anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-23 10:45:33 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Kaspersky Antivirus deletes OpenCode during in-app update (suspected false positive) #7295

New Issue
Open
opened 2026-02-16 18:06:44 -05:00 by yindo · 1 comment
yindo commented 2026-02-16 18:06:44 -05:00
Owner
Copy Link
Copy Source

Originally created by @koushikkundu081-lgtm on GitHub (Jan 23, 2026).

Originally assigned to: @adamdotdevin on GitHub.

Description

While performing an in-app update using the OpenCode update notification,
Kaspersky Antivirus detects the update installation as malware once the update
is applied in place.

Kaspersky then deletes:

  • the update files
  • the existing installed OpenCode application

As a result, the application is completely removed from the system.

This appears to be a false positive triggered specifically during the update process.

Environment

  • OS: Windows (windows 11 pro 25 H2/ 26200.7623)
  • OpenCode version: Installed version 1.1.32 → Updated version 1.1.33 (via in-app update)
  • Update method: In-app update notification
  • Antivirus: Kaspersky Antivirus

Antivirus Detection

  • Antivirus: Kaspersky
  • Detection type: Malware / Heuristic (exact name available in AV report)
  • Action taken: Automatic deletion of update and existing installation

Evidence

  • Kaspersky event log (CSV available)
  • Issue reproducible only during in-place update
  • Normal execution without update does not trigger detection

Expected Behavior

In-app update should complete without triggering antivirus deletion
and without removing the existing installation.

Plugins

No response

OpenCode version

1.1.32

Steps to reproduce

No response

Screenshot and/or share link

av_report.csv

Operating System

windows 11 pro 25H2

Terminal

No response

Originally created by @koushikkundu081-lgtm on GitHub (Jan 23, 2026). Originally assigned to: @adamdotdevin on GitHub. ### Description While performing an in-app update using the OpenCode update notification, Kaspersky Antivirus detects the update installation as malware once the update is applied in place. Kaspersky then deletes: - the update files - the existing installed OpenCode application As a result, the application is completely removed from the system. This appears to be a false positive triggered specifically during the update process. ## Environment - OS: Windows (windows 11 pro 25 H2/ 26200.7623) - OpenCode version: Installed version 1.1.32 → Updated version 1.1.33 (via in-app update) - Update method: In-app update notification - Antivirus: Kaspersky Antivirus ## Antivirus Detection - Antivirus: Kaspersky - Detection type: Malware / Heuristic (exact name available in AV report) - Action taken: Automatic deletion of update and existing installation ## Evidence - Kaspersky event log (CSV available) - Issue reproducible only during in-place update - Normal execution without update does not trigger detection ## Expected Behavior In-app update should complete without triggering antivirus deletion and without removing the existing installation. ### Plugins _No response_ ### OpenCode version 1.1.32 ### Steps to reproduce _No response_ ### Screenshot and/or share link [av_report.csv](https://github.com/user-attachments/files/24815003/av_report.csv) ### Operating System windows 11 pro 25H2 ### Terminal _No response_
yindo added the windowsbugweb labels 2026-02-16 18:06:44 -05:00
yindo commented 2026-02-16 18:06:44 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Jan 23, 2026):

This issue might be a duplicate of existing issues. Please check:

  • #9937: OpenCode update triggers Kaspersky detection (PDM:Trojan.Win32.Generic / .nblk) and app is removed

Feel free to ignore if none of these address your specific case.

@github-actions[bot] commented on GitHub (Jan 23, 2026): This issue might be a duplicate of existing issues. Please check: - #9937: OpenCode update triggers Kaspersky detection (PDM:Trojan.Win32.Generic / .nblk) and app is removed Feel free to ignore if none of these address your specific case.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label bug web windows
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#7295
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?