Trojan: Script/Wacatac.H!m!

Description

After update 1.2.20 when i try to open opencode in my windows then i get this notfication Trojan: Script/Wacatac.H!m! and my opencode not opend. why is that happend ? and opencode not responceed any commend .

Plugins

No response

OpenCode version

1.2.20

Steps to reproduce

No response

Screenshot and/or share link

No response

Operating System

Windows 11

Terminal

PowerShell

This issue doesn't fully meet our contributing guidelines.

What needs to be fixed:

Several required fields are empty: OpenCode version, Operating System, Terminal, and Steps to reproduce — these are important for diagnosing the issue and should be filled in.

Please edit this issue to address the above within 2 hours, or it will be automatically closed.

This issue might be a duplicate of existing issues. Please check:

[False Positive?] Windows Defender detects Trojan:Win32/Wacatac.H!ml when running opencode #7592: [False Positive?] Windows Defender detects Trojan:Win32/Wacatac.H!ml when running opencode
Threat Found. Trojan:Script/Wacatac.H!ml #7669: Threat Found. Trojan:Script/Wacatac.H!ml
Windows Defender reports Trojan:Win32/Wacatac.H!ml when launching the latest version of OpenCode #7919: Windows Defender reports Trojan:Win32/Wacatac.H!ml when launching the latest version of OpenCode
Windows Defender Detected: Trojan:Win32/Wacatac.H!ml #13517: Windows Defender Detected: Trojan:Win32/Wacatac.H!ml
When I use OpenCode, Windows Defender pops up a security threat #16305: When I use OpenCode, Windows Defender pops up a security threat

If you believe this was flagged incorrectly, please let a maintainer know.

Can you please attach a screen recording

Thanks for updating the issue description! However, a few required fields are still empty:

Steps to reproduce — please describe what you did that triggered the Windows Defender notification (e.g., downloaded the installer, ran a specific command, etc.)
Operating System — please provide your Windows version (e.g., Windows 11 22H2)
Terminal — please specify which terminal you were using (e.g., Windows Terminal, PowerShell, CMD)

These details help maintainers investigate and reproduce the issue. Please edit the issue to fill them in.

I am currently having the same issue: Windows 11 25H2, Windows Terminal, once opening OpenCode.

OpenCode's TUI does not open, and a DLL that goes into my AppData Temp folder gets detected

Yeah, I have the same issue as well, started yesterday.

its happend after update 1.2.20

Thank you for updating the issue! It now meets our contributing guidelines. We appreciate you taking the time to provide the details.

Making a video now

Cap.2026-03-06.at.09.53.34.mp4

Also, Ctrl+C doesn't work to kill it.

when we give any prompt its not execute the prompt , its continue procesing no responce.

2026-03-06.15-05-14.mp4

I just ran into this too.
Symptoms

opencode freezes and doens't respond to ctrl-c
Company's I.T. calls to ask why I'm running malware....

@rony53

@rony53 want to add a security label to this?

Any update ?

we are waiting on Azure to approve our code signing certificate...

once wwe have that all these false positives should go awawy :)

Personally, I don't see it anymore. I don't know what I did to be honest...

I just ran into this too. Symptoms

opencode freezes and doens't respond to ctrl-c

Company's I.T. calls to ask why I'm running malware....

Same here!!! my IT team investigated my whole system and tools i have. Very embarrassing

Most likely it froze and was unresponsive due to the company anti virus closing the process.

To AVs like this - it looks like possible malware, due to how often we release the .exe is rarely downloaded.

Once we get code signing (been waiting on Microsoft approval for 2 weeks) this will go away

Is this still a problem? Waiting for this to get fixed before installing it on my school computer.

As of OpenCode v1.3.4 across the CLI + Desktop apps, we have full code signing - so there should be no more warnings.

Please let me know otherwise

Navigation Menu

Repository navigation

Trojan: Script/Wacatac.H!m! #16314

Description

Plugins

OpenCode version

Steps to reproduce

Screenshot and/or share link

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Trojan: Script/Wacatac.H!m! #16314

Description

Description

Plugins

OpenCode version

Steps to reproduce

Screenshot and/or share link

Activity

github-actions commented on Mar 6, 2026

Hona commented on Mar 6, 2026

github-actions commented on Mar 6, 2026

TotoCodeFR commented on Mar 6, 2026

Flybring commented on Mar 6, 2026

rony53 commented on Mar 6, 2026

github-actions commented on Mar 6, 2026

TotoCodeFR commented on Mar 6, 2026

TotoCodeFR commented on Mar 6, 2026

TotoCodeFR commented on Mar 6, 2026

rony53 commented on Mar 6, 2026

rony53 commented on Mar 6, 2026

VerdantForge commented on Mar 6, 2026

VerdantForge commented on Mar 6, 2026

rony53 commented on Mar 7, 2026

Hona commented on Mar 7, 2026

TotoCodeFR commented on Mar 7, 2026

Unmask06 commented on Mar 16, 2026

Hona commented on Mar 16, 2026

TotoCodeFR commented on Mar 26, 2026

Hona commented on Mar 29, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions