Threat Found. Trojan:Script/Wacatac.H!ml #7669

Activity

1. defmarshal

   added

   bugSomething isn't workingSomething isn't working

   on Jan 10, 2026
2. github-actions

   assigned

   rekram1-node

   on Jan 10, 2026
3. github-actions

   added

   windows

   on Jan 10, 2026
4. github-actions commented on Jan 10, 2026

   

   github-actionsBot

   on Jan 10, 2026 – with GitHub Actions

   Contributor

   More actions

   This issue might be a duplicate of existing issues. Please check:

   • Running opencode is flagged as trojan on windows - Installed through Node Package Manager #7655: Running opencode is flagged as trojan on windows - Same Wacatac.H!ml detection on Windows 11 with Wezterm
   • [False Positive?] Windows Defender detects Trojan:Win32/Wacatac.H!ml when running opencode #7592: [False Positive?] Windows Defender detects Trojan:Win32/Wacatac.H!ml - Same trojan detection blocking OpenCode
   • Windows Defender falsely flags new releases as trojans #3415: Windows Defender falsely flags new releases as trojans - Umbrella issue tracking recurring Wacatac false positives
   • v0.15.16 was infected by a virus and removed by Windows Security #3406: v0.15.16 was infected by a virus and removed by Windows Security - Same Wacatac trojan family issue
   • opencode-windows-x64.zip file contains virus #1103: opencode-windows-x64.zip file contains virus - Older report of Windows antivirus blocking OpenCode

   This appears to be part of a recurring pattern of Windows Defender false positives. Feel free to ignore if your specific case differs.
5. TheDarkSkyXD commented on Jan 10, 2026

   

   TheDarkSkyXD

   on Jan 10, 2026

   More actions

   i am getting the same issue every time i open opencode
6. rekram1-node

   assigned

   adamdotdevin

   and unassigned

   rekram1-node

   on Jan 10, 2026
7. Makishima commented on Jan 11, 2026

   

   Makishima

   on Jan 11, 2026

   More actions

   It seems that the installer archive is clean: https://www.virustotal.com/gui/file/8AB962BEF658B7E003DD0B982EE912F1EFD9FAADB988AA28582E9E0D2976D76C/detection.
8. marcinsiennicki95 commented on Jan 11, 2026

   

   marcinsiennicki95

   on Jan 11, 2026

   More actions

   I have the same error for latest version
9. magicprinc commented on Jan 11, 2026

   

   magicprinc

   on Jan 11, 2026

   More actions

   Same error: Windows Defender detects
   Trojan:Script/Wacatac.H!ml

   affected elements
   file: C:\TMP.3aebb6a10f17efcd-00000001.dll

   and blocks opencode 😱

   More about Trojan
   https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Trojan%3AScript%2FWacatac.H!ml&threatid=2147814524
10. okazakov commented on Jan 11, 2026

    

    okazakov

    on Jan 11, 2026

    Last edited by okazakov

    More actions

    affected elements
    file:
    C:\TMP.3aebb6a10f17efcd-00000001.dll

    The dll's name is different every time which makes it impossible to add as exclusion in Windows Defender/Security. So yeah, "just ignore it" LOL...

    👍React with 👍1Reacted by Andrej Fink
11. okazakov commented on Jan 11, 2026

    

    okazakov

    on Jan 11, 2026

    Last edited by okazakov

    More actions

    The only way I was able to continue using OpenCode was to uninstall it, then install the previous version 1.1.7
    But before you launch it, set "autoupdate" : "notify" in ~/.config/opencode/opencode.jsonc
    If you don't, OpenCode will auto upgrade to the latest on launch and get blocked again.
12. okazakov commented on Jan 11, 2026

    

    okazakov

    on Jan 11, 2026

    Last edited by okazakov

    More actions

    Same error: Windows Defender detects Trojan:Script/Wacatac.H!ml

    affected elements file: C:\TMP.3aebb6a10f17efcd-00000001.dll

    and blocks opencode 😱

    More about Trojan https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Trojan%3AScript%2FWacatac.H!ml&threatid=2147814524

    OK, so VirusTotal identifies THREE different threats in this DLL (the DLL name is different every time you try and run the latest openCode, which is suspicious on its own).
    I know false positives for OpenCode is a regular occurrencee, but on this occasions, think this deserves a serious look from the developers.
    https://www.virustotal.com/gui/file/c7155d1809bf7036fdff80f1d362183c8130ae4714951d78e0f0615a5bc83bc9

    
13. okazakov commented on Jan 11, 2026

    

    okazakov

    on Jan 11, 2026

    More actions

    It seems that the installer archive is clean: https://www.virustotal.com/gui/file/8AB962BEF658B7E003DD0B982EE912F1EFD9FAADB988AA28582E9E0D2976D76C/detection.

    You've checked the installer, but it's not the installer that triggers the threat detection. It's this DLL and only when you launch OpenCode:
    https://www.virustotal.com/gui/file/c7155d1809bf7036fdff80f1d362183c8130ae4714951d78e0f0615a5bc83bc9
14. laidani commented on Mar 5, 2026

    

    laidani

    on Mar 5, 2026

    More actions

    Same issue with v1.2.17

    👍React with 👍2Reacted by Frank Rodríguez López and Dusan Luketic
15. fr20587 commented on Mar 5, 2026

    

    fr20587

    on Mar 5, 2026

    Last edited by fr20587

    More actions

    Same issue with v1.2.17 and v1.2.18

    👍React with 👍5Reacted by Dusan Luketic, ko-hyeon-lim, SunnyRx, Jakob and skyfallsdown
16. Hona commented on Mar 29, 2026

    

    Hona

    on Mar 29, 2026

    Member

    More actions

    As of OpenCode v1.3.4 across the CLI + Desktop apps, we have full code signing - so there should be no more warnings.

    Please let me know otherwise

    
17. Hona

    closed this as completedon Mar 29, 2026