anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Your installer file on your website is distributing malware #4693

New Issue
Open
opened 2026-02-16 17:45:04 -05:00 by yindo · 22 comments
yindo commented 2026-02-16 17:45:04 -05:00
Owner
Copy Link
Copy Source

Originally created by @melbazpeach-source on GitHub (Jan 10, 2026).

Originally assigned to: @rekram1-node on GitHub.

Description

The download link button then windows install - the exe installer has been infected with malware.

Plugins

No response

OpenCode version

No response

Steps to reproduce

No response

Screenshot and/or share link

No response

Operating System

No response

Terminal

No response

Originally created by @melbazpeach-source on GitHub (Jan 10, 2026). Originally assigned to: @rekram1-node on GitHub. ### Description The download link button then windows install - the exe installer has been infected with malware. ### Plugins _No response_ ### OpenCode version _No response_ ### Steps to reproduce _No response_ ### Screenshot and/or share link _No response_ ### Operating System _No response_ ### Terminal _No response_
yindo added the windowsbug labels 2026-02-16 17:45:04 -05:00
yindo commented 2026-02-16 17:45:05 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Jan 10, 2026):

This issue might be a duplicate of existing issues. Please check:

  • #3406: v0.15.16 was infected by a virus and removed by Windows Security
  • #7655: Running opencode is flagged as trojan on windows - Installed through Node Package Manager
  • #1103: opencode-windows-x64.zip file contains virus
  • #3415: Windows Defender falsely flags new releases as trojans

These issues describe similar Windows Defender/Security detections of malware (primarily Trojan:Script/Wacatac variants) related to OpenCode releases. It appears this is a known recurring issue that the team is actively working to address with code signing and other measures.

Feel free to ignore if this describes a different specific case.

@github-actions[bot] commented on GitHub (Jan 10, 2026): This issue might be a duplicate of existing issues. Please check: - #3406: v0.15.16 was infected by a virus and removed by Windows Security - #7655: Running opencode is flagged as trojan on windows - Installed through Node Package Manager - #1103: opencode-windows-x64.zip file contains virus - #3415: Windows Defender falsely flags new releases as trojans These issues describe similar Windows Defender/Security detections of malware (primarily Trojan:Script/Wacatac variants) related to OpenCode releases. It appears this is a known recurring issue that the team is actively working to address with code signing and other measures. Feel free to ignore if this describes a different specific case.
yindo commented 2026-02-16 17:45:05 -05:00
Author
Owner
Copy Link
Copy Source

@melbazpeach-source commented on GitHub (Jan 10, 2026):

Maybe - but it’s NOT a signing issue - it’s self replicating and definitely a virus. Claude code scanned its files in the temp folder

@melbazpeach-source commented on GitHub (Jan 10, 2026): Maybe - but it’s NOT a signing issue - it’s self replicating and definitely a virus. Claude code scanned its files in the temp folder
yindo commented 2026-02-16 17:45:05 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Jan 10, 2026):

I think this is a false positive, what are you referring to that was causing issues in temp folder?

@rekram1-node commented on GitHub (Jan 10, 2026): I think this is a false positive, what are you referring to that was causing issues in temp folder?
yindo commented 2026-02-16 17:45:05 -05:00
Author
Owner
Copy Link
Copy Source

@melbazpeach-source commented on GitHub (Jan 10, 2026):

No it is not a false positive.
I’ve double checked and it is absolutely malware.
And these guys KNEW.
It’s been flagged before and nothing was fixed.
Now I’ve had to completely wipe my device and lost days of work.

@melbazpeach-source commented on GitHub (Jan 10, 2026): No it is not a false positive. I’ve double checked and it is absolutely malware. And these guys KNEW. It’s been flagged before and nothing was fixed. Now I’ve had to completely wipe my device and lost days of work.
yindo commented 2026-02-16 17:45:05 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Jan 11, 2026):

? please share more?

