anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 10:15:31 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

(Possible) Trojan/Malware warning ! (Maybe false alarm, but it's a bit strange) #528

New Issue
Closed
opened 2026-02-16 17:27:10 -05:00 by yindo · 6 comments
yindo commented 2026-02-16 17:27:10 -05:00
Owner
Copy Link
Copy Source

Originally created by @SkybuckFlying on GitHub (Jul 6, 2025).

Originally assigned to: @thdxr on GitHub.

https://www.virustotal.com/gui/file/7805f7d1f00772bf8ac211987323bde830725379c894367bfe44f4b961114e8f/behavior

Files dropped:

C:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0
C:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\Crashpad
C:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\Crashpad\attachments
C:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\Crashpad\metadata
C:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\Crashpad\reports
C:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\uninstall.cmd
C:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\updater.exe
C:\Program Files\Google2208_1117271987

Processes Created:

"C:\Users<USER>\Desktop\opencode.exe"
%SAMPLEPATH%\opencode.exe
C:\Program Files\Google3624_727247553\bin\updater.exe
C:\Windows\System32\UI0Detect.exe

AI take on it:

That’s a very valid concern — and you’re right to question it.
Based on what you’ve shared and what I found, OpenCode itself should not be installing or triggering Google Updater. However, here’s what might be happening:

🧩 Possible Explanations
1. OpenCode Uses Google APIs (e.g., Gemini)
If you configured OpenCode to use Google Gemini or other Google services, it may:
- Launch a browser window for authentication
- Use a Google SDK or library that triggers background services
Some Google SDKs (especially those bundled with Chromium-based tools) may silently install or update Google Updater as part of their telemetry or crash reporting setup.

2. Bundled Dependencies
If OpenCode or one of its dependencies (like opencode-sdk-go) uses a library that links to Chromium or Electron components, it might:
- Drop files like updater.exe or Crashpad
- Trigger Google Updater behavior
This is common in apps that use Google’s Crashpad for error reporting.

3. False Attribution
It’s possible that another app or background service (like Chrome, Drive, or Earth) was updating at the same time you ran opencode.exe, and VirusTotal attributed the behavior to the wrong process.

🔍 What You Can Do
✅ 1. Check the Binary
Use [Sigcheck](https://learn.microsoft.com/en-us/sysinternals/downloads/sigcheck) or VirusTotal to inspect opencode.exe:
- Is it signed?
- Does it contain embedded Google components?
✅ 2. Run in a Sandbox
Use [Sandboxie](https://sandboxie-plus.com/) or a VM to isolate opencode.exe and monitor its behavior.
✅ 3. Check Dependencies
Look inside the go.mod and package.json files for any Google-related packages or SDKs.

🚨 If You’re Suspicious
If you didn’t explicitly configure OpenCode to use Google services, and it’s dropping Google Updater files, that’s not expected behavior. You should:
- Stop using the binary
- Report it to the maintainers on [GitHub Issues](https://github.com/opencode-ai/opencode/issues)
- Consider building from a clean source tree and inspecting the build process

