The problem OPM solves

OPM secures your npm workflow by running AI security scans, verifying package integrity on-chain, and analyzing dependency graphs before any code reaches your node_modules

What it solves

The npm ecosystem runs on trust that often goes unchecked. A single npm install can pull in hundreds or thousands of transitive dependencies. Developers usually have no clear way to know whether one of those packages contains malware, a typosquatted name, or a known vulnerability.

Recent supply chain incidents show how dangerous this model is. Wallet drainers, credential stealers, and prototype pollution exploits have all been distributed through packages that looked legitimate at first glance. These attacks have already caused millions in losses and continue to target both Web2 and Web3 developers.

OPM introduces a safety layer in front of the install process. Instead of trusting every dependency blindly, packages are analyzed and verified before they are allowed into a project.

What you can use it for

• opm install
  A drop-in replacement for npm install. Every package is scanned before installation using AI security agents, vulnerability databases, and blocklists such as ChainPatrol. If a version is unsafe, OPM recommends or installs the safest available alternative.

• opm check
  Scans your entire dependency tree including transitive dependencies. Multiple AI agents analyze packages in parallel for typosquats, malicious code patterns, and known CVEs. Results are aggregated and anchored to a Merkle root so the analysis can be verified later.

• opm fix
  Automatically updates vulnerable or suspicious dependencies in package.json. If a package has a safer version or trusted alternative, OPM suggests and applies the fix.

• opm push
  Publishes your package to npm while also registering its checksum and metadata on-chain. The publish step includes a multi-agent security scan and optional ENS-linked identity so consumers can verify who published the package and what security checks it passed.

• opm audit
  Performs a deeper security audit of your project. Dependencies are checked against on-chain risk scores, ChainPatrol blocklists, and the OSV vulnerability database.

How it makes things safer

Who it's for

• Developers using npm
  opm install and opm check work with existing Node.js projects and require no blockchain knowledge.

• Package maintainers
  opm push provides verifiable package metadata, identity linking, and security attestations.

• Security teams
  Dependency graph scanning and risk propagation highlight vulnerabilities buried deep inside dependency trees.

• Web3 builders
  ENS-linked identities, on-chain package records, and verifiable dependency graphs help build more trustworthy software supply chains.

Challenges I ran into

Agent onboarding :
How do we onboard agents without verifying? Use labelled datasets without revealing the data itself

Reasoning Model API Constraints
OpenAI's reasoning models (o4-mini) reject temperature and response_format parameters that work fine with standard chat models. The scanner had to detect reasoning models at runtime and strip unsupported parameters from the request body, or every scan with a mixed model pool would fail.