
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
DEPRECATED: OpenAgents Tricoder bridge (v0.2.x only, use Swift v0.3+ instead)
This package is deprecated and no longer maintained.
As of version 0.3, OpenAgents has moved to a native Swift architecture for iOS and macOS. This npm package (tricoder) and the Rust bridge it depends on are no longer supported.
If you were using tricoder with v0.2.x:
Download the new native app:
No data migration: v0.3 is a fresh start with a new architecture
Uninstall this package: npm uninstall -g tricoder
The v0.2 architecture (Expo + Rust) was a proof-of-concept. v0.3 provides:
v0.2.5 was the last functional release of this package. It will continue to work with the v0.2 Expo mobile app, but both are no longer maintained.
OpenAgents Tricoder (CLI)
Desktop bridge for the OpenAgents mobile app. Currently iOS only via TestFlight — join here: https://testflight.apple.com/join/dvQdns5B
Quick Start
Behavior
openagents://connect?j=....hosts list (LAN and/or Tailscale IPs).--no-run to only show the QR/deep link without launching the bridge.oa-bridge binary (downloaded and cached); falls back to cargo run -p oa-bridge if no binary is available.TRICODER_BRIDGE_PORT (default 8787) and automatically picks the next available port if the preferred port is busy.~/.openagents/bridge.json token across runs; --rotate-token generates and persists a new token.TRICODER_PREFER=lan.hosts[] list (LAN and/or Tailscale). The app prefers hosts[0].Flags
~/.openagents/bridge.json (or $OPENAGENTS_HOME/bridge.json).Environment
tailscale (default) or lan — choose which IP to advertise.0.0.0.0:8888. Overrides the chosen port.0 to force cargo fallback instead of using a prebuilt bridge binary.oa-bridge (e.g., v0.2.3). If the cached version differs, tricoder downloads the requested version.1 to bypass cache and fetch the latest release with matching assets.1 to prefer a bridge on your PATH over prebuilt/cargo.v0.2.5). If an older cached binary is found, tricoder falls back to cargo to build latest from your local clone.Output
Notes
Verbose logging
--verbose to print diagnostics:
Bind: 0.0.0.0:8787).~/.claude/local/claude (exported via CLAUDE_BIN) or left to PATH.Claude Code (headless)
~/.claude/local/claude automatically so shell aliases don’t interfere.claude -p "<prompt>" --output-format stream-json --verbose.bridge.session_started when Claude prints init; maps session → thread.Changelog
TRICODER_BRIDGE_VERSION pin; TRICODER_BRIDGE_FORCE_UPDATE=1 to bypass cache; minimum-prebuilt version gate with cargo fallback.--no-run opt‑out.FAQs
DEPRECATED: OpenAgents Tricoder bridge (v0.2.x only, use Swift v0.3+ instead)
We found that tricoder demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.