OpenCode update triggers Kaspersky detection (PDM:Trojan.Win32.Generic / .nblk) and app is removed #9937

Description

Summary

When updating OpenCode from a previous version to the latest available as of 2026-01-21, Kaspersky detects the OpenCode installer/updater and OpenCode.exe as PDM:Trojan.Win32.Generic / PDM:Trojan.Win32.Generic.nblk (high severity) and terminates/quarantines/deletes the files, preventing the update and removing the app. [web:10]

Environment

• OS: Windows (x64)
• Antivirus: Kaspersky (Behavior Detection / PDM module) [web:10]
• Product being updated: OpenCode Desktop
• Update path: previous installed version → latest available on 2026-01-21
• User/profile seen in logs: RAFA-HW\rafal
• Paths involved:
  • C:\Users\rafal\AppData\Local\OpenCode\OpenCode.exe
  • C:\Users\rafal\AppData\Local\Temp\OpenCode-1.1.31-updater-*\OpenCode-1.1.31-installer.exe

What happened

During the update, Kaspersky Behavior Detection flags:

• OpenCode-1.1.31-installer.exe (in Temp updater folder) as PDM:Trojan.Win32.Generic (Behavior Analysis). [web:10]
• OpenCode.exe (in %LocalAppData%\OpenCode) as PDM:Trojan.Win32.Generic.nblk (Behavior Analysis). [web:10]

Kaspersky then blocks/terminates the related processes and later deletes/rolls back the application files, so OpenCode cannot remain installed after the update attempt. [web:10]

Expected behavior

Updating OpenCode should complete normally without triggering antivirus malware detection, process termination, or file deletion. [web:10]

Steps to reproduce

1. Install OpenCode (any previous working version).
2. Trigger an update to the latest version available on 2026-01-21 (observed installer name: OpenCode-1.1.31-installer.exe).
3. Observe Kaspersky alerts and that the installer and OpenCode.exe get blocked/terminated and subsequently removed. [web:10]

Evidence (Kaspersky event log excerpts)

2026-01-21 20:55:44 - Malicious object detected: OpenCode-1.1.31-installer.exe
Detection: PDM:Trojan.Win32.Generic | Object: Process | Method: Behavior analysis
Location: C:\Users\rafal\AppData\Local\Temp\OpenCode-1.1.31-updater-... [web:10]

2026-01-21 20:55:44 - Malicious object detected: OpenCode.exe
Detection: PDM:Trojan.Win32.Generic.nblk | Object: Process | Method: Behavior analysis
Location: C:\Users\rafal\AppData\Local\OpenCode [web:10]

2026-01-21 ~20:55:44-20:55:45 - Process terminated / Blocked (OpenCode.exe and installer) [web:10]

2026-01-21 20:56:28 and later - Object deleted / rollback completed (OpenCode files removed) [web:10]

Impact

• Update cannot be completed.
• OpenCode is removed from the machine after the update attempt.
• User cannot run OpenCode unless they disable protection/whitelist (not acceptable for many users). [web:10]

Plugins

No

OpenCode version

v1.1.30

Steps to reproduce

Steps to reproduce
Install OpenCode (any previous working version).
Trigger an update to the latest version available on 2026-01-21 (observed installer name: OpenCode-1.1.31-installer.exe).
Observe Kaspersky alerts and that the installer and OpenCode.exe get blocked/terminated and subsequently removed. [web:10]

Screenshot and/or share link

No response

Operating System

Windows 11

Terminal

OpenCode Desktop