Repository navigation
v0.15.16 was infected by a virus and removed by Windows Security #3406
Description
Description
Hello everyone,
I tried to download latest version 0.15.16 at 6:15PM 24 Oct 2025. But the file was quarantined and removed by Windows Security
It was identified as: Trojan Script Wacatac.C!ml
Thank you very much for consider the issue
OpenCode version
0.15.16
Steps to reproduce
- Navigate to the github release page of OpenCode.
- Download the latest release as 0.15.16 at the time of download was latest version
- Windows security deleted the file after finishing download.
Screenshot and/or share link
Operating System
Windows 11 Pro
Terminal
Windows Terminal
Activity
github-actions commentedon Oct 24, 2025
This issue might be a duplicate of existing issues. Please check:
These are all related to Windows Defender/Security false positives with OpenCode executables. The Wacatac.C!ml detection you're experiencing appears to be a known issue with Windows Defender flagging OpenCode binaries as trojans.
Feel free to ignore if none of these address your specific case.
rekram1-node commentedon Oct 24, 2025
this is just the security scanner being stupid there is prolly something we can do but this happens for a short period after every release from what ive heard. This should just go away soon see #1103 this happens every release apparently
I think someone said that if we stop trying to auto update if you installed with a package manager it could help? Not sure if that is the case
HydraKane commentedon Jan 10, 2026
Description
Get Trojan Script Wacatac.H!ml with these files when launch opencode:
allow them and works fine.
OpenCode version
v1.1.11
Operating System
Windows 11 Pro 24H2 26100.7309
Terminal
Windows Terminal
zhaozhongwenzzw commentedon Jan 13, 2026
rekram1-node commentedon Jan 13, 2026
We have a bunch of these false alarms popping up ill see what we can do to get proper signing in place
Hona commentedon Mar 29, 2026
As of OpenCode v1.3.4 across the CLI + Desktop apps, we have full code signing - so there should be no more warnings.
Please let me know otherwise