@rekram1-node commented on GitHub (Jan 11, 2026): ? please share more?
yindo commented 2026-02-16 17:45:05 -05:00
Author
Owner
Copy Link
Copy Source

@melbazpeach-source commented on GitHub (Jan 11, 2026):

CRITICAL: This is MALWARE
File: C:\users\melba\AppData\Local\Temp.7cdd8f5e2b77f7b9-00000000.node
Why it’s malware:
1. Naming pattern matches known malware - .GUID-00000000.node is identical to Trojan pattern
2. Created during infection - 1:53 PM today (same timeframe as malware detection)
3. No digital signature - NotSigned
4. Large size - 3.6 MB, unusual for a temp Node.js addon
5. Hash identified - specific malware signature

@melbazpeach-source commented on GitHub (Jan 11, 2026): CRITICAL: This is MALWARE File: C:\users\melba\AppData\Local\Temp.7cdd8f5e2b77f7b9-00000000.node Why it’s malware: 1. Naming pattern matches known malware - .GUID-00000000.node is identical to Trojan pattern 2. Created during infection - 1:53 PM today (same timeframe as malware detection) 3. No digital signature - NotSigned 4. Large size - 3.6 MB, unusual for a temp Node.js addon 5. Hash identified - specific malware signature
yindo commented 2026-02-16 17:45:05 -05:00
Author
Owner
Copy Link
Copy Source

@Mirrowel commented on GitHub (Jan 11, 2026):

This is a common windows defender L. This can trigger for archives with no binaries whatsoever.

WIndows defender is nothing but trouble - disable it.

Naturally, claude is clearly incorrect.
You asked it and from your question an LLM will try to answer positively using whatever it can find. They are not trained to answer no and to disprove.

@Mirrowel commented on GitHub (Jan 11, 2026): This is a common windows defender L. This can trigger for archives with no binaries whatsoever. WIndows defender is nothing but trouble - disable it. Naturally, claude is clearly incorrect. You asked it and from your question an LLM will try to answer positively using whatever it can find. They are not trained to answer no and to disprove.
yindo commented 2026-02-16 17:45:05 -05:00
Author
Owner
Copy Link
Copy Source

@Xavier-Burger commented on GitHub (Jan 11, 2026):

CRITICAL: This is MALWARE
File: C:\users\melba\AppData\Local\Temp.7cdd8f5e2b77f7b9-00000000.node
Why it’s malware:
1. Naming pattern matches known malware - .GUID-00000000.node is identical to Trojan pattern
2. Created during infection - 1:53 PM today (same timeframe as malware detection)
3. No digital signature - NotSigned
4. Large size - 3.6 MB, unusual for a temp Node.js addon
5. Hash identified - specific malware signature

Instead of relying on llm hallucinations, Google the old fasion way. There's a reason the detection is inconsistent on different open code versions, the temp dll and node files are being heuristically detected as Trojans. Look into the contributors behind opencode, these people aren't malicious or idiots.

@Xavier-Burger commented on GitHub (Jan 11, 2026): > CRITICAL: This is MALWARE > File: C:\users\melba\AppData\Local\Temp.7cdd8f5e2b77f7b9-00000000.node > Why it’s malware: > 1. Naming pattern matches known malware - .GUID-00000000.node is identical to Trojan pattern > 2. Created during infection - 1:53 PM today (same timeframe as malware detection) > 3. No digital signature - NotSigned > 4. Large size - 3.6 MB, unusual for a temp Node.js addon > 5. Hash identified - specific malware signature Instead of relying on llm hallucinations, Google the old fasion way. There's a reason the detection is inconsistent on different open code versions, the temp dll and node files are being heuristically detected as Trojans. Look into the contributors behind opencode, these people aren't malicious or idiots.
yindo commented 2026-02-16 17:45:05 -05:00
Author
Owner
Copy Link
Copy Source

@Makishima commented on GitHub (Jan 11, 2026):

@melbazpeach-source Just to be fair, could you please upload the file to https://www.virustotal.com/gui/home/upload?

