Run the full orchestrate workflow on a given task./zooplankton-orchestrate-auto — Run orchestrate in autonomous mode (auto-approves all steps)./zooplankton-orchestrate-resume — Resume an interrupted orchestrate run./zooplankton-pr-review — Run review-only on an existing PR (no implementation).Per-role agent instructions under guides/, with unified files containing inline mode callouts:
core-coder, junior-coder, frontend-codercore-reviewer, reviewer (normal), security-reviewer, frontend-reviewerexplorersagepr-commentatorEach role has a single unified guide (e.g. core-coder-guide.md) with inline > **GitHub mode:** / > **Local mode:** callouts. /zooplankton-init generates agent MD files that reference the unified guide; the agent reads project.platform from zooplankton.json at invocation time.
When autonomousMode: true in a project's zooplankton.json, the permission.asked hook auto-allows every permission request — intended for CI / trusted automation scenarios. Exception: doom_loop requests are always denied regardless of autonomousMode — infinite-loop protection is never bypassed.
The tool.execute.before hook blocks reads and writes to ~/.ssh/*, ~/.npmrc, and ~/.netrc. (.env is already blocked natively by OpenCode.) Project-level .npmrc files outside the home directory are permitted.
Install globally so it applies to every project:
# In ~/.config/opencode/
npm install opencode-plugin-zooplankton
Add to ~/.config/opencode/opencode.json:
{
"plugin": ["opencode-plugin-zooplankton"]
}
That's it. Skills, commands, guides, and coding-standards injection all activate automatically. No per-project install or file copying needed.
Migrating from the old split: If your
opencode.jsonalso listed"opencode-plugin-coding", remove it — that package is deprecated and its contents live here now.
The plugin registers six OpenCode hooks:
experimental.chat.system.transform — Appends instructions/coding-standards.md content to the system[] array for every LLM call (including subagents). Deduplicated via LF-normalized substring check so repeated calls don't pile up.
config — Pushes skills/ into config.skills.paths and merges every .md file under commands/ into config.command. Pre-existing user commands take precedence.
permission.asked — Reads zooplankton.json from the working directory; sets output.action = "allow" when autonomousMode === true. Always sets output.action = "deny" for doom_loop requests (infinite-loop protection is never bypassed).
tool.execute.before — Blocks reads and writes to ~/.ssh/*, ~/.npmrc, and ~/.netrc. Project-level .npmrc files (outside the home directory) are permitted.
experimental.session.compacting — Injects zooplankton.json project config (platform, repo, autonomousMode) into the session compaction context so these settings persist across summary boundaries.
event — When notifications: true in zooplankton.json, shows a TUI toast when a session goes idle. Opt-in; silently no-ops when the TUI client is unavailable (e.g., headless/CI).
Note:
experimental.chat.system.transformis an experimental OpenCode API (available since OpenCode ≥0.1) and may change in future versions.
Edit instructions/coding-standards.md, bump the version in package.json, then republish.
These are not bundled but are referenced in Coding Standard Rule 5. Install them globally for the best experience.
Fetches current, version-specific library documentation directly from source. Invoke by appending use context7 to any prompt about a library's API.
npx ctx7 setup --opencode
Cross-repo code search across public GitHub. Zero-auth, no install needed — just add to opencode.json:
{
"mcp": {
"gh_grep": {
"type": "sse",
"url": "https://mcp.grep.app/sse"
}
}
}
Requires Node.js >= 20.
git clone git@github.com:ZooplanktonAI/opencode-plugin-zooplankton.git
cd opencode-plugin-zooplankton
npm install
npm test
See AGENTS.md for the full project knowledge base, repository layout, conventions, and release checklist.
FAQs
Unified global OpenCode plugin for ZooplanktonAI — coding standards, multi-agent skills (plan / orchestrate), commands, guides, and the autonomous-mode permission hook.
The npm package opencode-plugin-zooplankton receives a total of 18 weekly downloads. As such, opencode-plugin-zooplankton popularity was classified as not popular.
We found that opencode-plugin-zooplankton demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.