anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 10:15:31 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Windows Defender reports Trojan:Win32/Wacatac.H!ml when launching the latest version of OpenCode #4807

New Issue
Open
opened 2026-02-16 17:45:31 -05:00 by yindo · 19 comments
yindo commented 2026-02-16 17:45:31 -05:00
Owner
Copy Link
Copy Source

Originally created by @Suaig on GitHub (Jan 12, 2026).

Originally assigned to: @adamdotdevin on GitHub.

Hi team,

I encountered a security issue when launching the latest version of OpenCode on Windows.
Windows Defender immediately identifies the startup process as malicious activity and reports the threat Trojan:Win32/Wacatac.H!ml.

Environment:

  • OS: Windows 10 / Windows 11 (Windows 11)
  • OpenCode version: 1.1.8+ all of them

Detection details from Windows Defender:

  • Threat: Trojan:Win32/Wacatac.H!ml
  • Status: Active
  • Description: This program is dangerous and executes commands from an attacker.
  • Affected files are temporary DLLs generated under:
    C:\Users\{UserName}\AppData\Local\Temp\{random}.dll

(Example from my system:)

C:\Users\xxx\AppData\Local\Temp\3aebf761ddfd7fd5-00000001.dll
C:\Users\xxx\AppData\Local\Temp\3aebf761ded7a7ed-00000000.dll
C:\Users\xxx\AppData\Local\Temp\3aebf67cd73efd-00000001.dll
C:\Users\xxx\AppData\Local\Temp\3aebf67d8c57b6f5-00000000.dll

Steps to Reproduce:

  1. Install the latest version of OpenCode
  2. Launch the application
  3. Windows Defender immediately pops up a threat alert

Expected behavior:
Launching OpenCode should not trigger antivirus warnings.

Actual behavior:
Windows Defender flags the startup as malware and quarantines or blocks generated temp DLLs, preventing the program from running normally.

Additional notes:

  • This may be a false positive, but it severely affects normal usage.
  • Please help confirm whether this behavior is expected, and whether code signing or packaging needs adjustment.

Thanks! Let me know if you need more logs or diagnostic information.

Plugins

No response

OpenCode version

1.1.8+ all of them

Steps to reproduce

No response

Screenshot and/or share link

No response

Operating System

No response

Terminal

No response

Originally created by @Suaig on GitHub (Jan 12, 2026). Originally assigned to: @adamdotdevin on GitHub. Hi team, I encountered a security issue when launching the latest version of **OpenCode** on Windows. Windows Defender immediately identifies the startup process as malicious activity and reports the threat **Trojan:Win32/Wacatac.H!ml**. **Environment:** - OS: Windows 10 / Windows 11 (Windows 11) - OpenCode version: 1.1.8+ all of them **Detection details from Windows Defender:** - Threat: `Trojan:Win32/Wacatac.H!ml` - Status: Active - Description: *This program is dangerous and executes commands from an attacker.* - Affected files are temporary DLLs generated under: `C:\Users\{UserName}\AppData\Local\Temp\{random}.dll` (Example from my system:) ``` C:\Users\xxx\AppData\Local\Temp\3aebf761ddfd7fd5-00000001.dll C:\Users\xxx\AppData\Local\Temp\3aebf761ded7a7ed-00000000.dll C:\Users\xxx\AppData\Local\Temp\3aebf67cd73efd-00000001.dll C:\Users\xxx\AppData\Local\Temp\3aebf67d8c57b6f5-00000000.dll ``` **Steps to Reproduce:** 1. Install the latest version of OpenCode 2. Launch the application 3. Windows Defender immediately pops up a threat alert **Expected behavior:** Launching OpenCode should not trigger antivirus warnings. **Actual behavior:** Windows Defender flags the startup as malware and quarantines or blocks generated temp DLLs, preventing the program from running normally. **Additional notes:** - This may be a false positive, but it severely affects normal usage. - Please help confirm whether this behavior is expected, and whether code signing or packaging needs adjustment. Thanks! Let me know if you need more logs or diagnostic information. ### Plugins _No response_ ### OpenCode version 1.1.8+ all of them ### Steps to reproduce _No response_ ### Screenshot and/or share link _No response_ ### Operating System _No response_ ### Terminal _No response_
yindo added the windowsbugweb labels 2026-02-16 17:45:31 -05:00
yindo commented 2026-02-16 17:45:31 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Jan 12, 2026):

This issue might be a duplicate of existing issues. Please check:

  • #7821: Windows Defender says Found Trojan
  • #7669: Threat Found. Trojan:Script/Wacatac.H!ml
  • #7592: [False Positive?] Windows Defender detects Trojan:Win32/Wacatac.H!ml when running opencode
  • #7655: Running opencode is flagged as trojan on windows - Installed through Node Package Manager
  • #3415: Windows Defender falsely flags new releases as trojans

Feel free to ignore if none of these address your specific case.

@github-actions[bot] commented on GitHub (Jan 12, 2026): This issue might be a duplicate of existing issues. Please check: - #7821: Windows Defender says Found Trojan - #7669: Threat Found. Trojan:Script/Wacatac.H!ml - #7592: [False Positive?] Windows Defender detects `Trojan:Win32/Wacatac.H!ml` when running opencode - #7655: Running opencode is flagged as trojan on windows - Installed through Node Package Manager - #3415: Windows Defender falsely flags new releases as trojans Feel free to ignore if none of these address your specific case.
yindo commented 2026-02-16 17:45:31 -05:00
Author
Owner
Copy Link
Copy Source

@theepicsaxguy commented on GitHub (Jan 12, 2026):

Happens to me too

@theepicsaxguy commented on GitHub (Jan 12, 2026): Happens to me too
yindo commented 2026-02-16 17:45:31 -05:00
Author
Owner
Copy Link
Copy Source

@kfuglsang commented on GitHub (Jan 12, 2026):

Same here

@kfuglsang commented on GitHub (Jan 12, 2026): Same here
yindo commented 2026-02-16 17:45:31 -05:00
Author
Owner
Copy Link
Copy Source

@silverkhan commented on GitHub (Jan 12, 2026):

I have the same problem.

