Official resources
The canonical domain, npm scope, registry URL and repository, with the way to tell this project from something impersonating it.
The canonical list
| What | Where |
|---|---|
| Website and documentation | https://opsinjs.pensievelabs.org |
| Registry catalogue | https://opsinjs.pensievelabs.org/r/registry.json |
| A registry item | https://opsinjs.pensievelabs.org/r/<name>.json |
Namespace to register in components.json | @opsinjs |
| npm scope | @opsinjs, though nothing is published yet |
| Repository | github.com/prashantonomy/opsinjs |
| Machine index | https://opsinjs.pensievelabs.org/llms.txt |
None of the addresses above resolves today. The opsinjs.pensievelabs.org
subdomain is being attached to a fresh Vercel deployment and is not live yet, and
the repository is reserved but not public. Every row is therefore the address
this project intends to own, not one you can fetch. That gap matters more here
than it would anywhere else: this page exists so that an impersonation is
detectable, and a canonical address nobody can reach yet is one a reader has no
way to check against this table. Attaching the domain to the deployment and
opening the repository are release blockers for that reason, not only for
distribution. Remove this note when both resolve, and check that the issue
templates, the "Edit this page" links and the security reporting instructions all
point at them.
Why a page like this exists
A design system that is copied into other people's repositories is an unusually attractive thing to impersonate. The install step is a command that fetches JSON from a URL and writes files into a project. That is exactly what a supply-chain attack would like to be. A page naming the real addresses, linked from the footer and from the installation guide, is cheap and makes the check possible.
How to verify what you are installing
Check the registry URL
Your components.json should map @opsinjs to a URL on opsinjs.pensievelabs.org and
nowhere else. Registries are configured per project, so this is worth reading
rather than assuming, particularly in a repository you did not set up.
Read what the command will write
npx shadcn add @opsinjs/<name> --dry-run prints the files and the target paths
without writing anything. Read that list before you let it write: a presentation
component has no business landing outside the directories your
components.json names.
What the files themselves will not tell you is where they came from. Nothing in
an emitted file names its origin, so provenance rests on the URL you fetched
from, which is why the row above matters, and on your own history: commit the
files shadcn add writes, in their own commit, so a later --diff has
something to compare against.
Check the diff, not the download
Because you own the source, the review that matters is the one in your own pull request. An unexpected file path, an unexpected dependency or a network call in a presentation component is a reason to stop.
What this project will never do
- Never publish anything to npm with an install script. There is no
postinstall, and there will not be one. - Never ask for a token, a key or a credential to install a component, read the documentation or use the registry. All of it is public and unauthenticated.
- Never sell a "pro" tier that requires an account. If you find one, it is not us.
- Never ask you to paste a command you cannot read. Installation is
npx shadcn addagainst a public JSON URL, and that is the whole mechanism.
If you find an impersonation
Report it privately through the channels on Security, with the URL or the package name. Do not install it to find out what it does.
Last read through against the system on 2026-09-20. Due for review every 6 months; expiry is reported by pnpm run check:freshness.
Security
How to report a vulnerability, what counts as one in a system distributed as copied source, and where the advisories are published.
Licence and attribution
The code is MIT and the guidance prose is separately CC BY 4.0, so a team can quote this guidance inside a clinical safety case with a clear attribution path.