██████╗ ██████╗ ███╗   ███╗
██╔═══██╗██╔══██╗████╗ ████║
██║   ██║██████╔╝██╔████╔██║
██║   ██║██╔═══╝ ██║╚██╔╝██║
╚██████╔╝██║     ██║ ╚═╝ ██║
 ╚═════╝ ╚═╝     ╚═╝     ╚═╝

On-chain
Package Security

Cryptographic attestation via ECDSA-signed manifests, multi-model AI auditing through intelligence-weighted LLM consensus, and immutable risk scoring anchored to Base L2. Zero-knowledge agent verification. Tamper-evident by design.

$npm install -g opmsec
→Read the Docs
opm-terminal
LIVE
user@dev:~/project$ █
Commands:1/3
Agents:3 Active
Chain:Base Sepolia

Every command, security-first.

Drop-in replacement for npm. Every operation gains cryptographic verification, AI-powered auditing, and on-chain attestation transparently.

01

Push

ECDSA-sign package manifest, dispatch to 3 independent LLM agents for parallel static analysis, aggregate weighted risk scores, register immutable attestation on Base L2

$ opm push
02

Install

Resolve ENS identity, verify ECDSA signature against on-chain registry, validate SHA-256 checksum, cross-reference OSV CVE database before extraction

$ opm install <pkg>
03

Check

Traverse full dependency DAG, run Levenshtein-distance typosquat detection against top 10k packages, OSV CVE lookup, upload report to Fileverse (IPFS)

$ opm check
Active Threat Landscape

This is happening
right now.

Supply chain attacks on npm aren't theoretical. Developers are losing money, shipping CVEs, and installing malware — every single week.

6,847

Malicious packages

removed from npm in 2025

$15M+

Developer losses

from wallet drainer packages

23%

Projects affected

by known CVEs in deps

4 hrs

Avg time to detect

a supply chain attack

cyberpress.org — March 2026
Supply Chain Attack
PhantomRaven malware targeting npm supply chain

PhantomRaven Targets npm Supply Chain

Malware campaign targeting developer secrets through typosquatted packages. Thousands of downloads before detection.

@imanishbarnwal
Funds Lost
Developer lost money from silent dev environment exploit

“I lost a significant amount of money due to a silent, zero-interaction dev environment exploit.”

@nextjs — 213K views
CVE
Next.js critical CVE-2025-66478 announcement

Critical vulnerability in React Server Components affecting Next.js. 213K+ views.

@trashh_dev
React CVE
Developer reaction to React CVE announcement

How developers react to yet another critical CVE in their dependency tree.

@arsh_goyal
Reality Check
Dependency management is the bottleneck

“Code generation isn't the bottleneck anymore. Dependency management is.”

OPM catches these before they reach your node_modules.

$npm install -g opmsec&&opm install

Security Primitives

Defense in depth, by default.

opm features --list
6 ACTIVE
$ opm features --scan
✓multi-agent-consensus
N-of-M parallel LLM dispatch with intelligence-weighted aggregation via Artificial Analysis benchmarks. No single-model failure point.
✓cryptographic-attestation
SHA-256 content-addressable checksums + secp256k1 ECDSA signatures. Tamper-evident supply chain attestation.
✓zk-agent-verification
Hash-commitment ZK scheme with circom circuit reference. Accuracy proven without revealing labeled test data.
✓on-chain-registry
OPMRegistry.sol: authorizedAgents, packages, versionData, AgentScores mappings. Fully queryable immutable state.
✓cve-typosquat-detection
OSV advisory database integration + Levenshtein-distance analysis against top 10k npm packages. Dependency confusion detection.
✓drop-in-npm-replacement
Transparent npm CLI interop: install, audit, check, push, fix — each operation layered with cryptographic verification.
6 Active
Zero config

Multi-Agent Consensus

N-of-M heterogeneous LLM ensemble with intelligence-weighted scoring derived from live Artificial Analysis quality and coding indices. Byzantine fault-tolerant by design.

opm agents --status
3 AUTHORIZED
$ opm agents --list
[1]●claude-opus-4.6(anthropic)
Primary scanner
[2]●gemini-3.1-pro(google)
Secondary analysis
[3]●deepseek-v3.2(deepseek)
Tertiary verification
$ opm register-agent --name my-agent --model gpt-5.4
$ opm info express # View agent scores
3 Active
ZK-verified
●Permissionless registration • 100% benchmark accuracy required • Scores on-chain

Verification Pipeline

Five-stage cryptographic attestation pipeline: from ECDSA signing through multi-agent consensus to on-chain settlement. Every package is verified before extraction to node_modules.

opm pipeline --visualize
01

Pack & Sign

SHA-256 content-addressable checksum + secp256k1 ECDSA signature via author wallet

02

Multi-Agent Scan

Parallel dispatch to N heterogeneous LLMs; each submits independent risk vector

03

Weighted Consensus

Intelligence-weighted aggregate via Artificial Analysis quality + coding indices

04

On-chain Registry

Package metadata, agent scores, Fileverse report URI settled on Base Sepolia L2

05

Install Verify

ECDSA signature + on-chain score lookup + OSV CVE cross-reference at extraction time

Fully on-chain. Fully verifiable.

OPMRegistry.sol deployed on Base Sepolia L2. Every package registration, agent score submission, ZK-verified agent authorization, and ENS-resolved author profile is an immutable on-chain record. Fully queryable, fully verifiable.

Registered

Packages

Submitted

Agent Scores

Verified

Authors

On IPFS

Reports

View on BaseScanSource Code