Would you like help scanning the binary or checking which part of the code might be triggering this behavior?
Originally created by @SkybuckFlying on GitHub (Jul 6, 2025). Originally assigned to: @thdxr on GitHub. https://www.virustotal.com/gui/file/7805f7d1f00772bf8ac211987323bde830725379c894367bfe44f4b961114e8f/behavior Files dropped: C:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0 C:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\Crashpad C:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\Crashpad\attachments C:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\Crashpad\metadata C:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\Crashpad\reports C:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\uninstall.cmd C:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\updater.exe C:\Program Files\Google2208_1117271987 Processes Created: "C:\Users\<USER>\Desktop\opencode.exe" %SAMPLEPATH%\opencode.exe C:\Program Files\Google3624_727247553\bin\updater.exe C:\Windows\System32\UI0Detect.exe AI take on it: ``` That’s a very valid concern — and you’re right to question it. Based on what you’ve shared and what I found, OpenCode itself should not be installing or triggering Google Updater. However, here’s what might be happening: 🧩 Possible Explanations 1. OpenCode Uses Google APIs (e.g., Gemini) If you configured OpenCode to use Google Gemini or other Google services, it may: - Launch a browser window for authentication - Use a Google SDK or library that triggers background services Some Google SDKs (especially those bundled with Chromium-based tools) may silently install or update Google Updater as part of their telemetry or crash reporting setup. 2. Bundled Dependencies If OpenCode or one of its dependencies (like opencode-sdk-go) uses a library that links to Chromium or Electron components, it might: - Drop files like updater.exe or Crashpad - Trigger Google Updater behavior This is common in apps that use Google’s Crashpad for error reporting. 3. False Attribution It’s possible that another app or background service (like Chrome, Drive, or Earth) was updating at the same time you ran opencode.exe, and VirusTotal attributed the behavior to the wrong process. 🔍 What You Can Do ✅ 1. Check the Binary Use [Sigcheck](https://learn.microsoft.com/en-us/sysinternals/downloads/sigcheck) or VirusTotal to inspect opencode.exe: - Is it signed? - Does it contain embedded Google components? ✅ 2. Run in a Sandbox Use [Sandboxie](https://sandboxie-plus.com/) or a VM to isolate opencode.exe and monitor its behavior. ✅ 3. Check Dependencies Look inside the go.mod and package.json files for any Google-related packages or SDKs. 🚨 If You’re Suspicious If you didn’t explicitly configure OpenCode to use Google services, and it’s dropping Google Updater files, that’s not expected behavior. You should: - Stop using the binary - Report it to the maintainers on [GitHub Issues](https://github.com/opencode-ai/opencode/issues) - Consider building from a clean source tree and inspecting the build process Would you like help scanning the binary or checking which part of the code might be triggering this behavior? ```
yindo closed this issue 2026-02-16 17:27:10 -05:00
yindo commented 2026-02-16 17:27:10 -05:00
Author
Owner
Copy Link
Copy Source

@itsnumpty commented on GitHub (Jul 21, 2025):

Potentially related, seen when trying to unzip on Windows 11:

Image

Running most up to date protection:

Image
@itsnumpty commented on GitHub (Jul 21, 2025): Potentially related, seen when trying to unzip on Windows 11: <img width="503" height="311" alt="Image" src="https://github.com/user-attachments/assets/f5d355bc-8b34-47d6-a002-f83df2bf83c6" /> Running most up to date protection: <img width="464" height="825" alt="Image" src="https://github.com/user-attachments/assets/90c05a05-1a1d-44ef-b17d-2faad72eaf37" />
yindo commented 2026-02-16 17:27:10 -05:00
Author
Owner
Copy Link
Copy Source

@KoushikSahu commented on GitHub (Aug 23, 2025):

@itsnumpty I am seeing the same issue. Found any fix?

@KoushikSahu commented on GitHub (Aug 23, 2025): @itsnumpty I am seeing the same issue. Found any fix?
yindo commented 2026-02-16 17:27:10 -05:00
Author
Owner
Copy Link
Copy Source

@becseya commented on GitHub (Aug 26, 2025):

Run into the same issue, but with a totally unrelated personal project. Leaving some notes here, might be useful for someone with more sec experience.

A similar case (pyinstaller) from 8 years ago discussed here (same GoogleUpdater in the log). And from 2 months ago in a cracked game.

Description

Basically got the same behavior when bundling my CLI Python application with free version of nuitka.
Similar files (only differs in the numbers) dropped and processes created:

# files dropped
C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0
C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\Crashpad
C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\Crashpad\attachments
C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\Crashpad\metadata
C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\Crashpad\reports
C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd
C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\updater.exe
C:\Program Files\Google4004_532315358

# processes created
C:\Program Files\Google3984_507818687\bin\updater.exe
C:\Windows\System32\UI0Detect.exe

# shell command
"C:\Program Files\Google3984_507818687\bin\updater.exe" --update --system --enable-logging --vmodule=*/chrome/updater/*=2 /sessionid {8E8DD415-FD7B-44B5-AD9D-BAE8526D5E2A}

Full log at virustotal

When I bundled my code with cython+pyinstaller (as suggested here) this behavior disappeared along with number of threats decreased (log).

