You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Reacted by Luca Puddu, Jakub Drabik, Ano Rebel, Pranshu Chittora, Grant Ammons, Griffin Martin, 00PZ, Alessandro, Alisson Leal, Alexander Xavier Pauta Bueno and 17 more
Just throwing this here but @leohenon own fork is actually quite nice. I would recommend using ocv. I have been using it since this happened and I was made aware by @leohenon and I appreciate it.
careful with griffinmartin's plugin, some code related to crypto mining was found in the plugin, community was asking him by using issues, but he is deleting anything related to that.
Reacted by Dmitry Gordienko
Reacted by Dmitry Gordienko, dns_issue, Marcello Sylvester Bauer, Dennis Værum and Julian Coy
careful with griffinmartin's plugin, some code related to crypto mining was found in the plugin, community was asking him by using issues, but he is deleting anything related to that.
I didn't find anything related to mining in the repository.
Where did you get this information from? Can you provide any proof?
Seems like the repo description was updated to have some weird crypto hash. The social accounts looked...potentially compromised, too. There was no "bad code" delivered so far as I can tell. That said...even if the author was only briefly compromised that's bad news for a plugin that gets automatically updated every time most people open up their OpenCode session.
NGL, that's a little scary.
Reacted by Dmitry Gordienko, Chris Lasher and 林博仁 Buo-ren Lin
Using @latest means the plugin can be updated automatically every time OpenCode starts, which may expose you to unreviewed changes, unexpected updates, or a possible supply chain / exploit risk.
This is a preventive security measure to reduce the risk caused by automatic plugin updates.
From now on, updates should be done manually, only after reviewing the version you want to install.
If anyone needs help updating their config file, reply in this channel and we’ll help.
Reacted by Dmitry Gordienko, Marcello Sylvester Bauer and Dennis Værum
Since the recent Anthropic changes, I built this plugin. It lets you use claude code through the opencode TUI. At the moment, this seems to be the only way to use claude max credits in opencode without extra usage.
Interesting, there is a fix. I added a similar workaround in op-anthropic-auth, and it’s working there as well. Not sure how long it will keep working though.
Activity
R00tedbrain commentedon Mar 19, 2026
R00tedbrain commentedon Mar 19, 2026
github-actions commentedon Mar 19, 2026
This issue might be a duplicate of existing issues. Please check:
gonzalosr commentedon Mar 19, 2026
#17910 (comment)
hyowonbernabe commentedon Mar 19, 2026
Up
rafaelsmgomes commentedon Mar 19, 2026
Is there a plugin we can use to go around this? Anyone know one?
pranshuchittora commentedon Mar 19, 2026
Same, also login fails, says invalid code....
GSUBx019 commentedon Mar 19, 2026
anthrobreak ahh moment
pranshuchittora commentedon Mar 19, 2026
What's this & how to use it? Can't find this on npm
nukeop commentedon Mar 19, 2026
Same
thlindustries commentedon Mar 19, 2026
Same here, nothing related to "#15562", always invalid code always
jeanclaudevibedan commentedon Mar 19, 2026
Same issue. Service was working 3 hours ago or so. Now it's broken.
129 remaining items
jgttech commentedon Mar 24, 2026
Just throwing this here but @leohenon own fork is actually quite nice. I would recommend using
ocv. I have been using it since this happened and I was made aware by @leohenon and I appreciate it.DavidNorena commentedon Apr 6, 2026
careful with griffinmartin's plugin, some code related to crypto mining was found in the plugin, community was asking him by using issues, but he is deleting anything related to that.
eXamadeus commentedon Apr 7, 2026
@DavidNorena that's wild, if true, is there any proof of that? (screenshots, links, etc?)
vsixer commentedon Apr 7, 2026
I didn't find anything related to mining in the repository.
Where did you get this information from? Can you provide any proof?
eXamadeus commentedon Apr 8, 2026
@vsixer I did some digging and what I found was this reddit post.
Seems like the repo description was updated to have some weird crypto hash. The social accounts looked...potentially compromised, too. There was no "bad code" delivered so far as I can tell. That said...even if the author was only briefly compromised that's bad news for a plugin that gets automatically updated every time most people open up their OpenCode session.
NGL, that's a little scary.
vsixer commentedon Apr 8, 2026
@eXamadeus, Thanks for providing the link. It definitely looks weird.
r00tedbrain-backup commentedon Apr 8, 2026
THX , FIXED :
Listo ✅
Cambié los plugins de
@latesta versión fijada:opencode-anthropic-auth@latest@0.0.13@thehugeman/opencode-anthropic-auth-community@latest@0.0.3Así OpenCode no los actualizará automáticamente al arrancar y no te pueden colar una versión maliciosa.
Cuando quieras actualizar alguno, lo haces tú manualmente cambiando el número de versión en
~/.config/opencode/opencode.json. 👊r00tedbrain-backup commentedon Apr 8, 2026
🚨 IMPORTANT SECURITY NOTICE – OPENCODE USERS 🚨
@everyone
As a precaution, we are asking all users who are using these plugins to stop using
@latestand pin a fixed version immediately:opencode-anthropic-auth→@0.0.13@thehugeman/opencode-anthropic-auth-community→@0.0.3Why?
Using
@latestmeans the plugin can be updated automatically every time OpenCode starts, which may expose you to unreviewed changes, unexpected updates, or a possible supply chain / exploit risk.What you need to do
Check your configuration file:
~/.config/opencode/opencode.jsonIf you currently have this:
{ "plugin": [ "opencode-anthropic-auth@latest", "@thehugeman/opencode-anthropic-auth-community@latest" ] }replace it with this:
{ "plugin": [ "opencode-anthropic-auth@0.0.13", "@thehugeman/opencode-anthropic-auth-community@0.0.3" ] }Important
This is a preventive security measure to reduce the risk caused by automatic plugin updates.
From now on, updates should be done manually, only after reviewing the version you want to install.
If anyone needs help updating their config file, reply in this channel and we’ll help.
leohenon commentedon Apr 9, 2026
Since the recent Anthropic changes, I built this plugin. It lets you use claude code through the opencode TUI. At the moment, this seems to be the only way to use claude max credits in opencode without extra usage.
r00tedbrain-backup commentedon Apr 9, 2026
ex-machina-co/opencode-anthropic-auth#50 (comment)
leohenon commentedon Apr 9, 2026
Interesting, there is a fix. I added a similar workaround in op-anthropic-auth, and it’s working there as well. Not sure how long it will keep working though.
vinzabe commentedon Apr 11, 2026
here's the perm fix that avoids any claude patches https://github.com/vinzabe/opencode-anthropic-max-fix
santiagocasas commentedon Apr 15, 2026
@vinzabe thanks, it works, but your readme install instructions are wrong. The https://raw.githubusercontent.com/vinzabe/opencode-anthropic-max-fix/main/install.cjs , returns 404. I used the correct one and installed without systemd.
gabejar commentedon Apr 16, 2026
i will edit it. i am updating this fix everytime claude is changing something that I dont have time to edit the readme. lol
santiagocasas commentedon May 11, 2026
I got this message now:
OAuth authentication is currently not allowed for this organization.