
Research
/Security News
CanisterWorm: npm Publisher Compromise Deploys Backdoor Across 29+ Packages
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.
opencode-router
Advanced tools
opencode-router: Slack + Telegram bridge + directory routing for a running opencode server
Simple Slack + Telegram bridge + directory router for a running opencode server.
Runtime requirement: Bun 1.3+ (bun --version).
One-command install (recommended):
curl -fsSL https://raw.githubusercontent.com/different-ai/openwork/dev/apps/opencode-router/install.sh | bash
Install from npm:
npm install -g opencode-router
Quick run without global install:
npx --yes opencode-router --help
Then configure identities and start.
.env if missing):pnpm -C apps/opencode-router setup
apps/opencode-router/.env (see .env.example).Required:
OPENCODE_URLOPENCODE_DIRECTORYRecommended:
OPENCODE_SERVER_USERNAMEOPENCODE_SERVER_PASSWORDopencode-router start
Telegram support is configured via identities. You can either:
TELEGRAM_BOT_TOKEN=...
opencode-router.json) using the CLI:opencode-router telegram add <token> --id default
opencode-router telegram list
Important for direct sends and bindings:
chat_id values.@username values are not valid direct peerId targets for router sends.chat not found./pair <code> before commands are accepted.Slack support uses Socket Mode and replies in threads when @mentioned in channels.
xapp-...).chat:writeapp_mentions:readim:historyfiles:readfiles:writeapp_mentionmessage.imopencode-router slack add ...):
SLACK_BOT_TOKEN=xoxb-...SLACK_APP_TOKEN=xapp-...SLACK_ENABLED=trueTo add multiple Slack apps:
opencode-router slack add <xoxb> <xapp> --id default
opencode-router slack list
The router routes messages based on (channel, identityId, peerId) -> directory bindings.
opencode-router bindings set --channel telegram --identity default --peer <chatId> --dir /path/to/workdir
opencode-router bindings list
The router can expose a small local HTTP server for health/config and simple message dispatch.
OPENCODE_ROUTER_HEALTH_PORT controls the port (OpenWork defaults to a random free port when using openwork).PORT is also accepted as a convenience if the above are unset.OPENCODE_ROUTER_HEALTH_HOST controls bind host (default: 127.0.0.1).Send a message to all peers bound to a directory:
curl -sS "http://127.0.0.1:${OPENCODE_ROUTER_HEALTH_PORT:-3005}/send" \
-H 'Content-Type: application/json' \
-d '{"channel":"telegram","directory":"/path/to/workdir","text":"hello"}'
Send text + media in one request:
curl -sS "http://127.0.0.1:${OPENCODE_ROUTER_HEALTH_PORT:-3005}/send" \
-H 'Content-Type: application/json' \
-d '{
"channel":"slack",
"peerId":"D12345678",
"text":"Here is the export",
"parts":[
{"type":"file","filePath":"./artifacts/report.pdf"},
{"type":"image","filePath":"./artifacts/plot.png","caption":"latest trend"}
]
}'
Supported media part types:
imageaudiofileEach media part accepts:
filePath (absolute path, or relative to the send directory/workspace root)captionfilenamemimeTypeopencode-router start
opencode-router status
opencode-router telegram list
opencode-router telegram add <token> --id default
opencode-router slack list
opencode-router slack add <xoxb> <xapp> --id default
opencode-router bindings list
opencode-router bindings set --channel telegram --identity default --peer <chatId> --dir /path/to/workdir
opencode-router send --channel telegram --identity default --to <chatId> --message "hello"
opencode-router send --channel telegram --identity default --to <chatId> --image ./plot.png --caption "plot"
opencode-router send --channel slack --identity default --to D123 --file ./report.pdf
~/.openwork/opencode-router/opencode-router.db unless overridden.~/.openwork/opencode-router/opencode-router.json (created by opencode-router or pnpm -C apps/opencode-router setup).GROUPS_ENABLED=true.test:smoke requires a running opencode server (default: http://127.0.0.1:4096).
opencode serve --port 4096 --hostname 127.0.0.1
pnpm -C apps/opencode-router test:smoke
Other test suites:
pnpm -C apps/opencode-router test:unit
pnpm -C apps/opencode-router test:cli
pnpm -C apps/opencode-router test:npx
FAQs
opencode-router: Slack + Telegram bridge + directory routing for a running opencode server
The npm package opencode-router receives a total of 2,581 weekly downloads. As such, opencode-router popularity was classified as popular.
We found that opencode-router demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.