@Makishima commented on GitHub (Jan 11, 2026): @melbazpeach-source Just to be fair, could you please upload the file to https://www.virustotal.com/gui/home/upload?
yindo commented 2026-02-16 17:45:05 -05:00
Author
Owner
Copy Link
Copy Source

@melbazpeach-source commented on GitHub (Jan 11, 2026):

I have completely wiped my 2week old computer now.
So as soon as your installer hit my system, it:
Tried to install 10 copies of itself.
It hammered my security.
Security stopped 9.
1 version got through.
In the 10 seconds it took for me to take my system offline, it had already created 5 replicas of uts payload in my temp drive.
It had altered group policy
And it had changed the date on all the files it touched to tomorrow’s date.

So honestly?
I don’t know if that’s what your code is supposed to do but common sense says it’s not.
If it is, I apologise.

The fact you are all fobbing it off as false positive, and letting peoples machines get fkd over, is not doing much for the UX nor trustworthiness of your products tbh.

@melbazpeach-source commented on GitHub (Jan 11, 2026): I have completely wiped my 2week old computer now. So as soon as your installer hit my system, it: Tried to install 10 copies of itself. It hammered my security. Security stopped 9. 1 version got through. In the 10 seconds it took for me to take my system offline, it had already created 5 replicas of uts payload in my temp drive. It had altered group policy And it had changed the date on all the files it touched to tomorrow’s date. So honestly? I don’t know if that’s what your code is supposed to do but common sense says it’s not. If it is, I apologise. The fact you are all fobbing it off as false positive, and letting peoples machines get fkd over, is not doing much for the UX nor trustworthiness of your products tbh.
yindo commented 2026-02-16 17:45:05 -05:00
Author
Owner
Copy Link
Copy Source

@Mirrowel commented on GitHub (Jan 11, 2026):

Upload to virustotal. What you are describing has nothing to do with what opencode does.
By install you mean this? curl -fsSL https://opencode.ai/install | bash
Windows installer:
https://www.virustotal.com/gui/file/3fcb5f22adbfa3ef280d8aaae529148e56853e62b3bfdad16b321dc651475561

@Mirrowel commented on GitHub (Jan 11, 2026): Upload to virustotal. What you are describing has nothing to do with what opencode does. By install you mean this? `curl -fsSL https://opencode.ai/install | bash` Windows installer: https://www.virustotal.com/gui/file/3fcb5f22adbfa3ef280d8aaae529148e56853e62b3bfdad16b321dc651475561
yindo commented 2026-02-16 17:45:05 -05:00
Author
Owner
Copy Link
Copy Source

@Makishima commented on GitHub (Jan 11, 2026):

It seems that the installer archive is clean: https://www.virustotal.com/gui/file/8AB962BEF658B7E003DD0B982EE912F1EFD9FAADB988AA28582E9E0D2976D76C/detection

@Makishima commented on GitHub (Jan 11, 2026): It seems that the installer archive is clean: https://www.virustotal.com/gui/file/8AB962BEF658B7E003DD0B982EE912F1EFD9FAADB988AA28582E9E0D2976D76C/detection
yindo commented 2026-02-16 17:45:05 -05:00
Author
Owner
Copy Link
Copy Source

@4cecoder commented on GitHub (Jan 13, 2026):

Image

opentui.dll depenency is tripping up the windows 666 beast

when cloning the source code windows quickly quarantines the node_modules/opentui/opentui.dll

Image
@4cecoder commented on GitHub (Jan 13, 2026): <img width="587" height="451" alt="Image" src="https://github.com/user-attachments/assets/ff1f24e4-c808-46c4-9812-43d3358c31af" /> opentui.dll depenency is tripping up the windows 666 beast when cloning the source code windows quickly quarantines the `node_modules/opentui/opentui.dll` <img width="1116" height="304" alt="Image" src="https://github.com/user-attachments/assets/1f363d79-e267-4c86-b24b-8f99d23e891e" />
yindo commented 2026-02-16 17:45:05 -05:00
Author
Owner
Copy Link
Copy Source

