opencode-cli

This is non-executable configuration documentation with no direct evidence of malware or intentional sabotage. It does recommend installing and automatically running unpinned third-party npm MCP servers and placing credentials in configuration files, creating meaningful supply-chain, credential-exposure, and database-impact risks. Package identity, publisher provenance, versions, integrity hashes, and MCP permissions should be verified before use.