Your installer file on your website is distributing malware

[melbazpeach-source]

Description

The download link button then windows install - the exe installer has been infected with malware.

Plugins

No response

OpenCode version

No response

Steps to reproduce

No response

Screenshot and/or share link

No response

Operating System

No response

Terminal

No response

[github-actions]

This issue might be a duplicate of existing issues. Please check:

• v0.15.16 was infected by a virus and removed by Windows Security #3406: v0.15.16 was infected by a virus and removed by Windows Security
• Running opencode is flagged as trojan on windows - Installed through Node Package Manager #7655: Running opencode is flagged as trojan on windows - Installed through Node Package Manager
• opencode-windows-x64.zip file contains virus #1103: opencode-windows-x64.zip file contains virus
• Windows Defender falsely flags new releases as trojans #3415: Windows Defender falsely flags new releases as trojans

These issues describe similar Windows Defender/Security detections of malware (primarily Trojan:Script/Wacatac variants) related to OpenCode releases. It appears this is a known recurring issue that the team is actively working to address with code signing and other measures.

Feel free to ignore if this describes a different specific case.

[melbazpeach-source]

Maybe - but it’s NOT a signing issue - it’s self replicating and definitely a virus. Claude code scanned its files in the temp folder

[rekram1-node]

I think this is a false positive, what are you referring to that was causing issues in temp folder?

[melbazpeach-source]

No it is not a false positive.
I’ve double checked and it is absolutely malware.
And these guys KNEW.
It’s been flagged before and nothing was fixed.
Now I’ve had to completely wipe my device and lost days of work.

[rekram1-node]

? please share more?

[melbazpeach-source]

CRITICAL: This is MALWARE
File: C:\users\melba\AppData\Local\Temp.7cdd8f5e2b77f7b9-00000000.node
Why it’s malware:
1. Naming pattern matches known malware - .GUID-00000000.node is identical to Trojan pattern
2. Created during infection - 1:53 PM today (same timeframe as malware detection)
3. No digital signature - NotSigned
4. Large size - 3.6 MB, unusual for a temp Node.js addon
5. Hash identified - specific malware signature

[Mirrowel]

This is a common windows defender L. This can trigger for archives with no binaries whatsoever.

WIndows defender is nothing but trouble - disable it.

Naturally, claude is clearly incorrect.
You asked it and from your question an LLM will try to answer positively using whatever it can find. They are not trained to answer no and to disprove.

[Xavier-Burger]

CRITICAL: This is MALWARE
File: C:\users\melba\AppData\Local\Temp.7cdd8f5e2b77f7b9-00000000.node
Why it’s malware:

1. Naming pattern matches known malware - .GUID-00000000.node is identical to Trojan pattern
2. Created during infection - 1:53 PM today (same timeframe as malware detection)
3. No digital signature - NotSigned
4. Large size - 3.6 MB, unusual for a temp Node.js addon
5. Hash identified - specific malware signature

Instead of relying on llm hallucinations, Google the old fasion way. There's a reason the detection is inconsistent on different open code versions, the temp dll and node files are being heuristically detected as Trojans. Look into the contributors behind opencode, these people aren't malicious or idiots.

[Makishima]

@melbazpeach-source Just to be fair, could you please upload the file to https://www.virustotal.com/gui/home/upload?

[melbazpeach-source]

I have completely wiped my 2week old computer now.
So as soon as your installer hit my system, it:
Tried to install 10 copies of itself.
It hammered my security.
Security stopped 9.
1 version got through.
In the 10 seconds it took for me to take my system offline, it had already created 5 replicas of uts payload in my temp drive.
It had altered group policy
And it had changed the date on all the files it touched to tomorrow’s date.

So honestly?
I don’t know if that’s what your code is supposed to do but common sense says it’s not.
If it is, I apologise.

The fact you are all fobbing it off as false positive, and letting peoples machines get fkd over, is not doing much for the UX nor trustworthiness of your products tbh.