@melbazpeach-source commented on GitHub (Jan 13, 2026):

@4cecoder You got lucky. This is what I got :-(

See [attached]

Free Automated Malware Analysis Service - powered by Falcon Sandbox - Viewing on.pdf

@melbazpeach-source commented on GitHub (Jan 13, 2026): @4cecoder You got lucky. This is what I got :-( See [attached] [Free Automated Malware Analysis Service - powered by Falcon Sandbox - Viewing on.pdf](https://github.com/user-attachments/files/24600837/Free.Automated.Malware.Analysis.Service.-.powered.by.Falcon.Sandbox.-.Viewing.on.pdf)
yindo commented 2026-02-16 17:45:05 -05:00
Author
Owner
Copy Link
Copy Source

@Vagenda commented on GitHub (Jan 14, 2026):

I'm old enough to remember when people cared about infections on their PC. Hell, I remember when people valued their privacy and rights as well. I read the report. It's a big enough red flag for me. Do better.

@Vagenda commented on GitHub (Jan 14, 2026): I'm old enough to remember when people cared about infections on their PC. Hell, I remember when people valued their privacy and rights as well. I read the report. It's a big enough red flag for me. Do better.
yindo commented 2026-02-16 17:45:05 -05:00
Author
Owner
Copy Link
Copy Source

@thdxr commented on GitHub (Jan 14, 2026):

i just went through everything that was posted here

nothing stands out to me - opencode has a binary dep called opentui which gets extracted on first run to a .dll and then called into with FFI

seems like some scans look at this and feel like it's similar behavior to malware

if someone can point to something more specific we're happy to take a look - i've checked our CI process and nothing has changed

same binaries produced as always

additionally everyone here is trying to help your issue - being insulting isn't particularly helpful

@thdxr commented on GitHub (Jan 14, 2026): i just went through everything that was posted here nothing stands out to me - opencode has a binary dep called opentui which gets extracted on first run to a .dll and then called into with FFI seems like some scans look at this and feel like it's similar behavior to malware if someone can point to something more specific we're happy to take a look - i've checked our CI process and nothing has changed same binaries produced as always additionally everyone here is trying to help your issue - being insulting isn't particularly helpful
yindo commented 2026-02-16 17:45:05 -05:00
Author
Owner
Copy Link
Copy Source

@thdxr commented on GitHub (Jan 14, 2026):

one thing that did stand out was this path

"H:\baidu\netdisk\pc-international-unite\src\node_modules\uiohook-napi"

this is what your security report is about - i don't know what this is and it's unrelated to opencode

is this your project?

@thdxr commented on GitHub (Jan 14, 2026): one thing that did stand out was this path "H:\baidu\netdisk\pc-international-unite\src\node_modules\uiohook-napi" this is what your security report is about - i don't know what this is and it's unrelated to opencode is this your project?
yindo commented 2026-02-16 17:45:06 -05:00
Author
Owner
Copy Link
Copy Source

@melbazpeach-source commented on GitHub (Jan 14, 2026):

That stood out for me too.
I’ve have no idea what “H:\baidu\netdisk\pc-international-unite\src\node_modules\uiohook-napi" is.
It’s not my machine or projects.

Look it’s done.
No amount of complaint is going to give me back my machine.

I’ve looked into anecdotal observations online, and I’d say either your link was (or is still) targeted for drive by malware.
It’s cos your repo is popular and also why it’s random.
Or maybe targeted in the npm malware attack.

Just my 10 cents worth that it might be a good idea to increase your defenses.
I’m no one. So my opinion doesn’t matter.
But if it happens to someone who does matter, your software suffers by association.

