anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Threat Found. Trojan:Script/Wacatac.H!ml #4651

New Issue
Open
opened 2026-02-16 17:44:55 -05:00 by yindo · 10 comments
yindo commented 2026-02-16 17:44:55 -05:00
Owner
Copy Link
Copy Source

Originally created by @defmarshal on GitHub (Jan 10, 2026).

Originally assigned to: @adamdotdevin on GitHub.

Description

Tried to open using Wezterm.
typing opencode on console and press enter
Windows Defender showing threat pop up
Opencode is not opening.

Plugins

No response

OpenCode version

1.1.8

Steps to reproduce

Tried to open using Wezterm.
typing opencode on console and press enter
Windows Defender showing threat pop up
Opencode is not opening.

Screenshot and/or share link

No response

Operating System

Windows 11

Terminal

Wezterm

Originally created by @defmarshal on GitHub (Jan 10, 2026). Originally assigned to: @adamdotdevin on GitHub. ### Description Tried to open using Wezterm. typing opencode on console and press enter Windows Defender showing threat pop up Opencode is not opening. ### Plugins _No response_ ### OpenCode version 1.1.8 ### Steps to reproduce Tried to open using Wezterm. typing opencode on console and press enter Windows Defender showing threat pop up Opencode is not opening. ### Screenshot and/or share link _No response_ ### Operating System Windows 11 ### Terminal Wezterm
yindo added the windowsbug labels 2026-02-16 17:44:55 -05:00
yindo commented 2026-02-16 17:44:55 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Jan 10, 2026):

This issue might be a duplicate of existing issues. Please check:

  • #7655: Running opencode is flagged as trojan on windows - Same Wacatac.H!ml detection on Windows 11 with Wezterm
  • #7592: [False Positive?] Windows Defender detects Trojan:Win32/Wacatac.H!ml - Same trojan detection blocking OpenCode
  • #3415: Windows Defender falsely flags new releases as trojans - Umbrella issue tracking recurring Wacatac false positives
  • #3406: v0.15.16 was infected by a virus and removed by Windows Security - Same Wacatac trojan family issue
  • #1103: opencode-windows-x64.zip file contains virus - Older report of Windows antivirus blocking OpenCode

This appears to be part of a recurring pattern of Windows Defender false positives. Feel free to ignore if your specific case differs.

@github-actions[bot] commented on GitHub (Jan 10, 2026): This issue might be a duplicate of existing issues. Please check: - #7655: Running opencode is flagged as trojan on windows - Same Wacatac.H!ml detection on Windows 11 with Wezterm - #7592: [False Positive?] Windows Defender detects Trojan:Win32/Wacatac.H!ml - Same trojan detection blocking OpenCode - #3415: Windows Defender falsely flags new releases as trojans - Umbrella issue tracking recurring Wacatac false positives - #3406: v0.15.16 was infected by a virus and removed by Windows Security - Same Wacatac trojan family issue - #1103: opencode-windows-x64.zip file contains virus - Older report of Windows antivirus blocking OpenCode This appears to be part of a recurring pattern of Windows Defender false positives. Feel free to ignore if your specific case differs.
yindo commented 2026-02-16 17:44:55 -05:00
Author
Owner
Copy Link
Copy Source

@TheDarkSkyXD commented on GitHub (Jan 10, 2026):

i am getting the same issue every time i open opencode Image

@TheDarkSkyXD commented on GitHub (Jan 10, 2026): i am getting the same issue every time i open opencode <img width="1200" height="932" alt="Image" src="https://github.com/user-attachments/assets/3f71cca7-bd2a-41e3-8764-4c3b2678da54" />
yindo commented 2026-02-16 17:44:55 -05:00
Author
Owner
Copy Link
Copy Source

@Makishima commented on GitHub (Jan 11, 2026):

It seems that the installer archive is clean: https://www.virustotal.com/gui/file/8AB962BEF658B7E003DD0B982EE912F1EFD9FAADB988AA28582E9E0D2976D76C/detection.

@Makishima commented on GitHub (Jan 11, 2026): It seems that the installer archive is clean: https://www.virustotal.com/gui/file/8AB962BEF658B7E003DD0B982EE912F1EFD9FAADB988AA28582E9E0D2976D76C/detection.
yindo commented 2026-02-16 17:44:55 -05:00
Author
Owner
Copy Link
Copy Source

@marcinsiennicki95 commented on GitHub (Jan 11, 2026):

I have the same error for latest version

@marcinsiennicki95 commented on GitHub (Jan 11, 2026): I have the same error for latest version
yindo commented 2026-02-16 17:44:55 -05:00
Author
Owner
Copy Link
Copy Source

@magicprinc commented on GitHub (Jan 11, 2026):

Same error: Windows Defender detects
Trojan:Script/Wacatac.H!ml

affected elements
file: C:\TMP.3aebb6a10f17efcd-00000001.dll

and blocks opencode 😱

More about Trojan
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Trojan%3AScript%2FWacatac.H!ml&threatid=2147814524

@magicprinc commented on GitHub (Jan 11, 2026): Same error: Windows Defender detects Trojan:Script/Wacatac.H!ml affected elements file: C:\TMP\.3aebb6a10f17efcd-00000001.dll and blocks opencode 😱 More about Trojan https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Trojan%3AScript%2FWacatac.H!ml&threatid=2147814524
yindo commented 2026-02-16 17:44:55 -05:00
Author
Owner
Copy Link
Copy Source

@okazakov commented on GitHub (Jan 11, 2026):

affected elements
file:
C:\TMP.3aebb6a10f17efcd-00000001.dll

The dll's name is different every time which makes it impossible to add as exclusion in Windows Defender/Security. So yeah, "just ignore it" LOL...

