Windows Defender reports Trojan:Win32/Wacatac.H!ml when launching the latest version of OpenCode

Hi team,

I encountered a security issue when launching the latest version of OpenCode on Windows.
Windows Defender immediately identifies the startup process as malicious activity and reports the threat Trojan:Win32/Wacatac.H!ml.

Environment:

OS: Windows 10 / Windows 11 (Windows 11)
OpenCode version: 1.1.8+ all of them

Detection details from Windows Defender:

Threat: Trojan:Win32/Wacatac.H!ml
Status: Active
Description: This program is dangerous and executes commands from an attacker.
Affected files are temporary DLLs generated under:
C:\Users\{UserName}\AppData\Local\Temp\{random}.dll

(Example from my system:)

C:\Users\xxx\AppData\Local\Temp\3aebf761ddfd7fd5-00000001.dll
C:\Users\xxx\AppData\Local\Temp\3aebf761ded7a7ed-00000000.dll
C:\Users\xxx\AppData\Local\Temp\3aebf67cd73efd-00000001.dll
C:\Users\xxx\AppData\Local\Temp\3aebf67d8c57b6f5-00000000.dll

Steps to Reproduce:

Install the latest version of OpenCode
Launch the application
Windows Defender immediately pops up a threat alert

Expected behavior:
Launching OpenCode should not trigger antivirus warnings.

Actual behavior:
Windows Defender flags the startup as malware and quarantines or blocks generated temp DLLs, preventing the program from running normally.

Additional notes:

This may be a false positive, but it severely affects normal usage.
Please help confirm whether this behavior is expected, and whether code signing or packaging needs adjustment.

Thanks! Let me know if you need more logs or diagnostic information.

Plugins

No response

OpenCode version

1.1.8+ all of them

Steps to reproduce

No response

Screenshot and/or share link

No response

Operating System

No response

Terminal

No response

This issue might be a duplicate of existing issues. Please check:

Windows Defender says Found Trojan #7821: Windows Defender says Found Trojan
Threat Found. Trojan:Script/Wacatac.H!ml #7669: Threat Found. Trojan:Script/Wacatac.H!ml
[False Positive?] Windows Defender detects Trojan:Win32/Wacatac.H!ml when running opencode #7592: [False Positive?] Windows Defender detects Trojan:Win32/Wacatac.H!ml when running opencode
Running opencode is flagged as trojan on windows - Installed through Node Package Manager #7655: Running opencode is flagged as trojan on windows - Installed through Node Package Manager
Windows Defender falsely flags new releases as trojans #3415: Windows Defender falsely flags new releases as trojans

Feel free to ignore if none of these address your specific case.

Happens to me too

Same here

I have the same problem.

Same here

I think we need code signing to prevent this

Same issue, was also blocked by Edge download security.

Same issue.

Same issue

this will probably keep happening until we get through the code signing process

opencode has a few binary deps (opentui for example) and on first start extracts them to a tmp folder

unfortunately some virus protectors are treating this is always malicious behavior

This is a bad one. Can't make it stop or get past it. Causes Opencode to just hang.

Same issue for me

It happened again in 1.1.23.
1.1.20 was okay.

same here

Me too, v1.1.25

me too. unusable

In addition to Defender warning for the installer:

there is also a Cordex warning when starting the app from the installer:

To stay organized issues are automatically closed after 90 days of no activity. If the issue is still relevant please open a new one.

As of OpenCode v1.3.4 across the CLI + Desktop apps, we have full code signing - so there should be no more warnings.

Please let me know otherwise

Navigation Menu

Repository navigation