@melbazpeach-source commented on GitHub (Jan 14, 2026): That stood out for me too. I’ve have no idea what “H:\baidu\netdisk\pc-international-unite\src\node_modules\uiohook-napi" is. It’s not my machine or projects. Look it’s done. No amount of complaint is going to give me back my machine. I’ve looked into anecdotal observations online, and I’d say either your link was (or is still) targeted for drive by malware. It’s cos your repo is popular and also why it’s random. Or maybe targeted in the npm malware attack. Just my 10 cents worth that it might be a good idea to increase your defenses. I’m no one. So my opinion doesn’t matter. But if it happens to someone who does matter, your software suffers by association.
yindo commented 2026-02-16 17:45:06 -05:00
Author
Owner
Copy Link
Copy Source

@melbazpeach-source commented on GitHub (Jan 16, 2026):

I've done further analysis and that path:

That path H:\baidu\netdisk\pc-international-unite\src\node_modules\uiohook-napi is literally the file path on the malware author’s development machine where they built/compiled the infected OpenCode package.

When developers compile code, sometimes the build process embeds the full file paths from their development environment into the binary. The malware author forgot to strip this metadata out before releasing it.

So this tells us:
About the malware author:
∙ Uses Baidu Netdisk (Chinese cloud storage) on their H: drive
∙ Developing in the “pc-international-unite” project folder
∙ Using Node.js with uiohook-napi (keyboard/mouse hooking library)
∙ Either Chinese-speaking or deliberately using Chinese infrastructure
What this means:
∙ This is NOT Hybrid Analysis’s path - it’s evidence baked into the malware itself
∙ It’s an OPSEC failure by the attacker (they leaked their dev environment)
∙ The uiohook-napi library explains autonomous mouse movement

  • the attacker’s own development path accidentally embedded in the code.
@melbazpeach-source commented on GitHub (Jan 16, 2026): I've done further analysis and that path: That path H:\baidu\netdisk\pc-international-unite\src\node_modules\uiohook-napi is literally the file path on the malware author’s development machine where they built/compiled the infected OpenCode package. When developers compile code, sometimes the build process embeds the full file paths from their development environment into the binary. The malware author forgot to strip this metadata out before releasing it. So this tells us: About the malware author: ∙ Uses Baidu Netdisk (Chinese cloud storage) on their H: drive ∙ Developing in the “pc-international-unite” project folder ∙ Using Node.js with uiohook-napi (keyboard/mouse hooking library) ∙ Either Chinese-speaking or deliberately using Chinese infrastructure What this means: ∙ This is NOT Hybrid Analysis’s path - it’s evidence baked into the malware itself ∙ It’s an OPSEC failure by the attacker (they leaked their dev environment) ∙ The uiohook-napi library explains autonomous mouse movement - the attacker’s own development path accidentally embedded in the code.
yindo commented 2026-02-16 17:45:06 -05:00
Author
Owner
Copy Link
Copy Source

@1076585426 commented on GitHub (Jan 20, 2026):

我进行了进一步分析，发现这条路径是：

路径 H:\baidu\netdisk\pc-international-unite\src\node_modules\uiohook-napi 实际上是恶意软件作者在其开发机器上构建/编译受感染 OpenCode 包的文件路径。

开发者编译代码时，有时构建过程会将开发环境中的完整文件路径嵌入到二进制文件中。恶意软件作者在发布前忘记移除这些元数据。

因此，这告诉我们： 关于恶意软件作者： ∙ 使用百度网盘（中国云存储）托管在其 H 盘 ∙ 在“pc-international-unite”项目文件夹中进行开发 ∙ 使用 Node.js 和 uiohook-napi（键盘/鼠标钩子库） ∙ 要么是中文使用者，要么故意使用中国基础设施。 这意味着： ∙ 这并非混合分析的结论——证据就隐藏在恶意软件本身中 ∙ 这是攻击者的安全操作失误（他们泄露了开发环境） ∙ uiohook-napi 库可以解释鼠标的自主移动

  • 攻击者自身的开发路径意外地嵌入到了代码中。

"Have you installed the 'Oh My OpenCode' extension, and did you find the installation tutorial on 'https://ohmyopencode.com/'?"

