anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

OpenCode update triggers Kaspersky detection (PDM:Trojan.Win32.Generic / .nblk) and app is removed #7142

New Issue
Open
opened 2026-02-16 18:06:17 -05:00 by yindo · 0 comments
yindo commented 2026-02-16 18:06:17 -05:00
Owner
Copy Link
Copy Source

Originally created by @rafalozan0 on GitHub (Jan 21, 2026).

Originally assigned to: @adamdotdevin on GitHub.

Description

Summary

When updating OpenCode from a previous version to the latest available as of 2026-01-21, Kaspersky detects the OpenCode installer/updater and OpenCode.exe as PDM:Trojan.Win32.Generic / PDM:Trojan.Win32.Generic.nblk (high severity) and terminates/quarantines/deletes the files, preventing the update and removing the app. [web:10]

Environment

  • OS: Windows (x64)
  • Antivirus: Kaspersky (Behavior Detection / PDM module) [web:10]
  • Product being updated: OpenCode Desktop
  • Update path: previous installed version → latest available on 2026-01-21
  • User/profile seen in logs: RAFA-HW\rafal
  • Paths involved:
    • C:\Users\rafal\AppData\Local\OpenCode\OpenCode.exe
    • C:\Users\rafal\AppData\Local\Temp\OpenCode-1.1.31-updater-*\OpenCode-1.1.31-installer.exe

What happened

During the update, Kaspersky Behavior Detection flags:

  • OpenCode-1.1.31-installer.exe (in Temp updater folder) as PDM:Trojan.Win32.Generic (Behavior Analysis). [web:10]
  • OpenCode.exe (in %LocalAppData%\OpenCode) as PDM:Trojan.Win32.Generic.nblk (Behavior Analysis). [web:10]

Kaspersky then blocks/terminates the related processes and later deletes/rolls back the application files, so OpenCode cannot remain installed after the update attempt. [web:10]

Expected behavior

Updating OpenCode should complete normally without triggering antivirus malware detection, process termination, or file deletion. [web:10]

Steps to reproduce

  1. Install OpenCode (any previous working version).
  2. Trigger an update to the latest version available on 2026-01-21 (observed installer name: OpenCode-1.1.31-installer.exe).
  3. Observe Kaspersky alerts and that the installer and OpenCode.exe get blocked/terminated and subsequently removed. [web:10]

Evidence (Kaspersky event log excerpts)

2026-01-21 20:55:44 - Malicious object detected: OpenCode-1.1.31-installer.exe
Detection: PDM:Trojan.Win32.Generic | Object: Process | Method: Behavior analysis
Location: C:\Users\rafal\AppData\Local\Temp\OpenCode-1.1.31-updater-... [web:10]

2026-01-21 20:55:44 - Malicious object detected: OpenCode.exe
Detection: PDM:Trojan.Win32.Generic.nblk | Object: Process | Method: Behavior analysis
Location: C:\Users\rafal\AppData\Local\OpenCode [web:10]

2026-01-21 ~20:55:44-20:55:45 - Process terminated / Blocked (OpenCode.exe and installer) [web:10]

2026-01-21 20:56:28 and later - Object deleted / rollback completed (OpenCode files removed) [web:10]

Impact

  • Update cannot be completed.
  • OpenCode is removed from the machine after the update attempt.
  • User cannot run OpenCode unless they disable protection/whitelist (not acceptable for many users). [web:10]

Plugins

No

OpenCode version

v1.1.30

Steps to reproduce

Steps to reproduce
Install OpenCode (any previous working version).
Trigger an update to the latest version available on 2026-01-21 (observed installer name: OpenCode-1.1.31-installer.exe).
Observe Kaspersky alerts and that the installer and OpenCode.exe get blocked/terminated and subsequently removed. [web:10]

Screenshot and/or share link

No response

Operating System

Windows 11

Terminal

OpenCode Desktop

Originally created by @rafalozan0 on GitHub (Jan 21, 2026). Originally assigned to: @adamdotdevin on GitHub. ### Description ### Summary When updating OpenCode from a previous version to the latest available as of 2026-01-21, Kaspersky detects the OpenCode installer/updater and `OpenCode.exe` as `PDM:Trojan.Win32.Generic` / `PDM:Trojan.Win32.Generic.nblk` (high severity) and terminates/quarantines/deletes the files, preventing the update and removing the app. [web:10] ### Environment - OS: Windows (x64) - Antivirus: Kaspersky (Behavior Detection / PDM module) [web:10] - Product being updated: OpenCode Desktop - Update path: previous installed version → latest available on 2026-01-21 - User/profile seen in logs: `RAFA-HW\rafal` - Paths involved: - `C:\Users\rafal\AppData\Local\OpenCode\OpenCode.exe` - `C:\Users\rafal\AppData\Local\Temp\OpenCode-1.1.31-updater-*\OpenCode-1.1.31-installer.exe` ### What happened During the update, Kaspersky Behavior Detection flags: - `OpenCode-1.1.31-installer.exe` (in Temp updater folder) as `PDM:Trojan.Win32.Generic` (Behavior Analysis). [web:10] - `OpenCode.exe` (in `%LocalAppData%\OpenCode`) as `PDM:Trojan.Win32.Generic.nblk` (Behavior Analysis). [web:10] Kaspersky then blocks/terminates the related processes and later deletes/rolls back the application files, so OpenCode cannot remain installed after the update attempt. [web:10] ### Expected behavior Updating OpenCode should complete normally without triggering antivirus malware detection, process termination, or file deletion. [web:10] ### Steps to reproduce 1. Install OpenCode (any previous working version). 2. Trigger an update to the latest version available on 2026-01-21 (observed installer name: `OpenCode-1.1.31-installer.exe`). 3. Observe Kaspersky alerts and that the installer and `OpenCode.exe` get blocked/terminated and subsequently removed. [web:10] ### Evidence (Kaspersky event log excerpts) > 2026-01-21 20:55:44 - Malicious object detected: `OpenCode-1.1.31-installer.exe` > Detection: `PDM:Trojan.Win32.Generic` | Object: Process | Method: Behavior analysis > Location: `C:\Users\rafal\AppData\Local\Temp\OpenCode-1.1.31-updater-...` [web:10] > 2026-01-21 20:55:44 - Malicious object detected: `OpenCode.exe` > Detection: `PDM:Trojan.Win32.Generic.nblk` | Object: Process | Method: Behavior analysis > Location: `C:\Users\rafal\AppData\Local\OpenCode` [web:10] > 2026-01-21 ~20:55:44-20:55:45 - Process terminated / Blocked (OpenCode.exe and installer) [web:10] > 2026-01-21 20:56:28 and later - Object deleted / rollback completed (OpenCode files removed) [web:10] ### Impact - Update cannot be completed. - OpenCode is removed from the machine after the update attempt. - User cannot run OpenCode unless they disable protection/whitelist (not acceptable for many users). [web:10] ### Plugins No ### OpenCode version v1.1.30 ### Steps to reproduce Steps to reproduce Install OpenCode (any previous working version). Trigger an update to the latest version available on 2026-01-21 (observed installer name: OpenCode-1.1.31-installer.exe). Observe Kaspersky alerts and that the installer and OpenCode.exe get blocked/terminated and subsequently removed. [web:10] ### Screenshot and/or share link _No response_ ### Operating System Windows 11 ### Terminal OpenCode Desktop
yindo added the windowsbugweb labels 2026-02-16 18:06:17 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label bug web windows
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#7142
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?