> ## Documentation Index
> Fetch the complete documentation index at: https://opm.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Introduction

> OPM is a drop-in npm replacement that adds cryptographic signing, multi-agent AI security scanning, on-chain risk scoring, and ZK-verified agent registration to the JavaScript supply chain.

# Introduction

**OPM (On-chain Package Manager)** is a drop-in npm replacement that scans every package with 3 AI agents, scores risk on-chain, and blocks malicious installs — all from the terminal.

## The Problem

npm has no built-in defense against supply chain attacks. Developers install typosquatted packages, ship unpatched CVEs, and run malicious postinstall scripts — often without knowing until it's too late. Traditional tools catch known vulnerabilities *after* disclosure, but miss novel threats, obfuscated payloads, and social engineering attacks.

## How OPM Fixes It

| Layer | What it does |
| - | - |
| **Cryptographic signing** | SHA-256 checksum + ECDSA signature from your Ethereum wallet, verified at install time |
| **Multi-agent AI scanning** | 3 LLMs (Claude, Gemini, DeepSeek) analyze packages in parallel — catches what static analysis misses |
| **On-chain registry** | Risk scores, author profiles, and audit reports stored on Base Sepolia — immutable and queryable |
| **ZK agent verification** | Anyone can register a security agent, but must prove 100% benchmark accuracy via zero-knowledge proofs |
| **ENS identity** | Author reputation tied to ENS names — decentralized trust, not centralized accounts |

## Key Integrations

| Integration | Purpose |
| - | - |
| **Base Sepolia** | On-chain registry for scores, packages, and agents |
| **ENS** | Author identity and package metadata records |
| **Fileverse** | IPFS-backed encrypted audit report storage |
| **OSV** | Real-time CVE/GHSA data |
| **ChainPatrol** | Blocklist fallback for unregistered packages |

## Architecture

<Frame>
  <img src="https://mintcdn.com/opm/3k1GLU5dr1NNNEcT/system-design.png?fit=max&auto=format&n=3k1GLU5dr1NNNEcT&q=85&s=cf949670bada5ee0a682eabfe8a3aadb" alt="OPM System Design" width="1892" height="1412" data-path="system-design.png" />
</Frame>

OPM implements the [ERC-8004 (Trustless Agents)](https://eips.ethereum.org/EIPS/eip-8004) pattern — agents hold on-chain identities, submit risk scores, and attach Fileverse reports as validation evidence.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.