
Research
/Security News
CanisterWorm: npm Publisher Compromise Deploys Backdoor Across 29+ Packages
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.
OpenCode Router: Slack + Telegram bridge + directory routing for a running OpenCode server
Simple Slack + Telegram bridge + directory router for a running OpenCode server.
One-command install (recommended):
curl -fsSL https://raw.githubusercontent.com/different-ai/openwork/dev/packages/opencode-router/install.sh | bash
Or install from npm (package name is still owpenwork):
npm install -g owpenwork
Quick run without install:
npx owpenwork
Then follow the guided setup (choose what to configure, start).
.env if missing):pnpm -C packages/opencode-router setup
packages/opencode-router/.env (see .env.example).Required:
OPENCODE_URLOPENCODE_DIRECTORYRecommended:
OPENCODE_SERVER_USERNAMEOPENCODE_SERVER_PASSWORDopencode-router
Telegram support is configured via identities. You can either:
TELEGRAM_BOT_TOKEN=...opencode-router.json) using the CLI:opencode-router telegram add <token> --id default
opencode-router telegram list
Slack support uses Socket Mode and replies in threads when @mentioned in channels.
xapp-...).chat:writeapp_mentions:readim:historyapp_mentionmessage.imopencode-router slack add ...):
SLACK_BOT_TOKEN=xoxb-...SLACK_APP_TOKEN=xapp-...SLACK_ENABLED=trueTo add multiple Slack apps:
opencode-router slack add <xoxb> <xapp> --id default
opencode-router slack list
The router routes messages based on (channel, identityId, peerId) -> directory bindings.
opencode-router bindings set --channel telegram --identity default --peer <chatId> --dir /path/to/workdir
opencode-router bindings list
The router can expose a small local HTTP server for health/config and simple message dispatch.
OPENCODE_ROUTER_HEALTH_PORT controls the port (OpenWork defaults to a random free port when using openwrk).PORT is also accepted as a convenience if the above are unset.OPENCODE_ROUTER_HEALTH_HOST controls bind host (default: 127.0.0.1).Send a message to all peers bound to a directory:
curl -sS "http://127.0.0.1:${OPENCODE_ROUTER_HEALTH_PORT:-3005}/send" \
-H 'Content-Type: application/json' \
-d '{"channel":"telegram","directory":"/path/to/workdir","text":"hello"}'
opencode-router start
opencode-router status
opencode-router telegram list
opencode-router telegram add <token> --id default
opencode-router slack list
opencode-router slack add <xoxb> <xapp> --id default
opencode-router bindings list
opencode-router bindings set --channel telegram --identity default --peer <chatId> --dir /path/to/workdir
~/.openwork/opencode-router/opencode-router.db unless overridden.~/.openwork/opencode-router/opencode-router.json (created by opencode-router or pnpm -C packages/opencode-router setup).GROUPS_ENABLED=true.pnpm -C packages/opencode-router test:unit
pnpm -C packages/opencode-router test:smoke
pnpm -C packages/opencode-router test:cli
pnpm -C packages/opencode-router test:npx
FAQs
OpenCode Router: Slack + Telegram bridge + directory routing for a running OpenCode server
We found that owpenwork demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.