Found Trojan when I added Gemini API to opencode after installation. #4750

Closed
opened 2026-02-16 17:45:16 -05:00 by yindo · 2 comments
Owner

Originally created by @grd2006 on GitHub (Jan 11, 2026).

Originally assigned to: @rekram1-node on GitHub.

Description

This was the Trojan...
Trojan:Script/Wacatac.H!ml

These files were affected by the Trojan...
file: C:\Users<username>\AppData\Local\Temp.3aebb7a76c977ff5-00000000.dll
file: C:\Users<username>\AppData\Local\Temp.3aebb7a7ded7bfed-00000001.dll

Image

Plugins

No response

OpenCode version

No response

Steps to reproduce

No response

Screenshot and/or share link

No response

Operating System

No response

Terminal

No response

Originally created by @grd2006 on GitHub (Jan 11, 2026). Originally assigned to: @rekram1-node on GitHub. ### Description This was the Trojan... Trojan:Script/Wacatac.H!ml These files were affected by the Trojan... file: C:\Users\<username>\AppData\Local\Temp\.3aebb7a76c977ff5-00000000.dll file: C:\Users\<username>\AppData\Local\Temp\.3aebb7a7ded7bfed-00000001.dll <img width="1037" height="448" alt="Image" src="https://github.com/user-attachments/assets/bf3d0182-78b7-4bab-a7f3-16ad1f96982c" /> ### Plugins _No response_ ### OpenCode version _No response_ ### Steps to reproduce _No response_ ### Screenshot and/or share link _No response_ ### Operating System _No response_ ### Terminal _No response_
yindo added the windowsbug labels 2026-02-16 17:45:16 -05:00
yindo closed this issue 2026-02-16 17:45:16 -05:00
Author
Owner

@github-actions[bot] commented on GitHub (Jan 11, 2026):

This issue might be a duplicate of existing issues. Please check:

  • #7592: [False Positive?] Windows Defender detects Trojan:Win32/Wacatac.H!ml when running opencode
  • #7669: Threat Found. Trojan:Script/Wacatac.H!ml
  • #7655: Running opencode is flagged as trojan on windows - Installed through Node Package Manager
  • #3415: Windows Defender falsely flags new releases as trojans
  • #3406: v0.15.16 was infected by a virus and removed by Windows Security
  • #1103: opencode-windows-x64.zip file contains virus

These all report similar Trojan:Win32/Wacatac.H!ml or related malware detections on Windows. Feel free to ignore if your specific case is different.

@github-actions[bot] commented on GitHub (Jan 11, 2026): This issue might be a duplicate of existing issues. Please check: - #7592: [False Positive?] Windows Defender detects `Trojan:Win32/Wacatac.H!ml` when running opencode - #7669: Threat Found. Trojan:Script/Wacatac.H!ml - #7655: Running opencode is flagged as trojan on windows - Installed through Node Package Manager - #3415: Windows Defender falsely flags new releases as trojans - #3406: v0.15.16 was infected by a virus and removed by Windows Security - #1103: opencode-windows-x64.zip file contains virus These all report similar Trojan:Win32/Wacatac.H!ml or related malware detections on Windows. Feel free to ignore if your specific case is different.
Author
Owner

@grd2006 commented on GitHub (Jan 12, 2026):

yeah so apparently I fixed the issue myself I installed a previous version first (the latest currently is v1.1.13 so I installed v1.1.12) and I thought I'll use this version but opencode auto updated it to the latest version and it turns out there are no trojans found in opencode anymore so yeah it's working now

@grd2006 commented on GitHub (Jan 12, 2026): yeah so apparently I fixed the issue myself I installed a previous version first (the latest currently is v1.1.13 so I installed v1.1.12) and I thought I'll use this version but opencode auto updated it to the latest version and it turns out there are no trojans found in opencode anymore so yeah it's working now
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#4750