@silverkhan commented on GitHub (Jan 12, 2026): I have the same problem.
yindo commented 2026-02-16 17:45:32 -05:00
Author
Owner
Copy Link
Copy Source

@myt960 commented on GitHub (Jan 12, 2026):

Same here

@myt960 commented on GitHub (Jan 12, 2026): Same here
yindo commented 2026-02-16 17:45:32 -05:00
Author
Owner
Copy Link
Copy Source

@ham-zax commented on GitHub (Jan 12, 2026):

Same here

@ham-zax commented on GitHub (Jan 12, 2026): Same here
yindo commented 2026-02-16 17:45:32 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Jan 12, 2026):

I think we need code signing to prevent this

@rekram1-node commented on GitHub (Jan 12, 2026): I think we need code signing to prevent this
yindo commented 2026-02-16 17:45:32 -05:00
Author
Owner
Copy Link
Copy Source

@vincentlarkin commented on GitHub (Jan 12, 2026):

Same issue, was also blocked by Edge download security.

@vincentlarkin commented on GitHub (Jan 12, 2026): Same issue, was also blocked by Edge download security.
yindo commented 2026-02-16 17:45:32 -05:00
Author
Owner
Copy Link
Copy Source

@A-Hsiang commented on GitHub (Jan 13, 2026):

Same issue.

@A-Hsiang commented on GitHub (Jan 13, 2026): Same issue.
yindo commented 2026-02-16 17:45:32 -05:00
Author
Owner
Copy Link
Copy Source

@developerchengang commented on GitHub (Jan 13, 2026):

Same issue

@developerchengang commented on GitHub (Jan 13, 2026): Same issue
yindo commented 2026-02-16 17:45:32 -05:00
Author
Owner
Copy Link
Copy Source

@teo8860 commented on GitHub (Jan 13, 2026):

Same issue

@teo8860 commented on GitHub (Jan 13, 2026): Same issue
yindo commented 2026-02-16 17:45:32 -05:00
Author
Owner
Copy Link
Copy Source

@thdxr commented on GitHub (Jan 14, 2026):

this will probably keep happening until we get through the code signing process

opencode has a few binary deps (opentui for example) and on first start extracts them to a tmp folder

unfortunately some virus protectors are treating this is always malicious behavior

@thdxr commented on GitHub (Jan 14, 2026): this will probably keep happening until we get through the code signing process opencode has a few binary deps (opentui for example) and on first start extracts them to a tmp folder unfortunately some virus protectors are treating this is always malicious behavior
yindo commented 2026-02-16 17:45:32 -05:00
Author
Owner
Copy Link
Copy Source

@bagleytravis68 commented on GitHub (Jan 15, 2026):

This is a bad one. Can't make it stop or get past it. Causes Opencode to just hang.

@bagleytravis68 commented on GitHub (Jan 15, 2026): This is a bad one. Can't make it stop or get past it. Causes Opencode to just hang.
yindo commented 2026-02-16 17:45:32 -05:00
Author
Owner
Copy Link
Copy Source

@c4droid369 commented on GitHub (Jan 15, 2026):

Same issue for me

@c4droid369 commented on GitHub (Jan 15, 2026): Same issue for me
yindo commented 2026-02-16 17:45:32 -05:00
Author
Owner
Copy Link
Copy Source

@bbagwang commented on GitHub (Jan 16, 2026):

It happened again in 1.1.23.
1.1.20 was okay.

@bbagwang commented on GitHub (Jan 16, 2026): It happened again in 1.1.23. 1.1.20 was okay.
yindo commented 2026-02-16 17:45:32 -05:00
Author
Owner
Copy Link
Copy Source

@Nitmi commented on GitHub (Jan 17, 2026):

same here

@Nitmi commented on GitHub (Jan 17, 2026): same here
yindo commented 2026-02-16 17:45:32 -05:00
Author
Owner
Copy Link
Copy Source

@77tb commented on GitHub (Jan 17, 2026):

Me too, v1.1.25

@77tb commented on GitHub (Jan 17, 2026): Me too, v1.1.25
yindo commented 2026-02-16 17:45:32 -05:00
Author
Owner
Copy Link
Copy Source

@repfigit commented on GitHub (Jan 17, 2026):

me too. unusable

@repfigit commented on GitHub (Jan 17, 2026): me too. unusable
yindo commented 2026-02-16 17:45:33 -05:00
Author
Owner
Copy Link
Copy Source

@stefaneidelloth commented on GitHub (Jan 22, 2026):

In addition to Defender warning for the installer:

Image

there is also a Cordex warning when starting the app from the installer:

Image
@stefaneidelloth commented on GitHub (Jan 22, 2026): In addition to **Defender** warning for the installer: <img width="514" height="477" alt="Image" src="https://github.com/user-attachments/assets/00ad1ef7-72ea-485c-9b4c-e4ecc9bdfe5f" /> there is also a **Cordex** warning when starting the app from the installer: <img width="533" height="284" alt="Image" src="https://github.com/user-attachments/assets/e4b5ffc1-615c-4d87-ba66-4099f2158d9a" />
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label bug web windows
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#4807
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?