@okazakov commented on GitHub (Jan 11, 2026): >>> affected elements file: >>> C:\TMP.3aebb6a10f17efcd-00000001.dll The dll's name is different every time which makes it impossible to add as exclusion in Windows Defender/Security. So yeah, "just ignore it" LOL...
yindo commented 2026-02-16 17:44:55 -05:00
Author
Owner
Copy Link
Copy Source

@okazakov commented on GitHub (Jan 11, 2026):

The only way I was able to continue using OpenCode was to uninstall it, then install the previous version 1.1.7
But before you launch it, set "autoupdate" : "notify" in ~/.config/opencode/opencode.jsonc
If you don't, OpenCode will auto upgrade to the latest on launch and get blocked again.

@okazakov commented on GitHub (Jan 11, 2026): The only way I was able to continue using OpenCode was to uninstall it, then install the previous version 1.1.7 But before you launch it, set "autoupdate" : "notify" in ~/.config/opencode/opencode.jsonc If you don't, OpenCode will auto upgrade to the latest on launch and get blocked again.
yindo commented 2026-02-16 17:44:55 -05:00
Author
Owner
Copy Link
Copy Source

@okazakov commented on GitHub (Jan 11, 2026):

Same error: Windows Defender detects Trojan:Script/Wacatac.H!ml

affected elements file: C:\TMP.3aebb6a10f17efcd-00000001.dll

and blocks opencode 😱

More about Trojan https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Trojan%3AScript%2FWacatac.H!ml&threatid=2147814524

OK, so VirusTotal identifies THREE different threats in this DLL (the DLL name is different every time you try and run the latest openCode, which is suspicious on its own).
I know false positives for OpenCode is a regular occurrencee, but on this occasions, think this deserves a serious look from the developers.
https://www.virustotal.com/gui/file/c7155d1809bf7036fdff80f1d362183c8130ae4714951d78e0f0615a5bc83bc9

Image
@okazakov commented on GitHub (Jan 11, 2026): > Same error: Windows Defender detects Trojan:Script/Wacatac.H!ml > > affected elements file: C:\TMP.3aebb6a10f17efcd-00000001.dll > > and blocks opencode 😱 > > More about Trojan https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Trojan%3AScript%2FWacatac.H!ml&threatid=2147814524 OK, so VirusTotal identifies THREE different threats in this DLL (the DLL name is different every time you try and run the latest openCode, which is suspicious on its own). I know false positives for OpenCode is a regular occurrencee, but on this occasions, think this deserves a serious look from the developers. https://www.virustotal.com/gui/file/c7155d1809bf7036fdff80f1d362183c8130ae4714951d78e0f0615a5bc83bc9 <img width="1545" height="774" alt="Image" src="https://github.com/user-attachments/assets/7d1b4cb0-7df7-44e8-8210-987c04e9932e" />
yindo commented 2026-02-16 17:44:55 -05:00
Author
Owner
Copy Link
Copy Source

@okazakov commented on GitHub (Jan 11, 2026):

It seems that the installer archive is clean: https://www.virustotal.com/gui/file/8AB962BEF658B7E003DD0B982EE912F1EFD9FAADB988AA28582E9E0D2976D76C/detection.

You've checked the installer, but it's not the installer that triggers the threat detection. It's this DLL and only when you launch OpenCode:
https://www.virustotal.com/gui/file/c7155d1809bf7036fdff80f1d362183c8130ae4714951d78e0f0615a5bc83bc9

@okazakov commented on GitHub (Jan 11, 2026): > It seems that the installer archive is clean: https://www.virustotal.com/gui/file/8AB962BEF658B7E003DD0B982EE912F1EFD9FAADB988AA28582E9E0D2976D76C/detection. You've checked the installer, but it's not the installer that triggers the threat detection. It's this DLL and only when you launch OpenCode: https://www.virustotal.com/gui/file/c7155d1809bf7036fdff80f1d362183c8130ae4714951d78e0f0615a5bc83bc9
yindo commented 2026-02-16 17:44:55 -05:00
Author
Owner
Copy Link
Copy Source

@skfd commented on GitHub (Feb 14, 2026):

The only way I was able to continue using OpenCode was to uninstall it, then install the previous version 1.1.7 But before you launch it, set "autoupdate" : "notify" in ~/.config/opencode/opencode.jsonc If you don't, OpenCode will auto upgrade to the latest on launch and get blocked again.

that worked

npm remove -g opencode
echo "{'autoupdate': 'notify'}" > ~\.config\opencode.jsonc
npm install -g opencode-ai@1.1.7
opencode
@skfd commented on GitHub (Feb 14, 2026): > The only way I was able to continue using OpenCode was to uninstall it, then install the previous version 1.1.7 But before you launch it, set "autoupdate" : "notify" in ~/.config/opencode/opencode.jsonc If you don't, OpenCode will auto upgrade to the latest on launch and get blocked again. that worked ``` npm remove -g opencode echo "{'autoupdate': 'notify'}" > ~\.config\opencode.jsonc npm install -g opencode-ai@1.1.7 opencode ```
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label bug windows
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#4651
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?