---
title: "Official resources"
description: "The canonical domain, npm scope, registry URL and repository, with the way to tell this project from something impersonating it."
url: "https://opsinjs.pensievelabs.org/project/official-resources"
source: "https://opsinjs.pensievelabs.org/project/official-resources.md"
section: "Project"
kind: "project"
reviewed: "2026-09-20"
reviewer: "engineering"
aliases: ["canonical domain", "npm scope", "impersonation", "is this the real opsinjs"]
---

> Elements written as `<PascalCase … />` below are opsinjs documentation
> components. Their attributes are the content: the values they render are
> generated from `tokens/*.json` and `registry/catalogue.ts` and are
> published separately at https://opsinjs.pensievelabs.org/r/index.json and under the Reference
> section.
> Nothing is missing from this page. The data simply does not live in
> the prose.

<PageTemplate kind="project" />

## The canonical list [#the-canonical-list]

| What                                       | Where                                              |
| ------------------------------------------ | -------------------------------------------------- |
| Website and documentation                  | `https://opsinjs.pensievelabs.org`                 |
| Registry catalogue                         | `https://opsinjs.pensievelabs.org/r/registry.json` |
| A registry item                            | `https://opsinjs.pensievelabs.org/r/<name>.json`   |
| Namespace to register in `components.json` | `@opsinjs`                                         |
| npm scope                                  | `@opsinjs`, though **nothing is published yet**    |
| Repository                                 | `github.com/prashantonomy/opsinjs`                 |
| Machine index                              | `https://opsinjs.pensievelabs.org/llms.txt`        |

<Todo>
  None of the addresses above resolves today. The `opsinjs.pensievelabs.org`
  subdomain is being attached to a fresh Vercel deployment and is not live yet, and
  the repository is reserved but not public. Every row is therefore the address
  this project intends to own, not one you can fetch. That gap matters more here
  than it would anywhere else: this page exists so that an impersonation is
  detectable, and a canonical address nobody can reach yet is one a reader has no
  way to check against this table. Attaching the domain to the deployment and
  opening the repository are release blockers for that reason, not only for
  distribution. Remove this note when both resolve, and check that the issue
  templates, the "Edit this page" links and the security reporting instructions all
  point at them.
</Todo>

## Why a page like this exists [#why-a-page-like-this-exists]

A design system that is copied into other people's repositories is an unusually
attractive thing to impersonate. The install step is a command that fetches JSON
from a URL and writes files into a project. That is exactly what a supply-chain
attack would like to be. A page naming the real addresses, linked from the
footer and from the installation guide, is cheap and makes the check possible.

## How to verify what you are installing [#how-to-verify-what-you-are-installing]

<Steps>
  ### Check the registry URL [#check-the-registry-url]

  Your `components.json` should map `@opsinjs` to a URL on `opsinjs.pensievelabs.org` and
  nowhere else. Registries are configured per project, so this is worth reading
  rather than assuming, particularly in a repository you did not set up.

  ### Read what the command will write [#read-what-the-command-will-write]

  `npx shadcn add @opsinjs/<name> --dry-run` prints the files and the target paths
  without writing anything. Read that list before you let it write: a presentation
  component has no business landing outside the directories your
  `components.json` names.

  What the files themselves will not tell you is where they came from. Nothing in
  an emitted file names its origin, so provenance rests on the URL you fetched
  from, which is why the row above matters, and on your own history: commit the
  files `shadcn add` writes, in their own commit, so a later `--diff` has
  something to compare against.

  ### Check the diff, not the download [#check-the-diff-not-the-download]

  Because you own the source, the review that matters is the one in your own pull
  request. An unexpected file path, an unexpected dependency or a network call in a
  presentation component is a reason to stop.
</Steps>

## What this project will never do [#what-this-project-will-never-do]

* **Never publish anything to npm with an install script.** There is no
  `postinstall`, and there will not be one.
* **Never ask for a token, a key or a credential** to install a component, read
  the documentation or use the registry. All of it is public and unauthenticated.
* **Never sell a "pro" tier that requires an account.** If you find one, it is not
  us.
* **Never ask you to paste a command you cannot read.** Installation is
  `npx shadcn add` against a public JSON URL, and that is the whole mechanism.

## If you find an impersonation [#if-you-find-an-impersonation]

Report it privately through the channels on [Security](./security.mdx), with the
URL or the package name. Do not install it to find out what it does.

<LastUpdated />

<Reviewed />