@1076585426 commented on GitHub (Jan 20, 2026): > 我进行了进一步分析，发现这条路径是： > > 路径 H:\baidu\netdisk\pc-international-unite\src\node_modules\uiohook-napi 实际上是恶意软件作者在其开发机器上构建/编译受感染 OpenCode 包的文件路径。 > > 开发者编译代码时，有时构建过程会将开发环境中的完整文件路径嵌入到二进制文件中。恶意软件作者在发布前忘记移除这些元数据。 > > 因此，这告诉我们： 关于恶意软件作者： ∙ 使用百度网盘（中国云存储）托管在其 H 盘 ∙ 在“pc-international-unite”项目文件夹中进行开发 ∙ 使用 Node.js 和 uiohook-napi（键盘/鼠标钩子库） ∙ 要么是中文使用者，要么故意使用中国基础设施。 这意味着： ∙ 这并非混合分析的结论——证据就隐藏在恶意软件本身中 ∙ 这是攻击者的安全操作失误（他们泄露了开发环境） ∙ uiohook-napi 库可以解释鼠标的自主移动 > > * 攻击者自身的开发路径意外地嵌入到了代码中。 "Have you installed the 'Oh My OpenCode' extension, and did you find the installation tutorial on '[https://ohmyopencode.com/](https://www.google.com/url?sa=E&q=https%3A%2F%2Fohmyopencode.com%2F)'?"
yindo commented 2026-02-16 17:45:06 -05:00
Author
Owner
Copy Link
Copy Source

@Hyp3rSon1X commented on GitHub (Jan 25, 2026):

I think there is nothing much that can be done at this point:

  • the op already cleared their PC so no binaries to cross check exist
  • accusations help no one

There was a case in the past, where malicious actors created a almost identical to the original looking homebrew page: https://www.bitdefender.com/en-au/blog/hotforsecurity/criminals-use-fake-mac-homebrew-google-ads-in-new-malicious-campaign

this site got promoted via Google ads. IF the OP really got infected, I would guess this or a similar thing to have happened to them. Meaning that not the original site got hacked, but instead the OP could have been duped into a phishing version of it.

IF a hack really occurred that is - which is also not confirmed nor can be at this point anyway.

Therefore I think this and similar Issues can just be closed. Windows Defender is allergic towards unsigned Apps anyway, so it will probably keep throwing out false positives.

Also the code is open-source, people can scan and compile the binaries themselves if they don't trust pre-built ones.

@Hyp3rSon1X commented on GitHub (Jan 25, 2026): I think there is nothing much that can be done at this point: - the op already cleared their PC so no binaries to cross check exist - accusations help no one There was a case in the past, where malicious actors created a almost identical to the original looking homebrew page: https://www.bitdefender.com/en-au/blog/hotforsecurity/criminals-use-fake-mac-homebrew-google-ads-in-new-malicious-campaign this site got promoted via Google ads. IF the OP really got infected, I would guess this or a similar thing to have happened to them. Meaning that not the original site got hacked, but instead the OP could have been duped into a phishing version of it. IF a hack really occurred that is - which is also not confirmed nor can be at this point anyway. Therefore I think this and similar Issues can just be closed. Windows Defender is allergic towards unsigned Apps anyway, so it will probably keep throwing out false positives. Also the code is open-source, people can scan and compile the binaries themselves if they don't trust pre-built ones.
yindo commented 2026-02-16 17:45:06 -05:00
Author
Owner
Copy Link
Copy Source

@dliedke commented on GitHub (Jan 25, 2026):

Only the damn antivirus Kaspersky gets incorrect false positive

https://www.virustotal.com/gui/file/1fcfbe7127704c37fb3043a791cc19e04502139842c12994393ebafc02c2b3a6

@dliedke commented on GitHub (Jan 25, 2026): Only the damn antivirus Kaspersky gets incorrect false positive https://www.virustotal.com/gui/file/1fcfbe7127704c37fb3043a791cc19e04502139842c12994393ebafc02c2b3a6
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label bug windows
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#4693
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?