Repository navigation
Your installer file on your website is distributing malware #7736
Description
Description
The download link button then windows install - the exe installer has been infected with malware.
Plugins
No response
OpenCode version
No response
Steps to reproduce
No response
Screenshot and/or share link
No response
Operating System
No response
Terminal
No response
Reacted by Vagenda
Activity
github-actions commentedon Jan 11, 2026
This issue might be a duplicate of existing issues. Please check:
These issues describe similar Windows Defender/Security detections of malware (primarily Trojan:Script/Wacatac variants) related to OpenCode releases. It appears this is a known recurring issue that the team is actively working to address with code signing and other measures.
Feel free to ignore if this describes a different specific case.
melbazpeach-source commentedon Jan 11, 2026
Maybe - but it’s NOT a signing issue - it’s self replicating and definitely a virus. Claude code scanned its files in the temp folder
rekram1-node commentedon Jan 11, 2026
I think this is a false positive, what are you referring to that was causing issues in temp folder?
melbazpeach-source commentedon Jan 11, 2026
No it is not a false positive.
I’ve double checked and it is absolutely malware.
And these guys KNEW.
It’s been flagged before and nothing was fixed.
Now I’ve had to completely wipe my device and lost days of work.
rekram1-node commentedon Jan 11, 2026
? please share more?
melbazpeach-source commentedon Jan 11, 2026
CRITICAL: This is MALWARE
File: C:\users\melba\AppData\Local\Temp.7cdd8f5e2b77f7b9-00000000.node
Why it’s malware:
1. Naming pattern matches known malware - .GUID-00000000.node is identical to Trojan pattern
2. Created during infection - 1:53 PM today (same timeframe as malware detection)
3. No digital signature - NotSigned
4. Large size - 3.6 MB, unusual for a temp Node.js addon
5. Hash identified - specific malware signature
Mirrowel commentedon Jan 11, 2026
This is a common windows defender L. This can trigger for archives with no binaries whatsoever.
WIndows defender is nothing but trouble - disable it.
Naturally, claude is clearly incorrect.
You asked it and from your question an LLM will try to answer positively using whatever it can find. They are not trained to answer no and to disprove.
Xavier-Burger commentedon Jan 11, 2026
Instead of relying on llm hallucinations, Google the old fasion way. There's a reason the detection is inconsistent on different open code versions, the temp dll and node files are being heuristically detected as Trojans. Look into the contributors behind opencode, these people aren't malicious or idiots.
Makishima commentedon Jan 11, 2026
@melbazpeach-source Just to be fair, could you please upload the file to https://www.virustotal.com/gui/home/upload?
melbazpeach-source commentedon Jan 11, 2026
I have completely wiped my 2week old computer now.
So as soon as your installer hit my system, it:
Tried to install 10 copies of itself.
It hammered my security.
Security stopped 9.
1 version got through.
In the 10 seconds it took for me to take my system offline, it had already created 5 replicas of uts payload in my temp drive.
It had altered group policy
And it had changed the date on all the files it touched to tomorrow’s date.
So honestly?
I don’t know if that’s what your code is supposed to do but common sense says it’s not.
If it is, I apologise.
The fact you are all fobbing it off as false positive, and letting peoples machines get fkd over, is not doing much for the UX nor trustworthiness of your products tbh.
Mirrowel commentedon Jan 11, 2026
Upload to virustotal. What you are describing has nothing to do with what opencode does.
By install you mean this?
curl -fsSL https://opencode.ai/install | bashWindows installer:
https://www.virustotal.com/gui/file/3fcb5f22adbfa3ef280d8aaae529148e56853e62b3bfdad16b321dc651475561
Makishima commentedon Jan 11, 2026
It seems that the installer archive is clean: https://www.virustotal.com/gui/file/8AB962BEF658B7E003DD0B982EE912F1EFD9FAADB988AA28582E9E0D2976D76C/detection
4cecoder commentedon Jan 13, 2026
opentui.dll depenency is tripping up the windows 666 beast
when cloning the source code windows quickly quarantines the
node_modules/opentui/opentui.dllmelbazpeach-source commentedon Jan 13, 2026
@4cecoder You got lucky. This is what I got :-(
See [attached]
Free Automated Malware Analysis Service - powered by Falcon Sandbox - Viewing on.pdf
Vagenda commentedon Jan 14, 2026
I'm old enough to remember when people cared about infections on their PC. Hell, I remember when people valued their privacy and rights as well. I read the report. It's a big enough red flag for me. Do better.
thdxr commentedon Jan 14, 2026
i just went through everything that was posted here
nothing stands out to me - opencode has a binary dep called opentui which gets extracted on first run to a .dll and then called into with FFI
seems like some scans look at this and feel like it's similar behavior to malware
if someone can point to something more specific we're happy to take a look - i've checked our CI process and nothing has changed
same binaries produced as always
additionally everyone here is trying to help your issue - being insulting isn't particularly helpful
thdxr commentedon Jan 14, 2026
one thing that did stand out was this path
"H:\baidu\netdisk\pc-international-unite\src\node_modules\uiohook-napi"
this is what your security report is about - i don't know what this is and it's unrelated to opencode
is this your project?
melbazpeach-source commentedon Jan 14, 2026
That stood out for me too.
I’ve have no idea what “H:\baidu\netdisk\pc-international-unite\src\node_modules\uiohook-napi" is.
It’s not my machine or projects.
Look it’s done.
No amount of complaint is going to give me back my machine.
I’ve looked into anecdotal observations online, and I’d say either your link was (or is still) targeted for drive by malware.
It’s cos your repo is popular and also why it’s random.
Or maybe targeted in the npm malware attack.
Just my 10 cents worth that it might be a good idea to increase your defenses.
I’m no one. So my opinion doesn’t matter.
But if it happens to someone who does matter, your software suffers by association.
melbazpeach-source commentedon Jan 16, 2026
I've done further analysis and that path:
That path H:\baidu\netdisk\pc-international-unite\src\node_modules\uiohook-napi is literally the file path on the malware author’s development machine where they built/compiled the infected OpenCode package.
When developers compile code, sometimes the build process embeds the full file paths from their development environment into the binary. The malware author forgot to strip this metadata out before releasing it.
So this tells us:
About the malware author:
∙ Uses Baidu Netdisk (Chinese cloud storage) on their H: drive
∙ Developing in the “pc-international-unite” project folder
∙ Using Node.js with uiohook-napi (keyboard/mouse hooking library)
∙ Either Chinese-speaking or deliberately using Chinese infrastructure
What this means:
∙ This is NOT Hybrid Analysis’s path - it’s evidence baked into the malware itself
∙ It’s an OPSEC failure by the attacker (they leaked their dev environment)
∙ The uiohook-napi library explains autonomous mouse movement
1076585426 commentedon Jan 20, 2026
"Have you installed the 'Oh My OpenCode' extension, and did you find the installation tutorial on 'https://ohmyopencode.com/'?"
dliedke commentedon Jan 25, 2026
Only the damn antivirus Kaspersky gets incorrect false positive
https://www.virustotal.com/gui/file/1fcfbe7127704c37fb3043a791cc19e04502139842c12994393ebafc02c2b3a6
Hona commentedon Mar 29, 2026
As of OpenCode v1.3.4 across the CLI + Desktop apps, we have full code signing - so there should be no more warnings.
Please let me know otherwise