Both .exes were created in GitHub Actions, so my machine being some kind of spreader is ruled out.

A possible explanation

My program prints a localhost address on the console. The sandbox might be "clicking" that link and triggering an automated Chrome update. But then again, it's not there with pyinstaller. Maybe they use a different shell environment.

Does opencode print addresses on the console?

@becseya commented on GitHub (Aug 26, 2025): Run into the same issue, but with a totally unrelated personal project. Leaving some notes here, might be useful for someone with more sec experience. > A similar case (pyinstaller) from 8 years ago discussed [here](https://stackoverflow.com/questions/43777106/program-made-with-pyinstaller-now-seen-as-a-trojan-horse-by-avg) (same GoogleUpdater in the [log](https://www.virustotal.com/gui/file/9b0c24a5a90d8e3a12d2e07e3f5e5224869c01732b2c79fd88a8986b8cf30406/behavior)). And from [2 months ago](https://www.reddit.com/r/antivirus/comments/1lhmr22/im_sure_this_is_a_virus_but_im_new_to_this/) in a cracked game. ### Description Basically got the same behavior when bundling my CLI Python application with free version of [nuitka](https://github.com/Nuitka/Nuitka). Similar files (only differs in the numbers) dropped and processes created: ``` # files dropped C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0 C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\Crashpad C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\Crashpad\attachments C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\Crashpad\metadata C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\Crashpad\reports C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\updater.exe C:\Program Files\Google4004_532315358 # processes created C:\Program Files\Google3984_507818687\bin\updater.exe C:\Windows\System32\UI0Detect.exe # shell command "C:\Program Files\Google3984_507818687\bin\updater.exe" --update --system --enable-logging --vmodule=*/chrome/updater/*=2 /sessionid {8E8DD415-FD7B-44B5-AD9D-BAE8526D5E2A} ``` Full log [at virustotal](https://www.virustotal.com/gui/file/47ba9e5f91349d98e0d64ad351efab628ea2ee4f7451adbd1a5b11dd0d84bdc8/behavior) **When I bundled my code with cython+pyinstaller (as suggested [here](https://stackoverflow.com/a/79004611/21290522)) this behavior disappeared along with number of threats decreased** ([log](https://www.virustotal.com/gui/file/b80211f969e132c454d6151ff44bb8f863f4adb837918e70f3555deb2f6387de/behavior)). Both `.exe`s were created in GitHub Actions, so my machine being some kind of spreader is ruled out. ## ### A possible explanation My program prints a localhost address on the console. The sandbox might be "clicking" that link and triggering an automated Chrome update. But then again, it's not there with pyinstaller. Maybe they use a different shell environment. Does opencode print addresses on the console?
yindo commented 2026-02-16 17:27:10 -05:00
Author
Owner
Copy Link
Copy Source

@becseya commented on GitHub (Aug 26, 2025):

The Behaviour sandbox captures everything that happens when the executable is opened. If there's any coincidental updates going on, it captures that too. Sometimes it also captures internal workings of the sandbox.

Indeed, re-running the analysis cleared GoogleUpdater logs in my case.

@becseya commented on GitHub (Aug 26, 2025): > The Behaviour sandbox captures everything that happens when the executable is opened. If there's any coincidental updates going on, it captures that too. Sometimes it also captures internal workings of the sandbox. - [source](https://www.reddit.com/r/antivirus/comments/1n0kgpn/comment/nar6nw4/) Indeed, re-running the analysis cleared GoogleUpdater logs in my case.
yindo commented 2026-02-16 17:27:10 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Sep 23, 2025):

@itsrainingmani

@rekram1-node commented on GitHub (Sep 23, 2025): @itsrainingmani
yindo commented 2026-02-16 17:27:10 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Oct 21, 2025):

if anyone is still running into this, we have a linked issue in the large windows support issue: Windows Support #631

@rekram1-node commented on GitHub (Oct 21, 2025): if anyone is still running into this, we have a linked issue in the large windows support issue: Windows Support #631
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#528
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?