Repository navigation
Running opencode is flagged as trojan on windows - Installed through Node Package Manager #7655
Description
Description
I have been using opencode throughout the week on my work machine, it has been great. Today in between sessions opencode outomatically updated as per my config, and from then on it has been marked as triggering a trojan called wacatac.h!ml
I have had issues with auto-update before, where my commandline would complain that the installed version was not valid. It went away after re-installing through npm -g
I am on Windows, I use Wezterm as my terminal, with PowerShell 7 as my shell.
I am not looking forward to explaining this one to IT at work 😅
Plugins
None
OpenCode version
v1.1.12
Steps to reproduce
- Begin in windows, in a Wezterm terminal running powershell
- install v1.1.11 via
npm -g install opencode.ai - Configure the opencode.jsonc to allow autoupdate
- Wait for autoupdate
- restart opencode via
/exit, thenopencode - Observe windows defender notification about a trojan detected.
Screenshot and/or share link
Full testing, with uninstall / re-install test. I was using 1.1.11 previously, it was fine. This broke after the autoupdate
Operating System
Windows 11
Terminal
Wezterm
Activity
github-actions commentedon Jan 10, 2026
This issue might be a duplicate of existing issues. Please check:
Trojan:Win32/Wacatac.H!mlwhen running opencode #7592: [False Positive?] Windows Defender detectsTrojan:Win32/Wacatac.H!mlwhen running opencode (reported same day with same detection)These issues discuss the same Windows Defender heuristic detection and potential solutions including code signing and submitting false positives to Microsoft.
Feel free to ignore if your specific case differs from these reports.
Xavier-Burger commentedon Jan 10, 2026
I have tested each of the recent releases to find one that does not cause the false positive. It seems 1.1.8 is ok,
1.1.10+ is triggering the issue.EDIT: After looking into similar issues raised, this seems to be a heuristic based flagging. I am leaving this issues open as in my case I installed through npm, not through the downloadable package. I cannot whitelist the file, because this is my work machine and is pretty locked down.
For those stuck, run the below powershell commands (individually) to clear the temp folder, and install 1.1.8 explicitely. Also make sure to update your config to not autoupdate.
~\.config\opencode\opencode.jsonc:{ "$schema": "https://opencode.ai/config.json", "autoupdate": false, // Rest of you configuration... }Clearing temp and installing 1.1.8:
[-]Running opencode is flagged as trojan on windows after latest update[/-][+]Running opencode is flagged as trojan on windows - Installed through Node Package Manager[/+]markusbegerow commentedon Jan 11, 2026
This workaround is extremely useful, @Xavier-Burger! Thx a lot!
Molder72 commentedon Jan 11, 2026
Yesterday, Defender gave me the false positive on version 1.1.12
I disabled auto-update. (see previous post #7655 (comment))
I installed 1.1.8, which seemed fine, but today I had the same false positive with 1.1.8.
I installed 1.1.13, with the same false positive.
At every step, I uninstalled, cleaned, and reinstalled using npm, (see previous post #7655 (comment))
My "temporary" solution was to exclude some files from the Defender
\Local\Temp\folderIt may not be the final solution but for now it works.
In Administrator level PowerShell, use these commands one after the other.
Add-MpPreference -ExclusionPath "C:\Users\YOUR-USER\AppData\Local\Temp\*-00000000.dll"Add-MpPreference -ExclusionPath "C:\Users\YOUR-USER\AppData\Local\Temp\*-00000001.dll"Add-MpPreference -ExclusionPath "C:\Users\YOUR-USER\AppData\Local\Temp\*-00000002.dll"Add-MpPreference -ExclusionPath "C:\Users\YOUR-USER\AppData\Local\Temp\*-00000003.dll"at this point you can reactivate opencode auto-update. (see previous post #7655 (comment) )
In case, If you want to check what is excluded from defender usa:
Get-MpPreference | Select-Object -ExpandProperty ExclusionPathto remove from defender exclusions in the future use:
Remove-MpPreference -ExclusionPath "C:\Users\YOUR-USER\AppData\Local\Temp\*-00000000.dll"and 001 002 003.
repolevedavaj commentedon Jan 11, 2026
Even 1.1.8 gets now blocked on my machine. As its a corporate device, I am now stuck.. is there any other workaround or is someone trying to work around this issue?
Update: 1.1.7 works for me
DemOnJR commentedon Jan 21, 2026
Xavier-Burger commentedon Jan 21, 2026
False positive, opencode is new software. The team has responded on other issues, its due to their TUI package files not being signed. I think they are not primarily windows users.
github-actions commentedon Mar 28, 2026
To stay organized issues are automatically closed after 90 days of no activity. If the issue is still relevant please open a new one.
Hona commentedon Mar 29, 2026
As of OpenCode v1.3.4 across the CLI + Desktop apps, we have full code signing - so there should be no more warnings.
Please let me know otherwise
jdiaz97 commentedon Apr 11, 2026
Not my screenshot, but apparently the website gets flagged by https://www.malwarebytes.com/browserguard