opm install

Install packages with on-chain security verification.

opm install

Install packages with on-chain verification, CVE checks, and signature validation.

Usage

Single package

opm install lodash

Aliases: opm i, opm add

Verification Pipeline

1. CVE check — Queries OSV for known vulnerabilities. CRITICAL CVEs block install.
2. On-chain score — Fetches aggregate risk from OPMRegistry. Score ≥ 70 blocks install.
3. Signature verification — Verifies ECDSA signature against tarball checksum.
4. ChainPatrol — Blocklist fallback for packages not in the registry.

If all gates pass, delegates to npm install.

ENS Version Resolution

When you specify an ENS name as a version (e.g. [e-mail]), OPM:

1. Resolves the ENS name to an Ethereum address
2. Verifies the author is registered on-chain
3. Fetches the safest version from the registry
4. Checks for CVEs and auto-bumps to a safe version if needed
5. Updates package.json with the resolved version

Installation is blocked if risk score ≥ 70, any CRITICAL CVE exists, or ChainPatrol returns BLOCKED.

No environment variables needed. Defaults for RPC and contract address are built-in.