anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

v0.15.16 was infected by a virus and removed by Windows Security #2257

New Issue
Closed
opened 2026-02-16 17:34:51 -05:00 by yindo · 5 comments
yindo commented 2026-02-16 17:34:51 -05:00
Owner
Copy Link
Copy Source

Originally created by @duytrung on GitHub (Oct 24, 2025).

Description

Hello everyone,

I tried to download latest version 0.15.16 at 6:15PM 24 Oct 2025. But the file was quarantined and removed by Windows Security

It was identified as: Trojan Script Wacatac.C!ml

Thank you very much for consider the issue

OpenCode version

0.15.16

Steps to reproduce

  1. Navigate to the github release page of OpenCode.
  2. Download the latest release as 0.15.16 at the time of download was latest version
  3. Windows security deleted the file after finishing download.

Screenshot and/or share link

Image

Operating System

Windows 11 Pro

Terminal

Windows Terminal

Originally created by @duytrung on GitHub (Oct 24, 2025). ### Description Hello everyone, I tried to download latest version 0.15.16 at 6:15PM 24 Oct 2025. But the file was quarantined and removed by Windows Security It was identified as: Trojan Script Wacatac.C!ml Thank you very much for consider the issue ### OpenCode version 0.15.16 ### Steps to reproduce 1. Navigate to the github release page of OpenCode. 2. Download the latest release as 0.15.16 at the time of download was latest version 3. Windows security deleted the file after finishing download. ### Screenshot and/or share link <img width="609" height="463" alt="Image" src="https://github.com/user-attachments/assets/4689b16f-c204-4800-8529-b41a3f97056b" /> ### Operating System Windows 11 Pro ### Terminal Windows Terminal
yindo added the windowsbug labels 2026-02-16 17:34:51 -05:00
yindo closed this issue 2026-02-16 17:34:51 -05:00
yindo commented 2026-02-16 17:34:52 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Oct 24, 2025):

This issue might be a duplicate of existing issues. Please check:

  • #3388: Windows Defender detected the same type of threat (Wacapew.A!ml) with OpenCode TUI
  • #3126: Windows Defender reported false positive on OpenCode nightly build
  • #1103: Similar Windows Security virus detection with opencode-windows-x64.zip file

These are all related to Windows Defender/Security false positives with OpenCode executables. The Wacatac.C!ml detection you're experiencing appears to be a known issue with Windows Defender flagging OpenCode binaries as trojans.

Feel free to ignore if none of these address your specific case.

@github-actions[bot] commented on GitHub (Oct 24, 2025): This issue might be a duplicate of existing issues. Please check: - #3388: Windows Defender detected the same type of threat (Wacapew.A!ml) with OpenCode TUI - #3126: Windows Defender reported false positive on OpenCode nightly build - #1103: Similar Windows Security virus detection with opencode-windows-x64.zip file These are all related to Windows Defender/Security false positives with OpenCode executables. The Wacatac.C!ml detection you're experiencing appears to be a known issue with Windows Defender flagging OpenCode binaries as trojans. Feel free to ignore if none of these address your specific case.
yindo commented 2026-02-16 17:34:52 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Oct 24, 2025):

this is just the security scanner being stupid there is prolly something we can do but this happens for a short period after every release from what ive heard. This should just go away soon see #1103 this happens every release apparently

I think someone said that if we stop trying to auto update if you installed with a package manager it could help? Not sure if that is the case

@rekram1-node commented on GitHub (Oct 24, 2025): this is just the security scanner being stupid there is prolly something we can do but this happens for a short period after every release from what ive heard. This should just go away soon see #1103 this happens every release apparently I think someone said that if we stop trying to auto update if you installed with a package manager it could help? Not sure if that is the case
yindo commented 2026-02-16 17:34:52 -05:00
Author
Owner
Copy Link
Copy Source

@HydraKane commented on GitHub (Jan 10, 2026):

Description

Get Trojan Script Wacatac.H!ml with these files when launch opencode:

file: ~\AppData\Local\Temp\.3aebf6d1fcbfbee5-00000001.dll
file: ~\AppData\Local\Temp\.3aebf6cffe37e6dd-00000000.dll

allow them and works fine.

OpenCode version

v1.1.11

Operating System

Windows 11 Pro 24H2 26100.7309

Terminal

Windows Terminal

@HydraKane commented on GitHub (Jan 10, 2026): ### Description Get **Trojan Script Wacatac.H!ml** with these files when launch opencode: ``` file: ~\AppData\Local\Temp\.3aebf6d1fcbfbee5-00000001.dll file: ~\AppData\Local\Temp\.3aebf6cffe37e6dd-00000000.dll ``` allow them and works fine. ### OpenCode version v1.1.11 ### Operating System Windows 11 Pro 24H2 26100.7309 ### Terminal Windows Terminal
yindo commented 2026-02-16 17:34:52 -05:00
Author
Owner
Copy Link
Copy Source

@zhaozhongwenzzw commented on GitHub (Jan 12, 2026):

Image
@zhaozhongwenzzw commented on GitHub (Jan 12, 2026): <img width="554" height="809" alt="Image" src="https://github.com/user-attachments/assets/66a8c7e8-f604-45f6-8698-208bee2967fe" />
yindo commented 2026-02-16 17:34:52 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Jan 12, 2026):

We have a bunch of these false alarms popping up ill see what we can do to get proper signing in place

@rekram1-node commented on GitHub (Jan 12, 2026): We have a bunch of these false alarms popping up ill see what we can do to get proper signing in place
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label bug windows
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#2257
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?